Contrast SCA

Contrast SCA is a Software Composition Analysis solution that uniquely prioritizes vulnerabilities based on runtime library usage, showing which vulnerable components are actually executed in production.

What is Contrast SCA?

Contrast SCA analyzes third-party dependencies and open-source libraries for known vulnerabilities.

Unlike traditional SCA tools that only look at manifest files, Contrast SCA uses runtime instrumentation to determine which libraries are actually executed.

This runtime awareness dramatically reduces noise by focusing on vulnerabilities in code paths that are actively used.

Key Differentiator: Runtime Prioritization

Traditional SCA tools report all vulnerabilities in all dependencies:

Traditional SCA:
├── 247 dependencies
├── 89 vulnerabilities
└── Which ones matter? 🤷

Contrast SCA shows runtime usage:

Contrast SCA:
├── 247 dependencies
├── 89 vulnerabilities
├── 12 in loaded libraries
├── 3 in executed code paths
└── Focus on these 3 first ✓

Key Features

Runtime Visibility

Contrast tracks library usage down to the class and method level:

• Which classes are loaded
• Which methods are called
• How often code paths execute
• Call stack context

Vulnerability Reachability

Determines if vulnerable code is actually reachable:

• Static analysis of call graphs
• Runtime execution data
• Data flow to vulnerable methods

License Compliance

Tracks open-source license obligations:

• License identification
• Compliance policy enforcement
• License conflict detection
• Attribution generation

SBOM Generation

Generate Software Bill of Materials:

• CycloneDX format
• SPDX format
• Custom export options

How It Works

Contrast SCA uses the same agent as Contrast Assess and Protect:

Application
    └── Contrast Agent
            ├── Library inventory
            ├── Runtime monitoring
            └── Vulnerability correlation

The agent observes which libraries and classes execute, providing ground-truth usage data.

Integration

CI/CD Pipeline

# GitHub Actions example
- name: Contrast SCA Analysis
  uses: Contrast-Security-OSS/contrastagent-action@v2
  with:
    application-name: 'my-app'
    contrast-api-key: ${{ secrets.CONTRAST_API_KEY }}

IDE Integration

Available for:

• IntelliJ IDEA
• VS Code
• Eclipse

SCM Integration

• GitHub Security Advisories
• GitLab Security Dashboard
• Bitbucket Security

Reporting

Priority-Based Reports

Reports are organized by actual risk:

Compliance Reports

Generate compliance documentation:

• SOC 2 evidence
• PCI DSS requirements
• GDPR technical measures

When to Use Contrast SCA

Contrast SCA is ideal for organizations that:

• Want to reduce SCA alert noise
• Need runtime-aware vulnerability prioritization
• Already use Contrast Assess or Protect
• Require accurate reachability analysis