Periodic Table

The software supply chain, laid out so position means something.

Twenty-five domains, 348 products, laid out in the order the chain runs. Open one to see its controls arranged by the program maturity each demands, how much of the modeled threat it closes, and who actually sells it.

Table

Capabilities Products

← All 25 domains

04Static Code Analysis

20 shown

Is every change to first-party code analyzed for exploitable vulnerabilities before merge, with findings accurate enough that developers act on them?

Color

Who maintains it Licensing Evaluation scores

Who maintains it

Foundation0
Community6
Company14

Mobile Security Framework (MobSF)

MobSF Project · Static Code Analysis

Close ×

Open SourceCommunity

MobSF analyzes APK, AAB and IPA packages for insecure configuration, code issues and secrets and supports dynamic analysis on emulators.

Repository ↗

What it does1 capability · 1 at full coverage

1 of 1 at full coverage.

Mobile Application Security TestingFullSAST · level 3 · 4 providers

What it proves2 controls across 1 framework

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.12 / 42PW.7.2 PW.8.2

What it stops

Its capabilities counter no modeled attack technique and reduce no modeled risk. 49 of 340 products are in that position.

Where it runs2 phases · 1 way to deploy

Capabilities per lifecycle phase

Build1
Test1

How it is delivered

Self-hosted

What it unlocks

No maturity activity uses its capabilities, so it does not move a program level on its own.

How it holds up

Not assessed yet: no strengths, limits or evaluation scores. 47 of 340 products carry an assessment and 29 are scored.

What it costsOpen source (free) · free tier

LicensingOpen source (free)

Priced pernone

BillingFree

Scales withOperating effort only

Total cost

No license cost, but self-support, upgrades, scaling and integration effort must be budgeted as personnel cost.

What it takes to run

No staffing, rollout time or operational commitment recorded.

What it works with

No supported language, standard, integration or named feature recorded.

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13

How this was produced

Every figure above was read from the Gantry knowledge graph, version 7.1.0, and computed when you opened this page — in 602 ms on 2026-10-27. Nothing here is a cached verdict or a dataset assembled for marketing: it is the same model our engagements run on.