nexB
nexB Inc. provides the AboutCode open source Software Composition Analysis (SCA) stack — including ScanCode, VulnerableCode, PurlDB, and the DejaCode enterprise compliance application — for organizations managing open source licensing and software supply chain security, monetizing via SaaS subscriptions, support plans, and M&A due diligence audits.
- Company typePrivate
- Founded2003
- HeadquartersLos Altos, United States
- Headcount11–50
- GTM typeB2B
- OfferingSoftware
What nexB does
nexB Inc. is a privately held Software Composition Analysis (SCA) company founded in 2003 and headquartered in Los Altos, California. The company develops and maintains the AboutCode stack — a modular set of open source tools and open data products for open source license compliance and software supply chain security. The core technology includes ScanCode Toolkit (a code scanning engine that detects licenses, copyrights, and package dependencies), ScanCode.io (a workflow automation layer for SCA pipelines), VulnerableCode (a vulnerability database correlating advisories from 30+ sources), PurlDB (a 75M+ package metadata index keyed by Package-URL), and ClearlyDefined (a curated open source component metadata project). nexB also created the Package-URL (PURL) specification, co-founded the SPDX standard at the Linux Foundation, and supports a community of 700+ contributors.
The company's commercial offerings revolve around DejaCode, an enterprise compliance application that runs scans, tracks open source and third-party components, defines usage policies, and captures SBOMs in CycloneDX and SPDX formats. DejaCode is sold via tiered SaaS subscriptions (Team at $500/month, Business at $1,500/month, Enterprise custom) with equivalent on-premises pricing, alongside annual Support subscriptions ($15K–$30K+ per year for direct maintainer access and data feeds), Professional Services for M&A due diligence and open source audits, and Managed Services for hosted AboutCode stack operation. Customers include Box, ARRIS/CommScope, Pivotal, Informatica, and Fox-IT, with named reliance on DejaCode for ongoing license compliance and SBOM management.
nexB monetizes its open source leadership position through a hybrid product-led, sales-led, and community-led go-to-market model. The free, open source ScanCode and AboutCode tools serve as a developer funnel that drives 4M+ daily downloads and adoption by 4 of the 5 Big Tech companies, while DejaCode and support subscriptions capture enterprise compliance budgets. The company is privately held, founder-led (CEO Michael Herzog, CTO Philippe Ombredanne), and discloses no institutional funding rounds; primary growth vectors include SBOM regulatory mandates, standards authority via SPDX and PURL, and the broader push toward software supply chain integrity.
nexB firmographics
Firmographics- Name
- nexB
- Legal name
- nexB Inc.
- Website
- https://nexb.com
- Company type
- Private
- Founded year
- 2003
- Operating status
- Operating
- Headcount range
- 11–50 employees
- Short description
- nexB Inc. provides the AboutCode open source Software Composition Analysis (SCA) stack — including ScanCode, VulnerableCode, PurlDB, and the DejaCode enterprise compliance application — for organizations managing open source licensing and software supply chain security, monetizing via SaaS subscriptions, support plans, and M&A due diligence audits.
- Ownership category
- akta.pro rank
Where nexB is headquartered
LocationHeadquarters
- HQ city
- Los Altos
- HQ country
- United States
- HQ region
- North America
Offices1 record
Markets served
nexB business model
Business model- GTM type
- B2B
- Offering type
- Software
- Cost components
- Personnel, Technology or R&D, Infrastructure, Marketing or Sales, Operations
Revenue model
- SaaS Subscriptions (DejaCode): Cloud-based enterprise compliance application with tiered subscription plans (Team $500/month, Business $1500/month, Enterprise custom pricing). Includes unlimited products, components, and packages. Pricing is the same for SaaS and On-premises deployments.
- Support Plans: Annual support subscription plans providing direct access to AboutCode maintainers for problem resolution and advisory support. Standard ($15,000/year) and Advanced ($30,000/year) tiers with data subscriptions for packages, licenses, and vulnerabilities.
- Professional Services and Consulting: Implementation services, SCA audits for M&A due diligence, and open source audits. nexB provides expert consulting for AboutCode stack deployment, custom feature development, and comprehensive Software Composition Analysis services.
- Managed Services: nexB-hosted or private-hosted AboutCode stack management. nexB installs, updates, manages software and dependencies, monitors availability and performance, and handles data backups. Includes Advanced Support Subscription.
