Where this offering fits
Checkmarx SCA addresses risk in third-party software components. Selection should focus on the application’s supported ecosystems, dependency context and remediation process. A useful result identifies what is present, why it matters and who can change the affected build.
Architecture and rollout decisions
Compare a pilot application’s detected dependencies with its manifests and build artefacts. Review direct and transitive components, then validate the workflow for updating and rescanning. Security and licence questions may have different reviewers. Record accepted exceptions with their basis and next review rather than hiding them in a blanket suppression.
An evaluation scenario for this offering
Create a representative build with a documented direct dependency and another introduced through a transitive path. Compare the SCA inventory with both the manifests and the actual build context supported by the chosen configuration. Review one security issue and one component-use question with their appropriate owners. Replace an approved test dependency, rebuild and confirm the relevant record changes. The evidence should explain which application is affected, what was updated and why any remaining exception is acceptable. A complete-looking component list is insufficient if the organisation cannot identify who can change the dependency and validate the resulting application.
Evidence to request for this scope
- Confirm ecosystem and dependency coverage.
- Verify a known component and its update.
- Assign ownership for security and licence review.