What Coana is
Coana built an SCA with direct and transitive dependency detection that is now a part of Socket. They also have advanced function level reachability analysis. The vendor site is coana.tech. This profile is an entry in the oneNorma directory, not a vendor landing page.
What Coana covers
Coana is in the catalog for these capabilities. Categories: SCA. Catalog tags: Best for Enterprise and Acquired.
How to evaluate Coana in a security program
Use Coana as a stack candidate, not as diligence evidence. The oneNorma score for Coana is 3.5/10 (percentile 6). If the real gap is in SCA, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what coana.tech publishes. Contrast it with pentesting and Security Cloud & Compliance.