# software composition analysis Published articles for software composition analysis. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Chainguard Images are the Gold Standard for PCI DSS v4.0 DevFeed: [Chainguard Images are the Gold Standard for PCI DSS v4.0]() Original publisher: [Read original article]() Published: 2025-02-03T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [chainguard images](), [container-security](), [Containers](), [supply-chain-security](), [vulnerability management]() Tags: [chainguard](), [chainguard-images](), [chainguard-sboms](), [compliance](), [container](), [container-image](), [container-image-compliance](), [container-images](), [container-security](), [containers](), [cryptography](), [financial](), [pci-dss](), [pci-dss-v4-0](), [sboms](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [stig](), [vulnerability](), [vulnerability-management]() ### AI overview The article explains how Chainguard Images can support selected PCI DSS v4.0 container-security controls. It focuses on asset and vulnerability management, hardened images, FIPS cryptography, build-time SBOMs, software supply chain inventory, and continuously updated containers. ### Source excerpt Chainguard Images are designed to make container image compliance for PCI DSS v4.0 easy for any company involved in card transactions. ## Snyk named a Customer Favorite in The Forrester Wave™: Software Composition Analysis Software, Q4 2024 Report DevFeed: [Snyk named a Customer Favorite in The Forrester Wave™: Software Composition Analysis Software, Q4 2024 Report]() Original publisher: [Read original article]() Author: Peter McKay Published: 2024-11-13T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk-open-source](), [Application Security](), [DevSecOps](), [Automation](), [Security](), [GitHub]() Tags: [acquisition](), [analytics](), [application-security](), [aspm](), [automation](), [awareness](), [blog](), [component](), [customer](), [developer-security-platform](), [devops](), [devsecops](), [executive](), [innovation](), [integration](), [megawatt](), [open-source-security](), [pmm](), [recognition](), [report](), [sca](), [secure-software](), [shift-left](), [snyk](), [snyk-open-source](), [software-composition-analysis](), [software-development](), [strategy](), [support]() ### AI overview Snyk announces that it was recognized as a Leader and a Customer Favorite in The Forrester Wave: Software Composition Analysis Software, Q4 2024. The article highlights Snyk's scores for strategy, risk intelligence, remediation and automation, reporting and analytics, toolchain integration, and component health, along with its developer-first approach to application security and DevSecOps. ### Source excerpt Snyk's developer-first approach secures recognition as a Customer Favorite and a Leader in The Forrester Wave™: Software Composition Analysis (SCA) Software, Q4 2024 report. ## Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities DevFeed: [Vulnerability fixes in plain sight: How your scanners are missing hundreds of vulnerabilities]() Original publisher: [Read original article]() Published: 2024-06-12T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [Vulnerabilities](), [Security](), [chainguard](), [NVD](), [chainguard images](), [container images](), [Open Source]() Tags: [chainguard](), [chainguard-images](), [container-images](), [cve](), [cve-list](), [cves](), [nvd](), [open-source-software](), [remote-code-execution-vulnerability](), [research](), [sca](), [security](), [software-composition-analysis](), [vulnerabilities](), [vulnerability-fix](), [vulnerability-scanning](), [wolfi]() ### AI overview An analysis of more than 600 Wolfi-packaged projects found over 100 security fixes without associated CVEs. Because vulnerability scanners and SCA tools rely on vulnerability databases such as the NVD, organizations may miss fixes unless they keep software updated. ### Source excerpt Are your vulnerability scanners missing critical security flaws? Discover how Chainguard's research reveals hundreds of vulnerabilities hiding in plain sight. ## Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration DevFeed: [Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-11-07T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [supply-chain-security](), [snyk-open-source](), [Vulnerabilities](), [Application Security]() Tags: [acquisition](), [awareness](), [blog](), [developer](), [related-content](), [sbom](), [sca](), [security](), [snyk](), [snyk-platform](), [software-bill-of-materials](), [software-composition-analysis](), [software-supply-chain](), [supply-chain](), [supply-chain-security](), [visibility](), [vulnerability]() ### AI overview The article introduces Snyk Vulnerability Intelligence for SBOM, an integration that brings Snyk vulnerability data into SBOMs stored in ServiceNow Vulnerability Response. It uses package URLs to identify vulnerable components, provides contextual severity and remediation information, and supports dashboards and workflows for tracking and fixing software supply chain risk. ### Source excerpt The new Snyk Vulnerability Intelligence for SBOM integration brings visibility to your SBOMs in ServiceNow Vulnerability Response for a more accurate understanding of risk within the enterprise supply chain. ## Snyk's 2023 State of Open Source Security: Supply chain security, AI, and more DevFeed: [Snyk's 2023 State of Open Source Security: Supply chain security, AI, and more]() Original publisher: [Read original article]() Author: Simon Maple Published: 2023-07-26T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [open-source-security](), [supply-chain-security](), [Security](), [Artificial Intelligence](), [Application Security]() Tags: [acquisition](), [ai](), [blog](), [developer](), [executive](), [false-positives](), [megawatt](), [open-source-security](), [report](), [sca](), [security](), [snyk](), [snyk-open-source](), [software-composition-analysis](), [supply-chain](), [supply-chain-security]() ### AI