SBOM vs SCA vs Hybrid Analysis
A clear layered model explaining the difference between SBOM (what components are present), SCA (what known vulnerabilities, supply-chain, and license risks are associated with those components), and hybrid SAST + SCA analysis (how vulnerable dependency functionality relates to actual application code usage).
Primary question: What is the difference between an SBOM, SCA, and hybrid SAST + SCA analysis?
Direct answer
SBOM, SCA, and hybrid SAST+SCA analysis are three distinct but complementary layers of dependency security
SBOM, SCA, and hybrid SAST+SCA analysis are three distinct but complementary layers of dependency security. SBOM inventories components, SCA evaluates those components for known risks, and hybrid SAST+SCA analysis correlates vulnerable components with application code usage to provide code-level reachability evidence. [derscanner-sca][nist-sbom-framework]
Each layer serves a different purpose — SBOM provides visibility into what is present, SCA provides evaluation of known risks, and hybrid analysis provides prioritization evidence by correlating component risk with application code behavior. [derscanner-sca]
Organizations should use all three layers together — SBOM generation for dependency discovery, SCA for vulnerability and license evaluation, and hybrid SAST+SCA analysis for code-level reachability evidence to prioritize findings. [derscanner-sca]
Definitions
SBOM (Software Bill of Materials)
A formal record containing the details and supply chain links of all components, libraries, and dependencies used to build a software product. An SBOM answers the question — what components are present in this software?
SCA (Software Composition Analysis)
The process of identifying all third-party components in software and evaluating them against vulnerability databases, license information, and supply-chain risk indicators. SCA answers the question — what known vulnerabilities, supply-chain risks, and license risks are associated with those components?
Hybrid SAST + SCA analysis
The correlation of SCA findings (vulnerable components) with SAST findings (application code behavior) to determine which vulnerable dependency functionality is actually called or imported from application code. Hybrid analysis answers the question — how does vulnerable dependency functionality relate to actual application code usage?
Reachability analysis
The process of determining whether vulnerable functionality inside a dependency is actually reached from application code through import statements, function calls, and code paths. Reachability analysis is a core capability of hybrid SAST+SCA analysis.
The engineering problem
Organizations often confuse SBOM generation with SCA analysis. An SBOM only inventories components; it does not evaluate them for known vulnerabilities, supply-chain risks, or license risks. [nist-sbom-framework]
SCA analysis identifies vulnerable components but does not determine whether the vulnerable functionality is actually used from application code. This can lead to over-prioritization of findings that are not reachable from the application. [derscanner-sca]
Without hybrid SAST+SCA analysis, teams lack code-level evidence about which vulnerable dependency functions are actually imported or called from application code, making prioritization more difficult. [derscanner-sca]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency inventory
SBOM generation- Artifact
- Dependency manifests, project files, and installed component directories.
- Risk
- Incomplete component inventory that blocks vulnerability assessment and supply-chain evaluation.
- Output
- An SBOM documenting the components discovered by the selected resolution and analysis methods, their versions, and their sources.
Evidence: DerScanner software composition analysis documentation
Component evaluation
SCA analysis- Artifact
- The component inventory produced by SBOM generation, cross-referenced against vulnerability databases, license registries, and supply-chain risk indicators.
- Risk
- Undetected vulnerabilities, license risks, and supply-chain risks in third-party components.
- Output
- Component-level findings including vulnerability severity, license type, and supply-chain risk assessment.
Evidence: DerScanner software composition analysis documentation
Reachability analysis
Hybrid SAST + SCA analysis- Artifact
- Application source code and dependency functionality, correlated to determine which vulnerable dependency functions are actually called or imported from application code.
- Risk
- Vulnerable dependencies whose vulnerable functionality is not reached from application code, leading to over-prioritization of findings.
- Output
- Code-level reachability evidence showing which vulnerable dependency functions are imported or called from application code.
Evidence: DerScanner software composition analysis documentation
Verification workflow
- Generate an SBOM documenting the components discovered by the selected resolution and analysis methods in the software project.
- Run SCA analysis to evaluate each component against vulnerability databases, license registries, and supply-chain risk indicators.
- Run hybrid SAST+SCA analysis to correlate vulnerable components with application code behavior, determining which vulnerable dependency functions are actually reached from application code.
- Use SBOM for dependency inventory and compliance reporting.
- Use SCA findings for vulnerability management and license compliance.
- Use hybrid reachability evidence for prioritization and triage of SCA findings.
- Integrate all three layers into the build process for continuous dependency security visibility.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SBOM generation, SCA analysis, and hybrid SAST+SCA analysis as complementary capabilities within a single platform.
DerScanner performs SCA analysis and provides hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization. [derscanner-sca]
Limits of verification
- SBOM generation does not evaluate components for vulnerabilities, license risks, or supply-chain risks.
- SCA analysis identifies vulnerable components but does not determine whether the vulnerable functionality is reached from application code.
- Reachability analysis provides evidence about code paths but does not by itself prove exploitability.
- Hybrid analysis requires source code availability; code-level reachability evidence may not be available for artifacts without source access.
- Production acceptance remains an organizational engineering decision.
Related knowledge
Dependency Security for AI-Generated Code
Umbrella page covering the broader dependency security analysis model for AI-generated applications
Relationship: related-toHybrid SAST + SCA Analysis
Detailed explanation of hybrid analysis concept and engineering model
Relationship: related-toVulnerable Function Reachability
Deep technical explanation of reachability analysis
Relationship: related-toSBOM for Delphi Applications
SBOM generation for Delphi applications
Relationship: related-toSoftware Composition Analysis for Delphi
SCA evaluation for Delphi applications
Relationship: related-toDerScanner
Product line providing SBOM, SCA, and hybrid analysis capabilities
Relationship: related-toCanonical terms used: SBOM; SCA; Hybrid SAST + SCA analysis; Reachability analysis.
Evidence and references
- NIST SP 800-161 Rev. 1 — Supply Chain Risk ManagementOrganizations should maintain SBOMs as part of supply chain risk management practices to enable vulnerability assessment and incident response. SBOMs should document all components, including transitive dependencies.
nist-sbom-framework - DerScanner software composition analysis documentationDerScanner SCA identifies component vulnerabilities, dependencies, software supply chain risks, and license risks. DerScanner provides hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization.
derscanner-sca
Understand the three layers