All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Black Duck sells software that development and security teams use to find security flaws and open-source license risks in code. Its products include the Polaris scanning platform and Signal, which checks AI-generated code in coding assistants. Synopsys combined Black Duck, founded in 2002, with code analysis company Coverity into a business with 524.6 million dollars of fiscal 2023 revenue. Clearlake and Francisco Partners funds bought it in 2024 for 1.65 billion dollars and renamed it Black Duck. Black Duck puts its customer count at more than 4,000 on its homepage and more than 2,500 on another page. A rival would need a curated database of licenses and vulnerabilities like Black Duck’s, and for government buyers, certifications such as Texas’s approval of Polaris for state agencies.
| Description | Application security company selling static, dynamic, interactive, and software composition testing, with the Polaris SaaS platform combining its main engines and the Signal product scanning AI-generated code inside coding assistants. | [f1] |
|---|---|---|
| Founded | 2002 | [f2] |
| HQ | Burlington, Massachusetts, United States | [f3] |
| Deployment | SaaS | [f4] |
| Product | What it does |
|---|---|
| Black Duck Polaris Platform | Cloud-native SaaS platform unifying SAST (fAST Static), SCA, and DAST engines with IaC analysis into one application security testing surface. |
| Black Duck SCA | Software composition analysis backed by the KnowledgeBase: detects open-source components, generates SBOMs, and supports regulatory compliance. |
| Coverity Static Analysis | Static application security testing (SAST) engine covering 22 languages and more than 250 frameworks for large-scale, complex software. |
| Seeker | Interactive application security testing (IAST) with active verification and sensitive-data tracking for web applications and services. |
| Black Duck DAST | Dynamic application security testing that identifies runtime vulnerabilities in web applications, APIs, and cloud-based services. |
| Black Duck Signal | Agentic application security that detects and fixes flaws in AI-generated code via MCP integrations with coding assistants and pipelines. |
| Defensics Protocol Fuzzing | Protocol fuzz testing that generates malformed inputs to find robustness and interoperability defects in software and connected devices. |
| Software Risk Manager ASPM | Application security posture management that consolidates findings from multiple testing tools with integrations, correlation, and central policy. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Black Duck Signal is an agentic application security solution that detects and fixes flaws in AI-generated code via MCP integrations with coding assistants and pipelines. It is mapped to the AI Defense Matrix. [f5]
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Black Duck Polaris Platform, Coverity Static Analysis, and Black Duck SCA test applications and their open-source components for vulnerabilities and license risk. These application security products are mapped to the Cyber Defense Matrix. [f1]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 | Black Duck names a specific buyer, the security and development teams that must find flaws in proprietary, open-source and AI-generated code. SD Times quantifies the pain with research from outside Black Duck, reporting Sonatype’s finding that AI hallucinated 27% of upgrade recommendations for open source projects and Veracode’s finding that AI introduced vulnerabilities in 45% of 80 coding tasks. The EU Cyber Resilience Act, which requires manufacturers to handle vulnerabilities, and Gartner’s analysts, quoted by SecurityBrief, corroborate the problem. [s1, s26, s27, s25] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Black Duck documents concrete mechanisms on its own pages: Coverity builds a structural model of each application across 22 programming languages and more than 250 frameworks, Black Duck SCA combines dependency, binary and snippet analysis, Seeker retests findings to confirm they can be exploited, and Defensics offers more than 300 prebuilt fuzz suites. The Gartner placement SecurityBrief reports rates the vendor rather than testing the engines, Black Duck states the TÜV SÜD certification on its own Coverity page, and Signal’s accuracy rests on Black Duck’s own tests. [s4, s3, s5, s8, s25, s7] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | The reviewed sources contain two distinct kinds of buyer-side signal from roughly the past twelve months. The regulatory driver is the EU Cyber Resilience Act, whose reporting obligations apply from 11 September 2026 per the European Commission. The analyst category note is Gartner’s authors saying, as SecurityBrief quoted on 15 October 2025, that AI and supply chain risks are