Pricing tiers
| Model | Billing | Price |
|---|---|---|
| Subscription | Monthly | Team plan at $500/month for small teams starting at 5 users |
| Subscription | Monthly | Business plan at $1,500/month for growing organizations starting at 25 users |
| Subscription | Annual | Enterprise plan with custom pricing for large organizations starting at 50 users |
| Subscription | Annual | Standard support plan at $15,000/year for production support |
| Subscription | Annual | Advanced support plan at $30,000/year with enhanced data feeds |
| Subscription | Annual | Premium support plan with expert consultative support |
Go-to-market motion3 records
Distribution channels7 records
Marketing channels10 records
nexB product offering
Product offeringCore offering
nexB develops and maintains the AboutCode stack of open source Software Composition Analysis (SCA) tools, including the ScanCode scanning engine, ScanCode.io for pipeline automation, DejaCode as an enterprise compliance SaaS, VulnerableCode for vulnerability data, and PurlDB for package metadata. The company monetizes these tools through tiered SaaS subscriptions (Team, Business, Enterprise), annual support subscriptions, managed hosting services, and professional consulting and M&A due diligence audits.
Product overview
nexB provides the AboutCode stack, a modular ecosystem of open source Software Composition Analysis (SCA) tools for open source license compliance and software supply chain security. The core products include ScanCode Toolkit (the industry-leading code scanning engine) and ScanCode.io (the web UI and API for running complex scans), which are powered by DejaCode (enterprise compliance application), VulnerableCode (vulnerability database), and PurlDB (package metadata database). ClearlyDefined curates open source component metadata. Package-URL (PURL) serves as the universal software package identifier standard. The hybrid solution provides open source tools for software developers and a SaaS enterprise application (DejaCode) for legal and business managers to manage open source usage and governance across products and teams.
Differentiator
Problem solved
Functional benefit
Brands
- AboutCode: Community of open source tools for open source SCA including ScanCode, VulnerableCode, DejaCode, and other open tools and open data for automating open source compliance and ensuring software supply chain security
- ScanCode
- VulnerableCode
- DejaCode
- ScanCode.io
- PurlDB
Products and services
- ScanCode Toolkit
Quantifiable outcome
- 80% of modern software is open source components requiring compliance management
- +3 more outcomes
Companies that use nexB
Customer profileNamed customers5 records
Segments4 records
Ideal customer profiles4 records
nexB technology and API
TechnologyTechnology focussed Yes
API detail
- Has API
- Yes
- API docs
- API detail
Core technology
AI maturity
App detail
Feature7 records
nexB partnerships and signals
Strategic signalPartnerships
Five partnerships are on record, tiered core and minor.
- Linux FoundationcorenexB is a Silver member of the Linux Foundation since 2013. Co-founded the SPDX working group from the Linux Foundation, which creates standard formats for communicating components, licenses, and copyrights. nexB is also a vendor for Commercial Compliance Tools approved by the Linux Foundation.
- Open Source Initiative (OSI)coreOSI and AboutCode signed a Memorandum of Understanding in February to put ClearlyDefined on a sustainable path. ClearlyDefined curates and serves open source component metadata for license, copyright, source, and security compliance, and has been widely cited since 2017.
- ClearlyDefinedcoreClearlyDefined is a community-run database project of license, copyright, and package metadata for open source components. Managed by AboutCode with support from OSI. Makes heavy usage of ScanCode for license and component identification.
- Google Summer of CodeminornexB participates in Google Summer of Code (GSoC), a program that encourages student developers to work on open source projects. Google sponsors selected students to work on AboutCode projects for three months, helping build better open source tooling for Software Composition Analysis.
- SPDX (Linux Foundation)corenexB co-founded the SPDX specification, a standard format for communicating components, licenses, and copyrights associated with a software package. The aim is to reduce redundant work by providing a common format for companies and communities to share information across the supply chain.
Scale indicators8 records
Recent moves6 records
Expansion highlights5 records
nexB competitors and assessment
Company assessmentDirect peers
- Snyk: Snyk is a leading developer security platform with a Software Composition Analysis product that scans open source dependencies for vulnerabilities and license issues, directly overlapping with ScanCode and DejaCode's core SCA use cases. It serves the same enterprise and developer buyer personas.
