A LOOK AT SOFTWARE COMPOSITION ANALYSIS

Summary from the TLDR InfoSec newsletter

Doyensec published a whitepaper on the results of testing Snyk, Dependabot, and Semgrep for SCA. The goal of the test was to find which tool had the highest true positive rate with the lowest false positive rate, while ignoring false negative rate. The test found that Dependabot had the highest true positive rate but also the highest false positive rate while Semgrep had the second highest true positive rate and the lowest false positive rate.