FOSSA review
A mature SCA platform covering dependencies, SBOMs, containers, licenses, and policy controls.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
FOSSA is a software supply chain security and compliance platform for engineering, security, and legal teams. It analyzes direct and transitive open-source dependencies, identifies license and vulnerability issues, generates and manages SBOMs, and supports policy enforcement and remediation workflows. Its coverage suits teams that need software composition analysis across application dependencies, container images, source repositories, and development pipelines rather than a tool limited to one scanning workflow.
The published plans offer a useful entry path. The Free plan costs $0 forever and includes 5 projects, 10 contributing developers, container scanning, API access, and SBOM export. Business costs $20 per project per month when billed annually and adds automated license and vulnerability scanning, unlimited dependency levels, multi-project reporting, and 10 projects or SBOM imports. Enterprise adds unlimited projects, a custom developer count, custom deployment options, SSO, and role-based access controls. This structure makes Free suitable for smaller evaluations and Business a clearer fit for teams that need broader project coverage and reporting.
FOSSA connects with GitHub, GitLab, Bitbucket, Azure Repos, CI/CD pipelines, and its API, with CLI and pull-request scanning available for development workflows. It supports web, Windows, macOS, Linux, API, and self-hosted deployments, while Enterprise customers can deploy on premises. The feature set spans vulnerability and license scanning, reachability analysis, container scanning, vendored code and snippet detection, merge gating, quality checks, and policy enforcement. Teams seeking dependency, SBOM, container, and compliance coverage in one platform should consider FOSSA; teams needing only a narrow dependency scanner may find this scope broader than necessary.
FOSSA pros and cons
- Where it wins
- Direct, transitive, and reachability analysis for dependencies
- SBOM generation, import, export, and management
- Broad CI/CD, source-control, container, and policy capabilities
- Where it doesn't
- Free plan is limited to 5 projects
- Business includes 10 projects or SBOM imports
- Business pricing is billed annually
FOSSA fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update