All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Black Duck enters AI-generated-code security as the established platform other entrants compete against. It sells SAST, SCA, and DAST testing to more than 4,000 organizations under the Polaris platform, and independent trade press confirms its Leader standing in the Gartner Magic Quadrant for application security testing and in Gartner's new software supply chain ranking. Synopsys filings record the unit's 2024 sale to private equity as a privately held company. The part a rival cannot copy fast is the KnowledgeBase, the open-source component database the Cybersecurity Research Center validates by hand. The catch a buyer should test is that Signal, the agentic AI-code line, reached general availability in March 2026 carrying neither a named reference customer nor an outside benchmark.
| Description | Application security company offering SAST, SCA, DAST, and IAST testing (the Polaris Platform unifies SAST, SCA, and DAST), backed by the human-validated KnowledgeBase, for proprietary, open-source, and AI-generated code. | [f1] |
|---|---|---|
| Founded | 2002 | [f2] |
| HQ | Boston, Massachusetts, United States | [f2] |
| Deployment | SaaS | [f3] |
| Product | What it does |
|---|---|
| Black Duck Polaris Platform | Cloud-native SaaS platform unifying SAST (fAST Static), SCA, and DAST engines with IaC analysis into one application security testing surface. |
| Black Duck SCA | Software composition analysis backed by the KnowledgeBase: detects open-source components, generates SBOMs, and supports regulatory compliance. |
| Coverity Static Analysis | Static application security testing (SAST) engine covering 22 languages and 200-plus frameworks for large-scale, complex software. |
| Seeker | Interactive application security testing (IAST) with active verification and sensitive-data tracking for web applications and services. |
| Black Duck DAST | Dynamic application security testing that identifies runtime vulnerabilities in web applications, APIs, and cloud-based services. |
| Black Duck Signal | Agentic application security that detects and fixes flaws in AI-generated code via MCP integrations with coding assistants and pipelines. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Orchestration Tools Agentic orchestration tools, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients on user devices. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Gateways & Routers MCP proxies and gateways, LLM routers, outbound AI-service traffic, shadow AI egress, and model-registry traffic. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, AIBOM, and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Black Duck Signal is an agentic application security solution that detects and fixes flaws in AI-generated code via MCP integrations with coding assistants and pipelines. It is mapped to the AI Defense Matrix. [f4]
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
Black Duck provides application security testing and software composition analysis. This conventional security is mapped to the Cyber Defense Matrix. [f5]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score |
|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 4/5 |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs, demos, and third-party validation. | 4/5 |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 4/5 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
press the advantage
| Dimension | Score |
|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 |
Unlock the Full Analysis
The reasoning for the scores, the strategy deep dive, the business risks, and more. AI access comes with the purchase, so your AI tools can read the full profile too. You keep 12 months of access.
One-time purchase: $20 per profile.
