Abstract: Target files in a search space are scanned to identify which versions of software components are present in the search space. A reference library is populated with indicia such as source code fragments of known versions of software components. A file scanner reads file data used to identify matches between the reference library content and target files, and a version detector determines which match candidates represent unique component versions. Once a component version is identified, a vulnerability module determines based on data in a vulnerabilities database what vulnerabilities are associated with the identified version, and a license module identifies which if any licensing schemes are applicable to the identified version. In one embodiment a report is automatically produced providing an indication of all matched files, their versions, vulnerabilities, and licensing schemes.