expanding the testing market. [s27, s25] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | Black Duck’s leadership page describes senior in-domain experience: chief executive Greg Hughes led Serena Software through a turnaround and sale to Micro Focus, and product chief Dipto Chakravarty led three PE-backed businesses with exits. Those exits are Black Duck’s own account, and the OSSRA report SD Times covered and the Gartner placements reflect the company’s standing rather than the team’s, so no independent source corroborates a plural same-domain build record. [s11, s26, s25] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 5/5 | Synopsys’s audited fiscal 2024 10-K reports 524.6 million dollars of fiscal 2023 revenue for the Software Integrity business that its buyers renamed Black Duck, and SecurityBrief reports eight consecutive Gartner Leader placements. Named customers including Thales Alenia Space, Banco General, and Trend Micro speak on Black Duck’s pages, and Accenture’s security practice standardized on Polaris in February 2026. [s24, s23, s28, s25, s4, s12, s22] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 4/5 | Synopsys’s fiscal 2024 10-K records the completed sale of the Software Integrity business, now Black Duck, to funds affiliated with Clearlake Capital and Francisco Partners on September 30, 2024, for an aggregate 1.65 billion dollars, after 524.6 million dollars of revenue in fiscal 2023. Under the at-scale reading, that exit and the disclosed revenue are confirmed output per dollar, and Black Duck has shipped Signal and new Coverity AI features since. The reviewed sources contain no results from after the sale, so the score stops below the top rung. [s24, s16, s20] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Buyers can place Black Duck in two Gartner categories without coaching, application security testing, where SecurityBrief reports eight consecutive Leader placements, and software supply chain security, where Black Duck announced a Leader placement in June 2026. Those are Leader placements among the 16 and 18 vendors Gartner evaluated. The reviewed sources contain no analyst category named after or defined by Black Duck. [s25, s19] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Polaris policy gates that break builds and block pull requests, a curated KnowledgeBase of more than 2,750 open source licenses, and more than 300 Defensics suites its engineers maintain give a platform vendor real friction to absorb. Black Duck describes all three itself, and the Gartner placements SecurityBrief reports rate the vendor rather than show a moat, so the record shows friction that bundling could eventually replicate rather than a structural barrier. [s2, s3, s8, s25] |
Black Duck sells application security testing to the security and development teams responsible for the software a business ships. Its homepage describes tools that integrate into developer workflows and CI/CD pipelines to secure proprietary code, open-source components, and AI-generated code, and the company pitches the portfolio to buyers working in what it calls a regulated, AI-powered world.
Black Duck measures the problem’s scale in its own research, which trade press reports. SD Times covered the 2026 Open Source Security and Risk Analysis report, in which Black Duck analyzed 947 commercial codebases, found license conflicts in two-thirds of them, and found that the mean number of vulnerabilities nearly doubled in a year. SD Times attributes those findings to Black Duck’s research, so they are the company’s own measurements.
The EU now sets a date for part of this demand. The European Commission says manufacturers face mandatory cybersecurity requirements under the EU Cyber Resilience Act and reporting obligations from 11 September 2026. Black Duck markets software bills of materials in its software composition analysis product and Cyber Resilience Act checkers in Coverity to those manufacturers. [s1, s26, s27, s3, s20]
Black Duck sells a broad testing portfolio, with Polaris as the SaaS platform that combines the main engines. Polaris combines static code analysis, open-source component analysis, and dynamic application testing with infrastructure-as-code analysis and secrets detection. The standalone Coverity and Black Duck SCA products remain available for customers that need on-premises or air-gapped deployment.
Black Duck documents each engine in depth. Coverity supports 22 programming languages and more than 250 frameworks, and Black Duck says TÜV SÜD certified it as a support tool under IEC 61508-3 and that it is qualified for ISO 26262 and DO-178C safety-critical work. Black Duck SCA combines dependency, binary, and snippet analysis, Seeker retests the vulnerabilities it finds to confirm they can be exploited, and Defensics fuzzes protocols with more than 300 prebuilt test suites.
