The story of static program analysis has certainly been full of successes and major advancements in the past decade especially in areas such as vulnerability detection. So what’s next for us? I think one of the greatest challenges will be to scale things up. We cannot look at single version snapshots anymore and call it a day. Software engineering is about constant managed change and so should we. In my talk, I will outline why the field of static program analysis has to grow out of the classic “whole program” view and embrace compositionality in order to keep up with software engineering practice. I will present our fundamental results in analysis compositionality and their implementation into scalable static analyses. A central role in this change will be the treatment of software component ecosystems. I will give an overview of our ongoing activities to scale program analysis to this challenge and explain the questions involved.