overview Snyk's 2023 State of Open Source Security report examines whether open source software security is improving after Log4Shell. It highlights gaps in supply chain security practices, slow adoption of foundational tools such as SCA and SAST, and mixed results and opinions surrounding AI and automation, including increased false positives. ### Source excerpt Read Snyk's 2023 State of Open Source Security report to learn why AI, false positives, and slow security tool adoption remain concerns but faster fixes and supply chain security progress are encouraging signs in open source security. ## 8 tips for securing your CI/CD pipeline with Snyk DevFeed: [8 tips for securing your CI/CD pipeline with Snyk]() Original publisher: [Read original article]() Author: Eric Smalling Published: 2023-07-20T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [CI/CD](), [snyk](), [snyk-open-source](), [Application Security](), [GitHub Actions](), [Jenkins]() Tags: [application-security](), [blog](), [cheat-sheet](), [ci-cd](), [ci-cd-pipeline](), [devops](), [devrel](), [devsecops](), [enablement](), [github-actions](), [jenkins](), [security](), [snyk](), [snyk-open-source](), [snyk-platform](), [software-composition-analysis]() ### AI overview This cheat sheet presents eight tips for securing CI/CD pipelines with Snyk. It covers dependency and open-source component scanning, vulnerability detection, remediation guidance, and implementation examples for Jenkins and GitHub Actions. ### Source excerpt In this post, we'll cover using Snyk in your CI/CD pipelines to catch security issues quickly and empower your developers to fix them before they ever get to production. ## Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation DevFeed: [Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation]() Original publisher: [Read original article]() Published: 2023-01-26T00:00:00Z Content type: article Language: en Sources: [Chainguard: Unchained]() Topics: [software bill of materials](), [supply-chain-security](), [software dark matter](), [vulnerability management](), [Reverse Engineering](), [Containers]() Tags: [apko](), [chainguard-images](), [container-security](), [guessbom](), [melange](), [reverse-engineering](), [sbom](), [sboms](), [sca](), [shift-left](), [software-composition-analysis](), [software-dark-matter](), [software-supply-chain](), [vulnerability]() ### AI overview The article argues that SBOMs generated after a build by software composition analysis tools can be incomplete because they may miss components that bypass recorded metadata, such as files copied through Dockerfiles. It presents build-time generation as a better way to produce complete SBOMs and describes untracked files as software dark matter, which can make post-build SBOMs closer to best guesses than reliable inventories. ### Source excerpt GuessBOMs, SBOMs generated by reverse-engineering software artifacts, have severe limitations. The optimal point for generating complete SBOMs is at build time. ## Improving the Developer Experience -- Our Application Security Journey (Part 3) DevFeed: [Improving the Developer Experience -- Our Application Security Journey (Part 3)]() Original publisher: [Read original article]() Author: Florian Wirtz Published: 2023-01-17T11:19:44Z Content type: article Language: en Sources: [Wise Engineering - Medium]() Topics: [Application Security](), [Developer experience](), [vulnerability management](), [dashboards](), [software composition analysis](), [trivy]() Tags: [application-security](), [dashboards](), [developer-experience](), [platform](), [security](), [software-composition-analysis](), [trivy](), [vulnerability-management]() ### AI overview This third article in Wise's application security series examines how to improve developers' experience when fixing vulnerabilities. It describes feedback gathered through surveys and interviews, identifying slow dashboards and the need for developers to proactively check them as key pain points. ### Source excerpt Improving the Developer Experience -- Our Application Security Journey (Part 3) This is the third in a series of articles on the state of Application Security at Wise, describing our integration of security in the Software Development Lifecycle. Photo by Possessed Photography on Unsplash In part three of our blog post series we will be focusing on how we can improve the developers' experience around fixing vulnerabilities. We explore how we identified the main pain points developers were facing, what we did to improve this experience and future improvement ideas that we are planning to work on. Recap: What happened so far? Over the course of the last year we have created our new setup for identifying vulnerabilities at Wise. It's centred around DefectDojo as our vulnerability management tool and we use scanners, such as Trivy for Software Composition Analysis, as inputs. You can learn more about our setup in part one of this blog series. Since then we have also created various dashboards to report vulnerabilities to our stakeholders, and also improved our Service-level agreement (SLA) with our developers to resolve new vulnerabilities. To learn more about that, please read part two of this series. What issues are our developers facing? As a next step, it's important to check in with our developers to see how they're interacting with our program. It's one thing to set up a vulnerability management program, but we also need to make sure that it actually works for our users and that the recommendations provided are actioned in a timely manner. While the initial feedback we received from developers was promising, we decided to share a survey with them to collect more actionable feedback. Our survey had a mix of multiple-choice and free-form questions and was mostly focused on how developers are using our tools and what issues they might be facing with them. We also interviewed them for analogous use cases, including what works well and what doesn't work well in other too