In Invicti and Acunetix products, the SCA functionality is provided by a separate sensor (agent) that also includes IAST. This sensor runs in the application environment and has access to more back-end information, so it is able to identify vulnerable back-end components. Components and versions are identified not only based on signatures (like in other products) but by their unique fingerprints.
Read more about analyzing software composition with the Invicti Shark sensor.