SECAI Core · phase 12 of 15
Software composition analysis
Tools designed to assist with identification of third-party and open-source code during software development and deployment.
The Explain card
- Plain English
- SCA tools identify the third-party and open-source components inside your software during development and deployment, then check them for known vulnerabilities and license issues.
- Example
- An SCA scan of an ML service lists every Python package, flags an outdated serialization library with a known remote code execution flaw, and recommends the patched version.
- Why it matters
- AI stacks pull in hundreds of dependencies, many maintained by small teams. SCA shows defenders what is actually in the build so a single vulnerable library does not compromise the whole model pipeline.
- Hook
- The ingredients list for your code.
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