UnlockReading several? Unlock the entire catalog.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Black Duck about page (True Scale Application Security) | official | 2026-06-23 |
| f2 | Wikipedia on Black Duck Software history | research | 2026-06-14 |
| f3 | AI Defense Matrix Catalog entry | other | 2026-06-10 |
| f4 | AI Defense Matrix Catalog mapping | other | 2026-06-23 |
| f5 | Black Duck platform | official | 2026-06-14 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Black Duck homepage (Polaris Platform, Gartner Magic Quadrant Leader for the eighth consecutive time) “A Magic Quadrant Leader for the Eighth Consecutive Time. 2025 Gartner Magic Quadrant for Application Security Testing, Black Duck placed highest for Ability to Execute.” | official | 2026-06-28 |
| s2 | Black Duck Polaris platform page (unified SAST, SCA, DAST engines) “It integrates the industry's most powerful security analysis engines, including SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic, into a single, fully integrated platform.” | official | 2026-06-28 |
| s3 | Black Duck SCA product page (KnowledgeBase, Cybersecurity Research Center, SBOM, EU CRA, Datametica customer testimonial) “A vast component database, human-validated by the Cybersecurity Research Center, tells you exactly what to fix. ... support regulatory compliance (e.g., EU CRA).” | official | 2026-06-28 |
| s4 | Coverity SAST product page (22 languages, 200-plus frameworks) “Coverity provides in-depth support for 22 programming languages, more than 200 frameworks, and many popular infrastructure-as-code platforms.” | official | 2026-06-28 |
| s5 | Black Duck about page (True Scale Application Security, over 4,000 organizations) “Over 4,000 organizations worldwide trust Black Duck” | official | 2026-06-28 |
| s6 | Black Duck leadership page (Greg Hughes CEO, Dipto Chakravarty CPTO) “Greg is the CEO of Black Duck Software. Previously, Greg was a Senior Operating Partner of the Francisco Partners Operating team ... Greg served as CEO of Veritas ... Prior to Veritas, Greg was the CEO of Serena Software, where he led the successful turnaround and sale to Micro Focus” | official | 2026-06-28 |
| s7 | Synopsys 8-K exhibit 99.1, sale of Software Integrity Group to Clearlake and Francisco Partners (May 6, 2024, up to $2.1 billion) “The existing Software Integrity Group management team is expected to lead the newly independent, privately held company after the transaction closes.” | regulatory | 2026-06-28 |
| s8 | Synopsys 10-K fiscal 2024 (sale of Software Integrity business completed September 30, 2024) “On September 30, 2024, we completed the previously announced sale of our Software Integrity business to entities controlled by funds affiliated with the Sponsors” | regulatory | 2026-06-28 |
| s9 | SC Media: Report, 86% of codebases contain vulnerable open source components (Laura French, Feb 25 2025) “86% of analyzed codebases contained vulnerable open source components” | press | 2026-06-28 |
| s10 | SecurityBrief UK: Black Duck named leader in Gartner Magic Quadrant for eighth year (Jed Nykolle Harme, Oct 15 2025) “Black Duck has been recognised as a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing for the eighth year running.” | press | 2026-06-28 |
| s11 | IT Security Guru: Black Duck lands Leader spot in Gartner's brand-new Software Supply Chain Security Magic Quadrant (June 22, 2026) “Gartner's move to carve out this category signals that analysts now regard SSCS as a mature, standalone discipline rather than a subset of application security testing or DevSecOps tooling.” | press | 2026-06-28 |
| s12 | Help Net Security: Black Duck Signal secures AI-generated code with agentic application security “Signal analysis is differentiated by its use of ContextAI, Black Duck's purpose-built application security model containing petabytes of human validated security intelligence.” | press | 2026-06-28 |
| s13 | NVD CVE-2023-23849, unauthenticated cross-site scripting in Coverity Connect prior to 2022.12.0 “Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability.” | research | 2026-06-28 |
| s14 | Black Duck customer value page (named case-study customers: FPT Software, Austrian Post Group, TAS Group) “Austrian Post Group secures software at scale Gains full visibility and control across open source risk and compliance” | official | 2026-06-28 |
| s15 | Black Duck Signal product page (agentic AI application security) “Signal connects with popular AI coding assistants including Claude Code, Google Gemini, and GitHub Copilot via Model Context Protocol (MCP)” | official | 2026-06-28 |
| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | Black Duck Polaris platform page (unified SAST, SCA, DAST engines) “It integrates the industry's most powerful security analysis engines, including SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic, into a single, fully integrated platform.” | official | 2026-06-28 |
