Black Duck

• Black Duck Signal reached general availability only in March 2026 with no named reference customer and no independent benchmark, so if no outside proof appears within a year, a buyer could doubt that the agentic and ContextAI claims amount to more than the conventional scanners Black Duck already sells.
• The platform vendors closest to developers, GitHub with its own code scanning and the model providers shipping coding assistants, could fold AI-code security into tools developers already use, pressuring the standalone AI-code budget line even for an incumbent.
• Clearlake Capital and Francisco Partners took Black Duck private from Synopsys in 2024, so the owners carry pressure to show the AI-driven growth that justifies the deal, which could pull roadmap focus toward the Signal narrative ahead of platform breadth.
• Same-asset rivals Checkmarx, Snyk, and Semgrep contest the same enterprise application security buyer from their own platforms, and a procurement team weighing testing platforms could pick a rival on the AI-code feature alone even while Black Duck holds the broader portfolio.
• Black Duck competes on a twenty-plus-year scanning heritage, and if a rival ships an independent benchmark showing its newer engine detects flaws more accurately than the Polaris engines or Signal, the heritage advantage would weaken on the exact ground Black Duck claims.

Black Duck sells application security testing to enterprises and frames its remit as securing both proprietary code and third-party components, including AI-generated code, across the development life cycle. The about page positions the company for a world ruled by AI and regulation, and the homepage names a comprehensive portfolio across static, dynamic, software-composition, and interactive testing, so the buyer is the security team responsible for software the business ships.

The breadth of the problem is older than the AI framing and independently quantified. Black Duck's core market is the testing of source code, open-source dependencies, and running applications for known and exploitable flaws, and SC Media's coverage of Black Duck research reports that 86% of analyzed codebases contained vulnerable open source, evidence the pain exists at the scale the company claims rather than only on its own pages.

The newer pain is AI-generated code arriving faster than conventional tools can review it. Signal addresses that narrower segment inside coding assistants, but it ships into the same enterprise security buyer the rest of the portfolio already serves, rather than a separately cultivated market. [s5, s9, s2]

Black Duck runs a wide testing portfolio under one platform rather than a single tool. The Polaris Platform unifies SAST through Polaris fAST Static, SCA through Polaris fAST SCA, and DAST through Polaris fAST Dynamic into a single cloud-native SaaS offering, with Coverity static analysis covering 22 languages and more than 200 frameworks and Seeker interactive testing extending coverage into running web applications.

The software composition analysis line rests on a curated data asset. Black Duck SCA combines dependency, binary, and snippet analysis to build a software bill of materials, and the company says a vast component database, human-validated by its Cybersecurity Research Center, tells a customer exactly what to fix and supports regulatory compliance such as the EU Cyber Resilience Act.

Signal is the agentic AI-code layer the company added on top. Black Duck Signal connects with coding assistants including Claude Code, Google Gemini, and GitHub Copilot through the Model Context Protocol, and Help Net Security describes ContextAI as a purpose-built model containing petabytes of human-validated security intelligence. That architecture is described on official and trade-press pages but is not yet backed by a public benchmark a buyer could check. [s2, s3, s12]

Black Duck enters AI-code security from the incumbent's seat rather than as a challenger. SecurityBrief and IT Security Guru independently report it as a Leader in the Gartner Magic Quadrant for application security testing for an eighth year and as a Leader in Gartner's new software supply chain security ranking, and the company reports more than 4,000 organizations as customers, so the bundling risk that pushes startups in this market toward acquisition runs the other direction for Black Duck.

The closest rivals are the other established testing platforms, not the AI-native startups. Checkmarx, Snyk, and Semgrep each run a broad application security platform that contests the same enterprise buyer deciding which platform reviews its code. Black Duck competes against them on portfolio breadth across SAST, SCA, DAST, and IAST and a long scanning heritage.

The differentiator Black Duck claims is its accumulated security data. The company positions the KnowledgeBase and ContextAI as the advantage an AI-native entrant cannot copy quickly, and while its analyst standing is now independently confirmed, it offers the data-quality claim as its own description rather than an independent evaluation of whether the data improves detection. [s10, s11, s3]

Black Duck carries strong commercial proof at the company level. The about page reports more than 4,000 organizations worldwide as customers, SecurityBrief and IT Security Guru independently confirm repeat Gartner Leader placements, and the customer-value and SCA pages carry named references including FPT Software, Austrian Post Group, and Datametica crediting the testing and software composition lines.

The proof for Signal specifically is thin. The AI-code product reached general availability in March 2026, and the reviewed sources carry no named Signal reference customer, no disclosed deployment count, and no independent benchmark of its detection or remediation against rival tools.

Distribution leans on the existing enterprise motion. Signal ships through Black Duck's established sales and platform relationships and integrates with the coding assistants developers already use, rather than through a separate marketplace or partner channel visible in the public record. [s5, s10, s14, s3]

Black Duck's leadership pairs an operator CEO with a recruited executive bench. Greg Hughes leads the company after serving as CEO of Veritas and, earlier, turning around Serena Software and selling it to Micro Focus. He joined from the Francisco Partners operating team, one of the firms that now owns Black Duck, so his exits sit in enterprise software rather than application security.

