Periodic Table
The software supply chain, laid out so position means something.
Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.
Table
← All 25 domains
05Dependency Management
24 shown
Before any package is installed, do we know it is not malicious, not critically vulnerable in a reachable way, properly licensed and actively maintained?
Who maintains it
- Foundation3
- Community1
- Company20
Open Source
6 here
Freemium
4 here
Commercial
12 here
- Bds49Black Duck SCA5 capabilities
- Cl50Chainguard Libraries5 capabilities
- Con51Checkmarx One SCA4 capabilities
- El52Echo Libraries7 capabilities
- Ela53Endor Labs8 capabilities
- Jc54JFrog Curation4 capabilities
- Jx55JFrog Xray5 capabilities
- Msc56Mend SCA5 capabilities
- Sse57Seal Security2 capabilities
- Sl58Sonatype Lifecycle5 capabilities
- Srf59Sonatype Repository Firewall5 capabilities
- Vsc60Veracode Software Composition Analysis3 capabilities
How this was produced
Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 300 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.