| s2 | Black Duck Signal product page (agentic application security) “Signal connects with popular AI coding assistants including Claude Code, Google Gemini, and GitHub Copilot via Model Context Protocol (MCP)” | official | 2026-06-28 |
| s3 | Black Duck leadership page (Greg Hughes CEO, Dipto Chakravarty CPTO) “Greg is the CEO of Black Duck Software. Previously, Greg was a Senior Operating Partner of the Francisco Partners Operating team. Prior to Francisco Partners, Greg served as CEO of Veritas” | official | 2026-06-28 |
| s4 | Help Net Security: Black Duck Signal secures AI-generated code with agentic application security “Signal analysis is differentiated by its use of ContextAI, Black Duck's purpose-built application security model containing petabytes of human validated security intelligence.” | press | 2026-06-28 |
| s5 | Black Duck about page (True Scale Application Security, over 4,000 organizations) “Over 4,000 organizations worldwide trust Black Duck” | official | 2026-06-28 |
| s6 | Black Duck homepage (Gartner Magic Quadrant Leader for the eighth consecutive time, FPT Software reference) “A Magic Quadrant Leader for the Eighth Consecutive Time. 2025 Gartner Magic Quadrant for Application Security Testing, Black Duck placed highest for Ability to Execute.” | official | 2026-06-28 |
| s7 | Synopsys 8-K exhibit 99.1, sale of Software Integrity Group to Clearlake and Francisco Partners (May 6, 2024, up to $2.1 billion) “The existing Software Integrity Group management team is expected to lead the newly independent, privately held company after the transaction closes.” | regulatory | 2026-06-28 |
| s8 | Black Duck customer value page (named case-study customers: FPT Software, Austrian Post Group, TAS Group) “Austrian Post Group secures software at scale Gains full visibility and control across open source risk and compliance” | official | 2026-06-28 |
| s9 | Coverity SAST product page (22 languages, 200-plus frameworks) “Coverity provides in-depth support for 22 programming languages, more than 200 frameworks, and many popular infrastructure-as-code platforms.” | official | 2026-06-28 |
| s10 | Black Duck Security Commitments page (SOC 2 Type 2, ISO 27001, ISO 27017, ISO 26262) “SOC 2 Type 2 Covering security, availability, and confidentiality ... ISO 27001 Certification ... ISO 27017 Certification” | official | 2026-06-28 |
| s11 | Black Duck SCA product page (KnowledgeBase, Cybersecurity Research Center, SBOM, EU CRA, Datametica customer testimonial) “A vast component database, human-validated by the Cybersecurity Research Center, tells you exactly what to fix. ... support regulatory compliance (e.g., EU CRA).” | official | 2026-06-28 |
| s12 | Black Duck Seeker IAST product page (active verification, sensitive-data tracking) “The industry's first interactive application security testing (IAST) software solution with active verification and sensitive-data tracking for web-based applications.” | official | 2026-06-28 |
| s13 | Black Duck DAST product page (Continuous Dynamic expert validation) “above all, that ALL of the findings are verified. And we are 99% false positives-free.” | official | 2026-06-28 |
| s14 | SC Media: Report, 86% of codebases contain vulnerable open source components (Laura French, Feb 25 2025) “86% of analyzed codebases contained vulnerable open source components” | press | 2026-06-28 |
| s15 | SecurityBrief UK: Black Duck named leader in Gartner Magic Quadrant for eighth year (Jed Nykolle Harme, Oct 15 2025) “Black Duck achieved the highest position for Ability to Execute for the sixth year in succession.” | press | 2026-06-28 |
| s16 | IT Security Guru: Black Duck lands Leader spot in Gartner's brand-new Software Supply Chain Security Magic Quadrant (June 22, 2026) “Gartner's move to carve out this category signals that analysts now regard SSCS as a mature, standalone discipline rather than a subset of application security testing or DevSecOps tooling.” | press | 2026-06-28 |
| s17 | NVD CVE-2023-23849, unauthenticated cross-site scripting in Coverity Connect prior to 2022.12.0 “Versions of Coverity Connect prior to 2022.12.0 are vulnerable to an unauthenticated Cross-Site Scripting vulnerability.” | research | 2026-06-28 |
| s18 | Synopsys 10-K fiscal 2024 (sale of Software Integrity business completed September 30, 2024) “On September 30, 2024, we completed the previously announced sale of our Software Integrity business to entities controlled by funds affiliated with the Sponsors” | regulatory | 2026-06-28 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Do not republish its content or share access without the operator's permission.