Signal is the AI-code line. It connects to coding assistants including Claude Code, Google Gemini, and GitHub Copilot through the Model Context Protocol, and Black Duck listed it in the Claude Directory in September 2026. Black Duck attributes Signal’s accuracy to ContextAI, a model it describes as holding petabytes of human-validated security intelligence, and says its own tests found Signal’s security findings better than those of general-purpose coding assistants. The reviewed sources contain no independent benchmark of Signal. [s2, s4, s3, s5, s8, s7, s16, s17]
Black Duck competes as an established testing vendor with analyst standing. SecurityBrief reports that Gartner evaluated 16 vendors for its 2025 application security testing report and named Black Duck a Leader for the eighth consecutive year, with the highest Ability to Execute for the sixth year running. Black Duck also announced a Leader placement in Gartner’s inaugural software supply chain security report in June 2026, in which Gartner evaluated 18 vendors.
The company’s claimed differentiator is its curated data. Black Duck describes its KnowledgeBase as sourced and curated by the Cybersecurity Research Center and as containing more than 2,750 open-source licenses. Banco General, quoted on the customer-value page, credits the Black Duck Security Advisories research for letting it work beyond published CVEs.
Black Duck measures Signal against the coding assistants it plugs into. Black Duck integrates Signal with GitHub Copilot and other assistants, and on its Signal page it compares Signal’s findings with those of general-purpose coding assistants. [s25, s19, s3, s12, s7]
Synopsys reported the revenue of the business that became Black Duck in an SEC filing. Its fiscal 2024 10-K records revenue of 524.6 million dollars in fiscal 2023 and 468.7 million dollars in fiscal 2024 for the Software Integrity business it sold to Clearlake Capital and Francisco Partners. The 2024 figure covers the year up to the September 30 sale. The new owners renamed that business Black Duck.
Black Duck gives its customer count as a minimum. It says on its about page and homepage that more than 4,000 organizations choose it, and on its customer-value page it cites more than 2,500 organizations, including Fortune 100 companies.
Black Duck names customers and a services partner. Case studies on the customer-value page cover Austrian Post Group, FPT Software, and TAS Group, and quoted customers include Thales Alenia Space, Banco General, and Trend Micro. Accenture’s Application Security Practice standardized on Polaris under a managed security service provider agreement Black Duck announced in February 2026. Signal reached general availability in March 2026. No Signal customer appears in the reviewed sources. [s24, s28, s10, s1, s12, s4, s22, s16]
Greg Hughes leads Black Duck as chief executive after serving as a senior operating partner at Francisco Partners, one of its owners, and before that as chief executive of Veritas. He earlier led the turnaround and sale of Serena Software to Micro Focus, so his track record is in running and selling enterprise software companies. In its March 2026 Signal release Black Duck quoted Jason Schmitt as chief executive, and in its June 2026 Gartner release it quoted Hughes.
The executive bench mixes owner-linked operators with application security veterans. Chief product and technology officer Dipto Chakravarty was chief product officer at Cloudera and led three PE-backed businesses with exits. Chief revenue officer Bill Griffin also came from the Francisco Partners operating team, and chief marketing officer Jim Ivers joined in 2016 with the Cigital acquisition.
Black Duck also has a sustained research and category record. Black Duck publishes the annual Open Source Security and Risk Analysis report, which SD Times covered in February 2026, and SecurityBrief reports eight consecutive years of Gartner Leader placement in application security testing. [s11, s16, s19, s26, s25]
Black Duck publishes a broad set of attestations on its Security Commitments page. It lists a SOC 2 Type 2 report, ISO 27001 and ISO 27017 certifications, an ISO 26262 functional-safety certification, a TISAX assessment at level 2 valid until February 2028, and a TX-RAMP Level 2 certification covering Polaris.
Black Duck holds a state authorization for Polaris and is still pursuing a federal one. It says TX-RAMP certification approves Polaris for use by Texas state agencies, public universities, and community colleges. It is still pursuing FedRAMP Moderate authorization for Polaris, with a target of 2027. Synopsys filings record the September 30, 2024 sale of the business and describe the result as a newly independent, privately held company.
