Silicon Valley venture capital juggernaut Sequoia is backing a fledgling Danish startup to build a next-gen software composition analysis (SCA) tool, one that promises to help companies filter through the noise and identify vulnerabilities that are a genuine threat.For context, most software contains at least some open source components, many of which are out-of-date and irregularly if at all maintained. There are, of course, many software composition analysis (SCA) tools out there, from Snyk to Synopsis, which alert companies about known vulnerabilities in their technology stack but this can create a lot of noise, particularly if an application isnt actively using that component, thus making it difficult for security teams to prioritize the vulnerabilities that really matter.And this is where Danish cybersecurity startup Coana is setting out to make a difference, using code aware SCA to help its users separate out irrelevant alerts and focus only on those that matter.Founded out of Denmark in 2021, Coana is the handiwork of a computer science professor (Anders M\xf8ller) and two PhDs (Martin Torp and Benjamin Barslev Nielsen) who say they hit upon a technical breakthrough while part of a research group at Denmarks Aarhus University, discovering a new technique for analyzing and understanding large, JavaScript-based applications. CEO Anders S\xf8ndergaard joined the trio as co-founder in 2022, having exited a previous biometrics tech startup called Resilio the previous year.To help fund their company through its early-access stage to full commercialization, Coana today announced it has raised $1.6 million in a pre-seed round of funding led by Sequoia Capital, with participation from Essence VC and a slew of angels including current and former executives from Google, Red Hat, and GitHub.A typical application can consist of as much as 90% third-party libraries, the majority of which are open source and maintained (or not) by any number of volunteer developers.So a company building software might build their own application layer that draws on these myriad libraries, creating a long chain of dependencies that are connected by functions. Traditionally, a SCA tool would look at the version number of a particular dependency, and map it against a database of known vulnerabilities and then report back to the developers if it finds a match. However, the company is working to expand its support beyond JavaScript and into Java and Python this year, which will help it target a broader customer base.As our product matures, and our company matures, were moving up market, eventually targeting large enterprises, but that will take a while before we have the sophistication on the language support to get to get to that level, S\xf8ndergaard said.Companies looking to check out Coana today can apply for early access now.