Coana

Coana is a cybersecurity software brand focused on software composition analysis (SCA) and open-source vulnerability management. Its platform uses reachability analysis to help teams distinguish vulnerabilities that can affect their applications from those in unused or unreachable code, reducing false positives and directing remediation toward issues that matter. The technology analyzes direct and indirect dependencies, maps vulnerable package components to relevant locations in a codebase, and helps teams identify fixes. It also supports assisted triaging, auto-fixing, software bills of materials (SBOMs), vulnerability exploitability exchange (VEX) workflows, and development process integrations.

Coana’s analysis uses static control-flow analysis and is designed to conservatively flag vulnerabilities when reachability is uncertain. Its command-line interface runs as an offline task, including in CI/CD pipelines, without requiring agents or access to cloud environments or source-control systems. The company presents its tools as a way to reduce vulnerability workloads, speed remediation, and maintain visibility into dependency usage. Coana was acquired by Socket in 2025, according to the announcement on its website.