The product and go-to-market roster is publicly identifiable. The leadership page lists Dipto Chakravarty as Chief Product and Technology Officer alongside other recruited leaders, set beside the Software Integrity Group management team that Synopsys filings said was expected to lead the standalone company after the carve-out.

A sustained, independently recognized research and category record is the strongest team signal. The Cybersecurity Research Center publishes the annual Open Source Security and Risk Analysis report, which SC Media covered in 2025, and the organization has held a Gartner-recognized position in application security testing for eight consecutive years through the Synopsys era and into independence, a publication and standing record that outweighs the absence of a founder application security exit. [s9, s10, s6, s7]

Black Duck serves more than 4,000 organizations and sells into security teams that already vet their software supply chain, so its testing tools run inside customers' own compliance and audit workflows. The SCA line generates software bills of materials customers fold into their own audits and supports regulatory compliance such as the EU Cyber Resilience Act.

Ownership and structure are a matter of independent public record. Synopsys filings with the SEC record the 2024 sale of the Software Integrity business to Clearlake Capital and Francisco Partners and describe the result as a newly independent, privately held company, completed on September 30, 2024, so a buyer has a clear picture of who controls the business and that it is not publicly traded.

The open readiness item is product-level assurance for Signal, which inspects source code and applies fixes inside developer workflows without a documented data-handling commitment for the new product. The established products carry the routine disclosure history a buyer can review, with the NVD recording vulnerabilities such as an unauthenticated cross-site scripting flaw in Coverity Connect, distinct from the unproven assurance picture around Signal. [s7, s3, s13]

Add analyzed competitors to compare them side by side with Black Duck.

Black Duck sells application security testing to the enterprise security team that owns software the business ships, and frames its remit as securing proprietary code, open-source components, and AI-generated code across the development life cycle. The about page positions the company for a world ruled by AI and regulation, and the homepage names a comprehensive portfolio across static, dynamic, software-composition, and interactive testing, so the segmentation rides the established application security buyer rather than a separately cultivated AI-code market.

The base is broad and named. The about page reports more than 4,000 organizations worldwide as customers, the customer-value page carries case-study references including FPT Software and Austrian Post Group, and SC Media reported Black Duck's own finding that 86% of analyzed codebases contained vulnerable open-source components, the scale of open-source risk this segment buys against. The reviewed pages do not describe the customer mix, so the sales motion rather than the buyer population is what the record shows.

Signal narrows that segment to the team adopting AI coding assistants. Help Net Security's general-availability coverage says Signal is designed to complement existing application security testing activities, and the reviewed pages document no Polaris cross-sell motion and no shared commercial packaging, so the addressable set for the AI-code line reads as adjacent to the application security buyer the company already serves rather than a documented route to market. That adjacency is an inference from the portfolio rather than a fact the record establishes.

Black Duck runs a wide testing portfolio under one platform rather than a single tool. The Polaris Platform unifies SAST through Polaris fAST Static, SCA through Polaris fAST SCA, and DAST through Polaris fAST Dynamic into one cloud-native SaaS offering, Coverity static analysis covers 22 languages and more than 200 frameworks for large-scale software, and Seeker adds interactive testing with active verification for running web applications.

The differentiated input is the curated data. Black Duck SCA combines dependency, binary, and snippet analysis to build a software bill of materials, and rests on a component database the Cybersecurity Research Center validates by hand and that the company says tells a customer exactly what to fix. Black Duck publishes the annual Open Source Security and Risk Analysis report that SC Media covers, and the dynamic line adds Continuous Dynamic expert validation that filters scan results to true positives, layering human judgment on top of the engines.

Signal is the agentic AI-code layer added on top. The product connects with coding assistants including Claude Code, Google Gemini, and GitHub Copilot through the Model Context Protocol, and Black Duck attributes its accuracy to ContextAI, which Help Net Security describes as a purpose-built model containing petabytes of human-validated security intelligence. The agentic and ContextAI claims are described on official and trade-press pages but carry no public benchmark a buyer could check.

Go-to-market leans on an established enterprise motion and outside validation. SecurityBrief and IT Security Guru independently confirm that Black Duck holds a Leader position in the Gartner Magic Quadrant for application security testing and in Gartner's new software supply chain security ranking, and the about page reports more than 4,000 organizations as customers, the outside validation and scale that anchor its go-to-market.

Named demand depends on the established lines. The customer-value page carries case-study references including FPT Software and Austrian Post Group, and the SCA page carries a customer testimonial crediting supply-chain risk reduction inside CI/CD pipelines, without naming the organization in the fetched text. That proof attaches to the testing portfolio rather than to Signal.

For Signal specifically the record is thin. The AI-code product reached general availability in March 2026, and the fetched pages name no Signal reference customer, no disclosed deployment count, and no independent benchmark of its detection against rival tools, so the channel reach is the indirect signal rather than proof of independent AI-code traction.