Black Duck documents its data handling for the platform and for Signal’s Claude integration. On its Security Commitments page, Black Duck says only the customer can access its own data and that its staff need the customer’s permission for support access. In its Claude Directory release, Black Duck says Signal transmits scanned source content to Black Duck’s remote analysis endpoint for processing. The NVD records a cross-site scripting flaw in Coverity Connect versions before 2022.12.0, a past product vulnerability a buyer can review. [s13, s21, s24, s23, s17, s29]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Checkmarx | competes with | Competes for the same enterprise application security testing budget across static and software composition analysis. | |
| Snyk | competes with | Competes for developer-facing software composition analysis and code security budgets. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Semgrep | competes with | Competes for code security budgets in development pipelines. | |
| Cycode | competes with | Competes for application security posture management and software supply chain security budgets. | |
| GitHub | adjacent | Black Duck compares Signal with general-purpose coding assistants such as GitHub Copilot on its Signal page, which makes GitHub an adjacent platform for AI-code review. |
Add analyzed competitors to compare them side by side with Black Duck.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
Black Duck’s defensible assets are its curated security content and the certifications regulated buyers ask for. Its Cybersecurity Research Center sources and curates the KnowledgeBase, which covers more than 2,750 open-source licenses, and customer Banco General credits Black Duck’s research with helping it fix vulnerabilities beyond public listings. Its Polaris cloud platform has TX-RAMP certification. TÜV SÜD certified its Coverity code scanner for safety-critical development. A rival cloud provider would need TX-RAMP certification where Texas public buyers require it. Customers that leave Polaris would need to reconfigure its pipeline policy gates in another vendor’s tool. Black Duck’s next government approval is the FedRAMP Moderate authorization it targets for Polaris in 2027.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Black Duck sells software the customer’s teams operate and blends in human expertise, from the KnowledgeBase its Cybersecurity Research Center curates to Continuous Dynamic, where Black Duck experts validate dynamic-scan results. The DAST line also offers on-demand expert guidance and expert-led business logic assessments, so code and expertise blend in what customers buy. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Polaris onboards a customer’s repositories and enforces policy gates that break builds and block pull requests, and Black Duck SCA keeps a persistent bill of materials, so leaving means re-creating those gates and integrations in another vendor’s tool. SBOMs export in SPDX and CycloneDX formats, and the cited record documents no non-portable state and does not size the migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 2/3 | Black Duck holds TX-RAMP Level 2 certification for Polaris, which it calls Texas’s framework for authorizing cloud products for public buyers, and a replacement serving those buyers needs its own certification, material validation that remains feasible. Black Duck also says TÜV SÜD certified Coverity as a support tool under IEC 61508-3 and backs it with a qualification kit for safety work, while FedRAMP Moderate is only targeted for 2027. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Coverity builds path-sensitive static analysis across 22 languages and more than 250 frameworks, Black Duck SCA matches dependencies, binaries, and code snippets against a curated component database, and Seeker and Defensics add interactive testing and protocol fuzzing. A rival would need years of specialized expertise to build that combination of program analysis, binary matching, and LLM-based code review. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Black Duck builds and sells its products for regulated enterprises and governments, with TX-RAMP certification for Texas public buyers, TÜV SÜD certification for safety-critical developers, and on-premises deployment for regulatory mandates. Its named customers include Thales Alenia Space, Banco General, and Austrian Post Group, and Black Duck says on its customer-value page that its base includes Fortune 100 companies. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Polaris is a platform with application features that scans code and gates builds and pull requests inside the development pipeline. It operates outside the request and execution path of the customer’s running applications, and Signal returns findings to coding assistants, so neither product is infrastructure that running applications depend on. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Black Duck retains a curated content asset, the KnowledgeBase, which its Cybersecurity Research Center sources and curates and which holds more than 2,750 open-source licenses with encoded obligations. The open-source projects are public, but the curated database is Black Duck’s, and Black Duck includes access to it in its SCA plans, an accumulated advantage a funded rival could approach with time and effort. |
Black Duck segments its market by industry and by the kind of software a customer ships. Black Duck lists automotive, embedded software and ISVs, financial services, medical devices, and the public sector in its site navigation, and it addresses safety-critical and disconnected environments with Coverity’s TÜV SÜD certification and air-gapped deployment. Black Duck also sells to software manufacturers facing the EU Cyber Resilience Act. The European Commission states that reporting obligations apply from 11 September 2026. Black Duck offers software bills of materials through Black Duck SCA and CRA-oriented checkers in Coverity.
