FOSSA Scan

What it does

FOSSA Scan is a software supply chain scanner that inventories third-party code across packages, containers, Software Bills of Materials (SBOMs), binaries, and code snippets to manage open source license compliance and dependency risk. The platform runs universal dependency analysis for 30+ languages through a zero-configuration cloud scan or the fossa-cli, pairing full-text license detection with 99.8% accuracy on non-standard and modified licenses with CVE identification, filtering, and prioritization.

How it works

Scans run from the CLI, CI/CD pipelines, or connected code hosts, resolving dependency graphs to unlimited depth and applying reachability-based Software Composition Analysis (SCA) so findings prioritize vulnerabilities reachable in production. A policy engine enforces pre-vetted or custom license and security rules during development, and a remediation algorithm weighs exploitability, upgrade impact, and effort to recommend fixes; fossabot adds automated pull-request checks and dependency updates. Reporting generates audit-grade attribution notices and SBOM exports in CycloneDX and SPDX, and imported third-party SBOMs are monitored against live vulnerability feeds. F5 NGINX uses the platform to automate SBOM generation.

Credentials and traction

FOSSA maintains SOC 2 compliance and was named a Niche Player in the inaugural 2026 Gartner Magic Quadrant for Software Supply Chain Security. Customers include UiPath, Collibra, Cloudera, DigiCert, Confluent, Applause, Lattice, and the U.S. Navy, alongside Cloud Native Computing Foundation projects. The platform's SBOM tooling supports Executive Order 14028 and NTIA minimum elements compliance, serving enterprise legal, security, and engineering teams.