Who competes with Veracode on SCA these days?

Having spent a considerable amount of time this quarter analyzing SCA (Software Composition Analysis) findings from various vendors and correlating them with our own internal deployment logs and runtime data, I've been compiling a landscape overview for our security and compliance team. Veracode's SCA (part of their platform) is a known entity in our audit trails, but the market seems particularly active lately. I'm trying to understand who the genuine, head-to-head competitors are in 2024, specifically for SCA as a primary or strong standalone offering, not just as a checkbox feature in a larger suite.

My primary evaluation criteria are rooted in my audit and compliance perspective:
* **Depth and Accuracy of Bill of Materials (BOM):** Not just CVE matching, but the ability to trace transitive dependencies, and provide evidence trails for audit purposes (SOX, HIPAA, GDPR Article 32). False positive rates are a major log noise concern.
* **Actionability of Findings:** How the findings are presented. Do they integrate with ticketing systems (Jira Service Management logs are critical for us)? Can the output be easily consumed by our SIEM (Splunk) for correlation with other security events, like a vulnerability scan from a cloud instance tied to a specific code deployment?
* **Pipeline Integration and Evidence Generation:** The CI/CD plugin logs (Jenkins, Azure DevOps) are a key data source for us. A tool's ability to not only break a build but also produce a structured, machine-readable audit log of that event (in JSON or CEF format) is highly valuable.
* **Prioritization Context:** Integration with runtime or production environment data to trim the list of vulnerabilities to those actually in use. This dramatically changes the audit workload.

From my research, I've seen several names consistently appear, but I'm keen to hear from others who have done detailed log analysis or proof-of-concepts. The contenders seem to fall into a few categories:

**Dedicated SCA / SBOM Focus:**
* **Snyk:** Their Open Source offering is almost synonymous with modern SCA. Their CLI output and IDE plugin logs are very detailed. I've seen their dependency graphs in practice, and they are comprehensive for audit trails.
* **Mend (formerly WhiteSource):** Often cited for its breadth of language support and policy engine. Their focus on compliance (like export control) aligns with my interests.
* **FOSSA:** Strong on license compliance and policy management, which generates a clear audit trail for legal reviews.

**Broader Platform Players with Strong SCA:**
* **Checkmarx:** Their SCA is integrated into their SAST platform. The query language for custom policies can be powerful for generating specific audit events.
* **GitHub Advanced Security (GHAS) / Dependabot:** Native integration's appeal is the unified audit log within GitHub itself, simplifying log aggregation.
* **GitLab:** Similar story, with their built-in dependency scanning. The pipeline artifact containing the vulnerability report is a fixed part of the evidence chain.
* **Sonatype Nexus Lifecycle:** Often mentioned for its repository firewall and early prevention, which creates a different, earlier point in the audit trail (at component ingestion versus code commit).

A specific technical question I have revolves around evidence collection. For instance, comparing a Veracode SCA scan output to a Snyk scan output for the same project: the structure of the JSON report, the fields available for mapping to a SIEM CIM, and the granularity of the license information differ significantly. Has anyone performed a similar log format analysis between these tools?

Furthermore, from a compliance workflow standpoint, which competitors provide the most robust features for documenting exceptions, waivers, or accepted risks? These waiver logs are critical during an external audit to demonstrate a managed process, not just tooling.

I am less interested in marketing claims and more in operational and evidentiary details. Any insights from your own log reviews or integration experiences would be greatly appreciated.