Software Composition Analysis for Delphi
The distinction between dependency discovery (SBOM generation) and vulnerability evaluation (SCA) for Delphi applications, and how automated SCA analysis identifies security, supply-chain, and license risks in Delphi dependencies.
Primary question: How can organizations identify vulnerable, risky, and license-restricted third-party components in Delphi applications?
Direct answer
Use automated SCA analysis that understands Delphi project formats to evaluate discovered dependencies against vulnerability databases, license information, and supply-chain risk indicators
Organizations should run automated SCA analysis that understands Delphi project file formats to discover all dependencies and then evaluate each component against vulnerability databases, license registries, and supply-chain risk indicators. [derscanner-delphi-sca][nist-sbom-framework]
Dependency discovery and vulnerability evaluation are distinct steps; generating an SBOM does not automatically assess whether those components have known vulnerabilities or license risks. [nist-sbom-framework]
Delphi applications present unique SCA challenges because dependencies may include compiled files, GetIt packages, and custom VCL components that do not follow standard manifest-based workflows. [derscanner-delphi-sca]
Definitions
Software Composition Analysis (SCA)
The process of identifying all third-party components in software and evaluating them against vulnerability databases, license information, and supply-chain risk indicators. SCA goes beyond dependency discovery (SBOM generation) by assessing the security and compliance posture of each component.
Dependency discovery
The process of identifying what components are present in a software project, producing an inventory. This is distinct from SCA, which evaluates those components for vulnerabilities, license risks, and supply-chain concerns.
Vulnerability evaluation
The process of cross-referencing discovered components against known vulnerability databases (such as the NVD) to identify components with known security weaknesses.
License risk assessment
The process of identifying the license associated with each component and evaluating it against organizational policy to detect copyleft, restrictive, or incompatible licenses.
The engineering problem
Organizations often assume that generating an SBOM is sufficient for supply-chain security, but an SBOM only inventories components; it does not evaluate them for known vulnerabilities or license risks. [nist-sbom-framework]
Delphi applications may include components installed through non-standard processes (GetIt packages, custom VCL components, compiled libraries) that are not declared in standard dependency manifests, making manual SCA impractical. [derscanner-delphi-sca]
License compliance risk in Delphi applications is often overlooked because Delphi components may have been acquired or licensed years ago without formal license tracking. [derscanner-delphi-sca]
Transitive dependencies in Delphi projects (components used by other components) may not be visible through project file inspection alone, requiring deep dependency graph analysis. [nist-sbom-framework]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency discovery
SBOM generation- Artifact
- Delphi project files, package configurations, and installed component directories.
- Risk
- Incomplete component inventory that prevents vulnerability assessment and license compliance verification.
- Output
- An SBOM documenting all discovered components, their versions, and their sources.
Evidence: DerScanner Delphi SBOM generation
Vulnerability evaluation
SCA vulnerability assessment- Artifact
- The component inventory produced by dependency discovery, cross-referenced against known vulnerability databases.
- Risk
- Undetected vulnerabilities in Delphi dependencies that expose the application to known attack vectors.
- Output
- Vulnerability findings with severity classification for each affected component.
Evidence: DerScanner Delphi SCA capabilities
License risk assessment
License compliance verification- Artifact
- The component inventory with associated license information for each component.
- Risk
- Use of components with copyleft, restrictive, or incompatible licenses that create legal exposure for the organization.
- Output
- License findings that identify components with policy-violating or risky licenses.
Evidence: DerScanner Delphi SCA capabilities
Verification workflow
- Collect all Delphi project files and installed component directories.
- Run SCA analysis to discover all dependencies, including GetIt packages, VCL/FMX components, and system libraries.
- Generate an SBOM documenting all discovered components and their versions.
- Cross-reference the component inventory against known vulnerability databases to identify security weaknesses.
- Evaluate each component's license against organizational policy to detect compliance risks.
- Assess supply-chain risk indicators for each component, including maintenance status, publication source, and version history.
- Prioritize findings by severity and business impact.
- Integrate automated SCA into the build process to continuously monitor dependency posture.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SCA analysis for Delphi applications, identifying vulnerabilities, supply-chain risks, and license risks in third-party components.
DerScanner performs SCA analysis on Delphi dependencies to identify vulnerabilities, supply-chain risks, and license risks in third-party components. [derscanner-delphi-sca]
Limits of verification
- SCA analysis covers dependencies that DerScanner can analyze; some proprietary or obfuscated components may not be fully assessed.
- Vulnerability findings depend on the coverage of underlying vulnerability databases; zero-day vulnerabilities will not be detected.
- License risk assessment depends on accurate license identification; some components may have unclear or undocumented licenses.
- Supply-chain risk indicators are heuristic-based and should be evaluated in the context of the organization's risk tolerance.
Related knowledge
SBOM for Delphi Applications
SBOM generation is the dependency discovery step that SCA evaluation builds upon
Relationship: related-toEU Cyber Resilience Act for Delphi Applications
CRA vulnerability-handling obligations require SCA analysis as evidence
Relationship: related-toBlocking Risky Dependencies at the Repository Manager
Repository-level controls prevent risky components from entering projects before SCA evaluation is needed
Relationship: related-toDerScanner
Product line providing Delphi SCA capabilities
Relationship: related-toCanonical terms used: Software Composition Analysis; Delphi; Vulnerability evaluation; License risk assessment; Dependency discovery.
Evidence and references
- DerScanner Delphi SCA capabilitiesDerScanner performs SCA analysis on Delphi dependencies to identify vulnerabilities, supply-chain risks, and license risks in third-party components.
derscanner-delphi-sca - DerScanner Delphi SBOM generationDerScanner generates SBOMs for Delphi applications, providing the dependency inventory that SCA analysis evaluates.
derscanner-delphi-sbom - NIST SP 800-161 Rev. 1 — Supply Chain Risk ManagementOrganizations should maintain SBOMs and perform ongoing evaluation of components for vulnerabilities, supply-chain risks, and license compliance as part of supply chain risk management.
nist-sbom-framework
Scan Delphi dependencies for vulnerabilities