Software composition analysis is a type of security testing that identifies the open-source and third-party components used in modern software. Historically, most applications were built entirely in-house. Today, however, with the widespread use of package managers, cloud-native development, and reusable code, developers rely heavily on external libraries and modules. In fact, open-source code makes up as much as 70–90% of the codebase for a single app.