- Sonatype: Sonatype's Nexus platform is a category-defining SCA and SBOM management solution used by enterprises to manage open source components, license compliance, and security risks, making it a direct competitor to nexB's DejaCode and ScanCode offerings.
- Mend (formerly WhiteSource): Mend provides an SCA and license compliance platform that prioritizes open source detection, SBOM generation, and policy enforcement, addressing the same enterprise compliance workflow as nexB's DejaCode and Support Plans.
- JFrog: JFrog's Artifactory and Xray products offer software composition analysis, vulnerability scanning, and license compliance for open source artifacts, overlapping with nexB's SBOM, vulnerability, and license detection capabilities.
- Fossa: Fossa is a SaaS-focused SCA and license compliance platform that targets engineering and legal teams with automated open source detection and SBOM workflows, directly comparable to nexB's DejaCode enterprise application.
- ReversingLabs: ReversingLabs offers software supply chain security including file, binary, and package analysis with threat detection, addressing the same software composition analysis and vulnerability intelligence use cases as ScanCode and VulnerableCode.
Broad incumbents
- Synopsys (Black Duck): Synopsys Black Duck is an established enterprise SCA platform with deep license compliance and SBOM features, competing head-on with nexB for large enterprise compliance deals while also offering broader AppSec portfolio products nexB does not provide.
Emerging players
- Anchore: Anchore provides open-source-anchored container security and SBOM generation tools (e.g., Syft, Grype) that compete with ScanCode.io and VulnerableCode in the developer-led, open-source SCA segment.
- ScanOSS: ScanOSS provides open source detection and license compliance scanning as both open source and SaaS, with a similar scanning-engine-first approach that parallels nexB's ScanCode Toolkit offering.
Others
- OpenSSF (Linux Foundation): OpenSSF coordinates supply chain security initiatives and tooling (e.g., GUAC, Sigstore, SLSA) that complement and partially overlap with nexB's vulnerability and SBOM focus, representing an ecosystem/standards player rather than a direct competitor.
Market position
Strengths4 records
Weaknesses4 records
Competitive moat6 records
Key risks5 records
Key highlights6 records
Customer concentration
nexB social profiles
Digital presencenexB compliance and trust
Trust signalCompliance1 record
nexB financial estimates
Financial estimateRevenue estimate
Valuation estimate
nexB leadership team
Management profileNumber of profiles
Profiles5 records
nexB funding detail
Funding detailFunding overview
Funding rounds
Investors
Funding detail is available on the Subscription and Enterprise plan.Contact sales →
nexB M&A and investment
M&A and investmentM&A
Investments
M&A and investment is available on the Subscription and Enterprise plan.Contact sales →
Frequently asked questions about nexB
What does nexB do?
nexB develops and maintains the AboutCode stack of open source Software Composition Analysis (SCA) tools, including the ScanCode scanning engine, ScanCode.io for pipeline automation, DejaCode as an enterprise compliance SaaS, VulnerableCode for vulnerability data, and PurlDB for package metadata. The company monetizes these tools through tiered SaaS subscriptions (Team, Business, Enterprise), annual support subscriptions, managed hosting services, and professional consulting and M&A due diligence audits.
Is nexB a public or private company?
nexB is a private company. It is classified as founder individual operated bootstrapped and is currently operating.
When was nexB founded?
nexB was founded in 2003. It employs 11 to 50 people.
Where is nexB based?
nexB is headquartered in Los Altos, United States, in the North America region.
How does nexB make money?
Four revenue lines are on record. SaaS Subscriptions (DejaCode) is the primary driver. The others are support Plans, professional Services and Consulting and managed Services.
Who are nexB's main competitors?
Direct peers on record are Snyk, Sonatype, Mend (formerly WhiteSource), JFrog, Fossa and ReversingLabs. Synopsys (Black Duck) is listed as a broad incumbent. Emerging players are Anchore and ScanOSS. OpenSSF (Linux Foundation) is listed as an others.
Does nexB have an API?
Yes. nexB provides multiple public APIs through its AboutCode stack products. DejaCode provides an enterprise-level API for open source license compliance. VulnerableCode provides a REST API for accessing a database of known software package vulnerabilities. PurlDB provides an API for Package URL data at public.purldb.io/api/. ScanCode.io provides a Web UI and API to run and review complex scans in rich scripted pipelines. Developer documentation is at scancodeio.readthedocs.io/en/latest.