FOSSA: cybersecurity software

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos.

What FOSSA is

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos. The vendor site is fossa.com. This profile is an entry in the oneNorma directory, not a vendor landing page.

What FOSSA covers

FOSSA is in the catalog for these capabilities. Categories: SCA. Catalog tags: Nerdy and Best for Enterprise.

How to evaluate FOSSA in a security program

Use FOSSA as a stack candidate, not as diligence evidence. The oneNorma score for FOSSA is 5.5/10 (percentile 65). If the real gap is in SCA, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what fossa.com publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

SCA

Tags

NerdyBest for Enterprise

Capabilities by category

SCA

Autofix

Frequently asked questions

What is FOSSA?

Fossa has really focused on SCA and SBOM for the enterprise. They have mature SBOM offerings such as a sharing portal, evolving reachability capabilities, internal dependency tracking, and good quality insights on repos. Site: fossa.com.

Which categories does FOSSA fall into?

FOSSA appears in the oneNorma directory under SCA. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement FOSSA?

No. The FOSSA profile (fossa.com) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.