Coana Due Diligence

Run due diligence on Coana: check compliance and get alerts when suppliers or ownership change.

Denmark · owned by Socket (United States) · www.coana.tech · 5 vendors

Coana is a software composition analysis (SCA) company that uses reachability analysis — built on leading academic research from Aarhus University — to identify open source vulnerabilities that are genuinely exploitable in a codebase, eliminating over 80% of false positives. Its static analysis engine builds a call graph of the analyzed program to determine which vulnerabilities are actually reachable at runtime, allowing development teams to focus remediation efforts only on real threats. Coana was acquired by Socket, a developer-first open-source supply chain security company, in April 2025.

Resilience scores

Technology vendors

Insights

Last updated 2026-09-14 · revision 6

5 direct vendors, 128 subvendors

Direct vendors by controlling owner country (sample)

Subvendors by controlling owner country (sample)

Compliance

7 in-scope frameworks identified; showing 3.

Cyber Resilience Act (source) — No public evidence

The EU Cyber Resilience Act applies to all products with digital elements, including software, placed on the EU market. Coana's software composition analysis tool falls directly within this scope.

Evidence: https://www.google.com/search?q=time+in+United+States+of+America&ucbcb=1, https://www.reedsmith.com/articles/eu-product-liability-directive-software-digital-products-cybersecurity/, https://www.gibsondunn.com/eu-product-liability-directive-responding-to-software-ai-and-complex-supply-chains/, https://www.kusari.dev/learning-center/eu-cyber-resilience-act/, https://www.orrick.com/en/Insights/2026/09/EU-Cyber-Resilience-Act-New-Guidance-Clarifies-Scope-Reporting, https://www.goodwinlaw.com/en/insights/publications/2026/09/alerts-lifesciences-technology-preparing-for-eu-cyber-resilience-act

US Export Administration Regulations — No public evidence

The EAR has extraterritorial reach and applies to items of US origin and certain foreign-produced items. Coana's software, especially if it incorporates US-origin technology or is exported from the US, could be subject to these regulations.

Evidence: https://www.google.com/search?q=time+in+United+States+of+America&ucbcb=1, https://www.google.com/search?q=time+in+Philadelphia,+PA,+US&ucbcb=1, https://industrialcyber.co/regulation-standards-and-compliance/eu-cyber-resilience-act-reporting-rules-take-effect-putting-vulnerability-disclosure-and-product-security-in-focus/, https://www.europarl.europa.eu/RegData/etudes/BRIE/2023/754439/EXPO_BRI(2023)754439_EN.pdf, https://www.mordorintelligence.com/industry-reports/software-composition-analysis-market, https://www.briefs.co/news/cybersecurity-startup-socket-just-hit-a-1-billion-valuation/

SOC 2 (source) — Evidence found

As a provider of security software, customers and prospects, especially enterprise clients, will likely require assurance over the security, availability, and confidentiality of the services provided.

Financials

Three-year financials

Financial Resilience Score: 6/10

Coana ApS presents a mixed financial resilience profile. On a stand-alone basis, the Danish entity is technically insolvent with negative equity of DKK -11.6M at end-2025, having accumulated persistent operating losses of DKK 5-6M in each of the last two full years. Revenue is not disclosed under Danish micro/small entity rules, making the top-line scale opaque to outsiders. Average headcount is small (7 employees), concentrating key-person risk among the four founders. However, the risk profile is materially transformed by the April 2025 acquisition by Socket, a well-funded US software supply chain security company. As a wholly-owned subsidiary, the negative equity position is effectively backstopped by the parent. Additionally, Coana benefits from a tier-1 investor base (Sequoia Capital, Essence VC, Aarhus University), non-dilutive EU Horizon Europe EIC Transition grant funding, a differentiated technology moat in reachability-based static analysis, and blue-chip reference customers including Anthropic, OpenAI, Figma, and Vercel. Gross profit swung positively from DKK -2.01M to DKK +2.39M in FY2025, suggesting accelerating commercial traction. The overall score reflects the balance between stand-alone weakness and strong parent/investor backing.

Key strengths: Acquired by well-funded US parent Socket in April 2025, Tier-1 investor base including Sequoia Capital, Essence VC, Aarhus University, Non-dilutive EU Horizon Europe EIC Transition grant funding, Blue-chip customer roster: Anthropic, OpenAI, Figma, Vercel, Gross profit swung from DKK -2.01M to DKK +2.39M in FY2025, Differentiated reachability-based SCA technology moat

Risk factors: Negative equity of DKK -11.6M at end-2025 (technically insolvent stand-alone), Persistent operating losses of DKK 5-6M annually, Revenue not disclosed - top-line scale opaque, Small absolute scale with only ~7 average employees, Key-person risk concentrated in four founders, Post-acquisition integration risk; strategic direction now set by Socket

Revenue by geography

Revenue by product/service

Workforce by country

Signed-in users can see whether their own company is exposed to this vendor's disruption, plus the full sub-vendor list and country breakdowns, every in-scope compliance framework plus gaps and next steps, and alerts when any of it changes.

View the full interactive report