Black Duck sells to companies of many sizes. Black Duck says on its customer-value page that its customers range from startups to the Fortune 100, and it states its customer count as more than 4,000 organizations on its about page and more than 2,500 on its customer-value page.
Black Duck added a public-sector route in 2026. It says Polaris is TX-RAMP certified for Texas state agencies, public universities, and community colleges, and that FedRAMP Moderate authorization for Polaris is targeted for 2027.
Black Duck aims Signal at teams adopting AI coding assistants. Black Duck says Signal is designed to complement existing application security testing, so it sells the AI-code line to the same application security programs its other products serve.
Black Duck runs a wide testing portfolio under one SaaS platform. Polaris combines static code analysis, open-source component analysis, and dynamic application testing with infrastructure-as-code analysis and secrets detection. Coverity covers 22 languages and more than 250 frameworks, Seeker retests findings to confirm they can be exploited, and Defensics fuzzes protocols with more than 300 prebuilt suites. Software Risk Manager integrates with more than 150 third-party tools to correlate findings across them.
The differentiated input is curated content. Black Duck says its Cybersecurity Research Center sources and curates the KnowledgeBase, which holds more than 2,750 open-source licenses with their obligations, and in its Continuous Dynamic service Black Duck’s experts validate dynamic-scan results before findings reach the customer.
Black Duck has added AI across the portfolio. Polaris offers AI triage recommendations and AI-generated fix pull requests, and Signal applies LLM-based analysis to code in any language. In July 2026 Black Duck added AI features to Coverity that run on the customer’s own LLM, along with a Coverity MCP server. Black Duck also says it will apply AI across its full portfolio through Anthropic’s Project Glasswing, an initiative to secure critical software infrastructure, which it joined in September 2026.
Signal’s accuracy claims are Black Duck’s own. The company attributes them to ContextAI, a model it describes as holding petabytes of human-validated security intelligence, and to its own tests against general-purpose coding assistants. The reviewed sources contain no outside benchmark of Signal.
Black Duck sells into an established enterprise base, which Synopsys sized in its fiscal 2024 10-K at 524.6 million dollars of fiscal 2023 revenue for the Software Integrity business that became Black Duck. SecurityBrief reports eight consecutive Gartner Leader placements in application security testing.
Black Duck reaches more buyers through partners and marketplaces. Accenture’s Application Security Practice standardized on Polaris under a managed security service provider agreement announced in February 2026, and Black Duck made Signal available as an MCP server in the Claude Directory in September 2026.
Black Duck names customers for its established lines. Case studies cover Austrian Post Group, FPT Software, and TAS Group, quoted customers include Thales Alenia Space, Banco General, and Trend Micro, and Black Duck reports outcome figures from a survey of 104 customers that UserEvidence conducted. Signal reached general availability in March 2026. No Signal customer appears in the reviewed sources.
Black Duck prices through custom quotes. Black Duck says on the Coverity page that pricing is delivered through a custom enterprise quote model, and it asks for contact details on the Coverity pricing page so a Black Duck representative can follow up.
Black Duck packages each product differently. On the Black Duck SCA page it lays out a Standard Edition and a broader enterprise plan, each with a request for pricing. It describes Polaris as using a consumption-based model, and it bundles Coverity with Black Duck SCA and Polaris.
Black Duck sells Signal the same sales-led way. It routes Signal buyers to a demo request on the product page and states no price or package for Signal there.
