In earlier years of software development, security testing was often conducted toward the end of the SDLC. However, the later in the SDLC compliance or vulnerability issues are detected, the more costly and time-consuming it is to resolve them. As such, most FOSSA customers choose to integrate our software composition analysis solution with their CI/CD pipeline, as part of the build process. Any time a new change is committed and a build is triggered, a new scan happens. This provides immediate feedback to developers very early in the dev cycle and reduces the cost of resolving the issue.