I’ve been comparing several software composition analysis tools, including Vulert, to understand how differently they identify and prioritize vulnerable dependencies.

Most SCA products appear similar at first glance, but the results can vary significantly depending on features such as:

Detection of direct and transitive dependencies Support for lockfiles and package manifests Vulnerability database coverage and update speed Reachability or exploitability analysis Handling of withdrawn, disputed, or duplicate advisories Fix-version and dependency-upgrade recommendations SBOM generation and export formats CI/CD, GitHub, GitLab, and IDE integrations License-risk detection Support for repositories that cannot run an agent Noise reduction and false-positive handling

The most interesting difference is not always the number of vulnerabilities found. A tool that reports 100 issues may be less useful than one that clearly explains which five require immediate action.

I’m considering publishing a comparison using the same set of public repositories and measuring:

Vulnerabilities detected Transitive dependencies identified Actionable fixes provided False positives or duplicate findings Setup time Quality of the developer workflow

What features or test cases would you consider essential for a fair SCA comparison?

I’d especially like feedback from developers who have used tools such as Snyk, Mend, Dependabot, Trivy, Grype, osv-scanner, or Vuler