Black Duck
Enterprise SCA platform with deep open-source detection, license compliance, and code origin analysis
ToolApplication SecurityCloud, Self-hosted
Pricing: Custom enterprise pricing
Reviewed by the Cyber Vendor Guide editorial team against the public sources cited below · Last reviewed October 2026 · How we review listings
What is Black Duck?
Black Duck is an enterprise-grade application security testing company whose software composition analysis platform provides deep visibility into open-source risks, license compliance, and code origin analysis. Black Duck's multi-factor open-source detection uses package managers, file-level analysis, and code snippet matching to identify open-source components even when they are not declared in manifests, making it a thorough SCA tool for auditing software acquisitions, M&A due diligence, and regulatory compliance. Black Duck was formerly a Synopsys business unit called the Synopsys Software Integrity Group (SIG); in October 2024 Synopsys sold SIG to Clearlake Capital Group and Francisco Partners, establishing Black Duck as an independent company that retains the full suite of application security testing solutions previously offered by SIG, including Coverity (SAST) and the Polaris platform.
Best for: Enterprises needing the deepest open-source detection including undeclared components, M&A due diligence, and regulatory compliance for software supply chain
Pros
- Most thorough open-source detection including undeclared and embedded components
- Massive KnowledgeBase tracking 7M+ open-source components and versions
- Gold standard for M&A software due diligence and audit
- Comprehensive SBOM generation for supply chain transparency
- Independent application security company with Coverity SAST and the Polaris platform
Things to check
- Significantly more expensive than Snyk with enterprise-only pricing
- Developer experience is audit-oriented rather than developer-friendly
- Scan performance is slower due to deep multi-factor analysis
- Complex deployment and configuration for enterprise environments
- Less suited for real-time developer feedback in CI/CD pipelines
Reported in public reviews and vendor documentation. See sources below.
Key Features
Do you work at Black Duck? to confirm the details or send us a correction.
Add the Cyber Vendor Guide badge to your site
Black Duck Comparisons
Sources & references
Where the information on this listing comes from. Always verify pricing and capabilities against the vendor before a purchasing decision.
Spot an error, or do you represent Black Duck? Request a correction.
Key facts
- Pricing
- Custom enterprise pricing
- Model
- Enterprise license (project-based)
- Founded
- 2002
- Cloud
- Yes
- Self-hosted
- Yes
Black Duck Alternatives
- SnykDeveloper-first application security platform for finding an...
- SonarQubeOpen-source code quality and security analysis platform with...
- CheckmarxEnterprise application security platform with deep SAST, SCA...
- VeracodeCloud-based application security testing platform with SAST,...
- SemgrepLightweight, open-source static analysis with intuitive patt...