📰 Dependency (Supply Chain) Analysis & Remediation - Dependabot / Snyk / Fossa / Jfrog Xray / OWASP Dependency Check

We're using Snyk, and though it's great I /feel/ like there's a bit of handwaving in their marketing claims that their vuln database is 40% larger than public databases like CVE/NVD. I've also been told there's a similar difference in their container scanning; that they have a large team constantly finding new exploits in system libs that nobody else knows about.

I'm curious if anybody has experience as to the truthiness of these claims.