Software Supply Chain
Automated Security and Compliance for your Software Supply Chain
Our range of services to assist you Software Supply Chain needs
OpenChain Conformance
Technical Due Diligence
Open Source Program Office
Software Composition Analysis
Software Bill of Materials
Training
Frequently Asked Questions
Below you can find a selection of FAQs. If you still have questions after this, please contact us and we would be happy to help!
There are two options for scanning your application code. First, you can share the source code via a shared folder for scanning. Second, we can provide an agent to allow you to scan the code within your environment without needing to share the source code.
A direct source code scan captures more details like copyright notices and URLs along with vulnerabilities, licensing, and operational issues, allowing for a thorough audit of the code. An agent-based scan captures only metadata related to vulnerabilities and licensing. Agent-based scanning is ideal for companies that prefer not to share their source code.
Source Code Control is tool-agnostic and does not sell specific tools. However, we help clients evaluate various tools, providing insights into pros and cons to assist in making the right choice based on their specific needs and objectives.
There are increasing global regulations mandating transparency in the use of third-party components and libraries in code. This impacts all software companies. An SBOM helps as part of an overall cybersecurity strategy and builds trust in software supplied to customers and stakeholders.
In addition to our standard training modules, we can design bespoke training sessions tailored to your team’s specific needs, covering both foundational and technical concepts. We also offer workshops to help teams optimize their use of tools and practices effectively.
The OpenChain project establishes best practices to enhance open-source license compliance, security assessments, and documentation processes. By ensuring that software is delivered with accurate and consistent information about its open-source components, it helps build trust in the software supply chain.
