SCA / SBOM

Software Composition Analysis

Find vulnerable dependencies — most of your risk lives in code you didn't write.

Launch heimdallXAll capabilities

The overwhelming majority of vulnerabilities live in transitive dependencies — code your team never wrote. Connect a repository and heimdallX parses your manifests, queries the OSV database, and turns every vulnerable package into a finding, complete with CVE references that flow into the Validation Core for EPSS/KEV enrichment. A raw SBOM gives you the full component inventory.

heimdallx.ai/appheimdallXPROUpgradeAI analystNew scanSign outAAcme Securityacme-prodCommand centerOverviewExecutive BriefFindings24Remediation7Assets18OperationsDiscoveryAttack Surface5Breach SimThreat IntelMonitoring3Compliance12IntegrationsActivityExternal ThreatsExternal Threats9Threat FeedAI BriefingFindingsCode Security · SBOMSBOM142dependencies31 vulnerable111 up-to-datenpm · PyPI · OSVDependenciesllodash4.17.11 · transitiveCVE-2020-28500Vulnmminimist1.2.0 · transitiveCVE-2021-44906Vulneexpress4.18.2 · directOKrreact18.2.0 · directOK

The risk you inherited

Modern apps are mostly dependencies, and most of those are transitive — pulled in by the packages you chose. heimdallX reads npm (package.json) and PyPI (requirements.txt) manifests so the components you actually ship are the ones under analysis.

OSV-backed, CVE-enriched

Each manifest is checked against OSV via a batched query, then bounded advisory lookups pull the detail — CVE aliases and severity. Every vulnerable package becomes a "Vulnerable Dependency" finding whose CVE references flow straight into the Validation Core for KEV and EPSS enrichment.

Mapped to compliance

Dependency findings are mapped to the controls auditors ask about — OWASP A06 (Vulnerable & Outdated Components), PCI-DSS 6.3.3 and ISO 27001 A.8.8 — so software composition risk lands in your compliance posture automatically.

How it works

1

Parse

Read npm and PyPI dependency manifests.

2

Query

Batch-query the OSV vulnerability database.

3

Detail

Pull advisory CVE aliases and severity.

4

Enrich

Emit findings + SBOM; CVEs → Validation Core.

From manifest to validated CVE
package.json → lodash 4.17.11
→ OSV advisory: prototype pollution
  alias CVE-2020-28500  ·  EPSS 0.07
→ mapped: OWASP A06 · PCI 6.3.3 · ISO A.8.8

Explore more

Exploit validation

Exploitability Validation Core

Stop chasing severity. Rank by what's actually exploitable — EPSS probability, CISA KEV, and proven reachability.

Learn more →
Active validation

Proof-based Active Testing

Confirm vulnerabilities by safely triggering them — reflected XSS, error-based SQLi and open redirects, proven not guessed.

Learn more →
Adversary emulation

Attack Simulation & MITRE ATT&CK

See findings the way an adversary chains them — mapped to MITRE ATT&CK tactics and techniques.

Learn more →

Put it to work

Run your first scan in under two minutes. Free, no credit card, real findings.

Launch heimdallX
Software Composition Analysis — heimdallX