SCA identifies open source components in an application and helps teams manage security risks and compliance issues. A software bill of materials (SBOM) is an inventory of an app’s known dependencies, which SCA tools cross-reference against public and private databases.