Black Duck does not publish a public rate card for its testing portfolio. The SCA, Coverity, Seeker, and platform pages route the buyer to a get-pricing request and a sales contact rather than a self-serve price, consistent with a vendor selling negotiated enterprise agreements rather than to self-service developers.

The buying unit follows the established application security motion. Polaris is sold as a SaaS platform that consolidates SAST, SCA, and DAST, and the fetched pages disclose no metered dimension at all, so what a customer is actually charged for is a question for sales rather than a fact on the public record.

The fetched record does not document Signal pricing. The AI-code product reached general availability in March 2026, and the public pages route the buyer to a demo request without a published price or packaging detail, so the cost basis for the AI-code line is not visible to a buyer comparing it against rival assistant integrations.

Polaris is delivered as a cloud-native SaaS platform, so the customer configures policy and scans rather than running testing infrastructure on premises. The platform onboards code from repositories such as GitHub and GitLab and unifies scan results into a single risk view, concentrating the customer's application security operations on one managed surface.

Operations target developer-speed feedback. The platform applies policy-driven gates and filters findings to the issues that drive most risk, the SCA line generates a persistent bill of materials and monitors components for emergent risk, and the dynamic line adds verified findings that remove false positives, the continuous operation an enterprise application security program runs day to day.

Signal delivers inside developer tooling rather than as a separate console. The product runs scans through coding assistants and IDEs over the Model Context Protocol and analyzes new code incrementally so fixes apply before check-in, which places the AI-code operation in the same workflow developers already use rather than a standalone scanning step.

Trust rests on attestations, scale, analyst standing, and ownership of public record. Black Duck publishes a Security Commitments page listing a SOC 2 Type 2 covering security, availability, and confidentiality, an ISO 27001 certification, an ISO 27017 certification, and an ISO 26262 functional-safety mark, with a downloadable SOC 3 report, and it serves more than 4,000 organizations while holding a Gartner Magic Quadrant Leader placement in application security testing for the eighth consecutive time, and a Leader spot in Gartner's new software supply chain security ranking.

Ownership is a matter of public record. Synopsys filings with the SEC record the 2024 sale of the Software Integrity business to Clearlake Capital and Francisco Partners and describe the result as a newly independent, privately held company, so a buyer has a clear picture of who controls the business and that it is not publicly traded.

The curated data is part of the trust pitch. The SCA line rests on a component database the Cybersecurity Research Center validates by hand, and the company describes the KnowledgeBase as the basis for telling a customer exactly what to fix and supporting regulatory compliance such as the EU Cyber Resilience Act, which supplies the accumulated security content a regulated application security buyer weighs.

The open readiness item is product-level assurance for Signal specifically. The established products carry a public disclosure record a buyer can review, with the NVD documenting an unauthenticated cross-site scripting flaw in Coverity Connect versions before 2022.12.0, while the company-wide attestations are not documented on the fetched pages as covering the AI-code line, which reached general availability in March 2026 without a public benchmark, so a security review will likely ask how Signal handles proprietary code and what leaves the environment.

Polaris is built to be the single application security platform for a development organization. The platform consolidates SAST, SCA, DAST, infrastructure-as-code analysis, and secrets detection into one SaaS surface, so a buyer can replace fragmented point tools with one vendor, the consolidation Black Duck sells.

Outward, the line integrates into the developer ecosystem rather than binding to one vendor stack. Polaris onboards from common code repositories and Signal connects to coding assistants from multiple providers through the Model Context Protocol, so the platform reaches developers wherever they write code rather than only inside a single assistant.

Inward, adoption deepens reliance on Black Duck. Standardizing on Polaris concentrates a customer's scanning, bill-of-materials history, and risk scoring with one platform, and the curated KnowledgeBase is a Black Duck-controlled input the customer cannot reproduce, which is both the value a buyer consolidates onto and the concentration a buyer wary of single-vendor dependence weighs against it.

Black Duck pairs an owner-linked operator chief executive with a refreshed executive roster that mixes recruited leaders and some continuity from the Synopsys Software Integrity Group. The leadership page names Greg Hughes as Chief Executive Officer, who was previously CEO of Veritas and before that a Senior Operating Partner on the Francisco Partners operating team, one of the firms that co-owns Black Duck, so the seat is held by an owner-linked enterprise-software operator rather than the leader who ran the carve-out.

The product and go-to-market roster is publicly identifiable and recently recruited. The leadership page lists Dipto Chakravarty as Chief Product and Technology Officer alongside a Chief Revenue Officer, a Chief Financial Officer, and a Chief Information Security Officer, while Synopsys filings said the existing Software Integrity Group management team was expected to lead the standalone company after closing, so the bench is part inherited and part rebuilt rather than the division carried over intact.

A sustained, independently recognized research and category record is the strongest team signal. Black Duck publishes the annual Open Source Security and Risk Analysis report, which SC Media covered in 2025 as based on Black Duck Audit analyses of commercial codebases, and the organization has held a Gartner-recognized position in application security testing for eight consecutive years through the Synopsys era and into independence, a publication and standing record that outweighs the absence of a founder application security exit.