Some vendors wrap this functionality into existing SCA or software supply chain bundles, but others charge extra for it. Supplemental Material Survey Methodologies For Forrester’s Q4 2024 Software Composition Analysis Software Forrester Wave™ Customer Reference Survey, Forrester surveyed 28 reference customers submitted by the participants in The Forrester Wave™: Software Composition Analysis Software, Q4 2024.

Forrester Wave™: Software Composition Analysis Software, Q4 2024 This graphic plots vendors by their overall ranking, determined by current offering and strategy scores. This graphic has an associated spreadsheet that includes all data presented. Please access the spreadsheet for details. Figure 1 Forrester Wave™: Software Composition Analysis Software Scorecard, Q4 2024 This table shows vendors’ criteria scores by current offering and strategy.

Software Composition Analysis Software: Functionality By Core Use Case This table lists functionalities and indicates which use cases they apply to. This graphic has an associated spreadsheet that includes all data presented. Please access the spreadsheet for details. Figure 5 Software Composition Analysis Software: Functionality By Extended Use Case This table lists functionalities and indicates which use cases they apply to.

Source: Forrester’s Q1 2023 Software Composition Analysis Forrester Wave™ Customer Reference Survey. Figure 5 Supplemental Material Survey Methodologies Forrester surveyed 31 reference customers submitted by the participants in The Forrester Wave™: Software Composition Analysis, Q2 2023. Beyond collecting information about their feelings about their particular vendor, Forrester asked references about their top priorities and adoption trends.

Even startups promising AI agents for code security bundle SAST, software composition analysis (SCA), and infrastructure-as-code (IaC) scanning functionality together. AI-assisted and AI-generated code is collapsing the SDLC while making it easy for new entrants to the application security market to create a credible product.

Embedding security leads and developer security champions on product teams makes them responsible for static and dynamic application security testing, software composition analysis, application threat modeling, and vulnerability remediation.

Many developers said their enterprises were planning to adopt or continue using emerging cloud-native development technologies, including cloud-resident continuous integration and continuous delivery tools, test automation, development environments, agile planning tools, software composition analysis tools, and device labs (see Figure 2). This reflects continued interest in developing code as close to cloud workloads as possible.

Figure 5 Supplemental Material Related Research Introducing The Forrester IT Management Systems Architecture The Forrester Wave™: Cloud Cost Management And Optimization Solutions, Q3 2024 The Forrester Wave™: Collaborative Work Management Tools, Q2 2025 The Forrester Wave™: Integrated Software Delivery Platforms, Q2 2023 The Forrester Wave™: Software Composition Analysis, Q2 2023 Establish Technology Lifecycle Management To Control Technical Debt The Forrester Wave™: Enterprise Architecture Management

Key Testing Tools See Adoption Throughout The Software Development Lifecycle Forty-nine percent of security decision-makers report that their organization implements dynamic application security testing (DAST) and software composition analysis (SCA) during the testing phase of the software development lifecycle (see Figure 6).

Support TLM on the back end with data from software asset management, attack surface management, software composition analysis, scanning, tools, and package managers. Organizations increasingly require that all downloaded software, including earliest-stage evaluation, be checked into a central package manager such as Cloudsmith or JFrog Artifactory — both of which can perform software composition analysis — before installation.