A software composition analysis (SCA) tool scans your codebase for open source components, then creates a list of dependencies, which the tool checks against public and private databases. The tool then creates a list of violations, prioritized by threat score, based on the organization’s governance policies.