Black Duck delivers its tools as SaaS, on premises, or in hybrid form. Polaris runs as a cloud service, the standalone Coverity and Black Duck SCA products cover air-gapped and data-residency requirements, and the Code Sight IDE plug-in works in developers’ local environments wherever the platform runs.
Polaris operates inside the development workflow. It discovers repositories in GitHub, GitLab, Bitbucket, and Azure DevOps, runs scans on source control events, and enforces policy by breaking builds and blocking pull requests when code violates a rule.
Black Duck includes people in some of its delivery. Continuous Dynamic adds expert validation of dynamic-scan results and an Ask-a-Question feature for expert guidance, Black Duck offers expert-led business logic assessments, and the SCA plans include implementation and adoption services. For its SaaS service, Black Duck states a recovery time objective of one business day and a recovery point objective of 24 hours.
Black Duck publishes a broad set of attestations. On its Security Commitments page, Black Duck lists a SOC 2 Type 2 report, ISO 27001 and ISO 27017 certifications, an ISO 26262 functional-safety certification, a TISAX assessment at level 2, and a TX-RAMP Level 2 certification covering Polaris. On the Coverity page it says TÜV SÜD certified Coverity as a support tool for safety-critical development under IEC 61508-3.
Black Duck holds part of the government authorization it seeks. Black Duck says TX-RAMP approves Polaris for Texas state agencies, public universities, and community colleges, and that it targets FedRAMP Moderate authorization for Polaris in 2027.
Synopsys filings document the ownership, and Black Duck documents its data handling. Synopsys filings record the September 30, 2024 sale and describe the result as a newly independent, privately held company. On its Security Commitments page, Black Duck says only the customer can access its own data and that its staff need the customer’s permission for support access. In its Claude Directory release, Black Duck says Signal transmits scanned source content to Black Duck’s remote analysis endpoint. The NVD records a cross-site scripting flaw in Coverity Connect versions before 2022.12.0.
Black Duck built Polaris to consolidate application security testing for a development organization. It combines static, composition, and dynamic analysis with infrastructure-as-code and secrets scanning in one SaaS platform and gives a single prioritized view of issues across scan types. Software Risk Manager integrates with more than 150 third-party tools to correlate their findings.
Outward, the products connect to the tools developers already use. Polaris onboards repositories from the major source control platforms, Signal connects to Claude Code, Google Gemini, and GitHub Copilot through the Model Context Protocol, and Coverity offers its own MCP server.
Black Duck extends that ecosystem through partnerships. Accenture standardized its application security practice on Polaris, Black Duck listed Signal in the Claude Directory, and Black Duck joined Anthropic’s Project Glasswing in September 2026.
Greg Hughes leads Black Duck as chief executive. According to Black Duck’s leadership page, he was a senior operating partner at Francisco Partners, one of Black Duck’s owners, and before that chief executive of Veritas. He earlier led the turnaround and sale of Serena Software. In its March 2026 Signal release Black Duck quoted Jason Schmitt as chief executive, and in its June 2026 Gartner release it quoted Hughes.
The executive bench mixes owner-linked operators with long-tenured security staff. Chief product and technology officer Dipto Chakravarty was chief product officer at Cloudera and led three PE-backed businesses with exits. Chief revenue officer Bill Griffin came from the Francisco Partners operating team, and chief marketing officer Jim Ivers joined in 2016 with the Cigital acquisition. Chief financial officer Roman Telerman was CFO of MRI Software for more than 15 years, and chief information security officer Dom Glavach leads security strategy including AI security and governance.
Black Duck also has a sustained research and category record. Black Duck publishes the annual Open Source Security and Risk Analysis report, which SD Times covered in February 2026, and SecurityBrief reports eight consecutive years of Gartner Leader placement in application security testing.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Black Duck: homepage | official | 2026-10-20 |
| f2 | Wikipedia on Black Duck Software history | research | 2026-10-20 |
| f3 | Black Duck: newsroom release index | official | 2026-10-20 |
| f4 | AI Defense Matrix Catalog entry | other | 2026-06-10 |
| f5 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.