@Component is a Spring stereotype annotation that marks a class as a managed bean candidate. When component scanning finds it, Spring creates and manages the object in the application context, and other stereotypes are specialisations of the same underlying mechanism.
What @Component Means in Spring
@Component is part of Spring’s stereotype model: it marks a class as a managed bean candidate so component scanning can discover it and register it in the application context. That makes the class part of the container’s dependency graph rather than an ordinary Java object created manually by the application.
How Component Scanning Uses It
When Spring scans configured packages, it looks for stereotype annotations and turns matched classes into beans. @Component is the base stereotype, while other annotations such as @Service, @Repository, and @Controller are specialised forms that exist to communicate intent more clearly without changing the underlying bean registration mechanism.
That distinction matters because the annotation is about container management, not business logic. A class annotated with @Component may still be simple or complex, but its lifecycle, instantiation, and dependency injection are now controlled by Spring rather than by direct constructor calls or manual factory code.
Why It Matters for Application Design
@Component is often the smallest unit of Spring-managed structure, so it shapes how code is assembled, tested, and reasoned about. Once a class is container-managed, dependencies can be injected consistently, cross-cutting concerns can be applied through the framework, and object creation becomes a governed part of application startup instead of scattered across the codebase.
That also means placement and package structure matter. If component scanning does not reach a class, Spring will not create it as a bean, and any downstream injection points that expect it can fail at runtime or during context initialisation.
Common Misunderstandings
A frequent mistake is treating @Component as a generic “make this class available” flag. In practice, it only works within Spring’s scanning and configuration model, so the annotation is effective only when the application context is set up to discover it. Another common misunderstanding is assuming that all stereotype annotations are materially different; most of the time they differ mainly in semantic clarity, not in the core bean-registration mechanism.
Another subtle point is that @Component does not by itself define scope, transactionality, persistence behaviour, or web exposure. Those concerns come from other annotations, framework conventions, or explicit configuration layered on top of the bean lifecycle that @Component enables.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Covers how Spring-managed components depend on controlled secret and credential handling. |
| Recommendation — Apply IA-5 to manage any credentials or tokens injected into Spring-managed components. | ||
| NIST CSF 2.0 | PR.AA-01 — Identity Management, Authentication, and Access Control | Supports how managed beans participate in controlled application access and trust boundaries. |
| Recommendation — Define access and trust boundaries for application components under PR.AA-01. | ||
| ISO/IEC 27001:2022 | A.8.9 — Configuration management | Applies because component scanning and bean registration are configuration-driven application behaviour. |
| Recommendation — Control Spring component registration through disciplined configuration management. | ||
Related resources from NHI Mgmt Group
- What breaks when a GitHub Actions workflow component is compromised?
- What is the difference between identity infrastructure and a login component?
- What breaks when sensitive data is passed from a Server Component to a Client Component?
- What is the main risk of giving AI access to component hierarchies and style mappings?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org