TrustRadius: an HG Insights company

Black Duck Software Composition Analysis (SCA)

Score10 out of 10

13 Reviews and Ratings

Get a Demo

What is Black Duck Software Composition Analysis (SCA)?

Black Duck is a software composition analysis tool acquired and now supported by Synopsys since 2017.

Categories & Use Cases

Media

Black Duck helps you find and fix your highest-priority vulnerabilities
Use Black Duck to comply with open source license obligations and to verify compliance with all open source license terms
Black Duck automatically creates tickets in your activity tracking applications like Jira for both policy violations and vulnerabilities
Black Duck's vulnerability ImpactAnalysis indicates whether a vulnerability is actually being called by your application
The Black Duck security advisory gives the information you need to address security risks and make the fix
Black Duck generates a Bill of Materials which gives you a complete and detailed inventory of all open source identified in your codebase
Configure and customize to your company's specific security and license policies
Black Duck integrates with other tools to find and scan your codebase

1 / 8

Reviews

What users are saying about Black Duck Software Composition Analysis (SCA).
View all reviews

Code review software to decrease costs

Incentivized
Suzanne DesmondView profile
Cloud DevOps Engineer in Engineering at Platinum Technologies (51-200 employees employees)

Use Cases and Deployment Scope

This software checks out code for possible vulnerabilities and allow us to “shift left”. This allows the potential issue to be seen and addressed in the beginning stages before the cost to fix are too high.

Pros

  • Vulnerability scans
  • Tracking of the problem
  • Alerting

Cons

  • Have a scheduled alerting process for items in triage
  • I would like if problems could be “rolled up”, to see how many issues throughout the company need triaged
  • Export to csv

Return on Investment

  • We have found issues that could have caused us thousands to resolve but it was caught
  • When log4j issue was found, this was instrumental in finding all locations where it needed resolved

Usability

Alternatives Considered

Fortify by OpenText

Other Software Used

SonarQube Server

Black Duck SCA - The premier dependency and container scanning tool

Incentivized
Verified User
Engineer in Information Technology (5001-10,000 employees employees)

Use Cases and Deployment Scope

It's being used for dependency analysis to find out if there are any known CVEs existing by integrating them in the DevOps tooling. It's very useful to figure out vulnerabilities in the various open-source libraries. This ensures overall security, compliance, and risk management

Pros

  • Application and Container Scan
  • Source Code Dependency Analysis
  • Severity Prioritization

Cons

  • Improvements in Documentation
  • Live video examples

Most Important Features

  • Application or Library Scans
  • Container scans
  • Dependency analysis

Return on Investment

  • Increased efficiency of the teams
  • Rapid identification of security issues

SecOps made easy!!!

Incentivized
Rajiv Aradhyula
Sr. Specialist Cloud Architect in Information Technology at NICE Systems (1001-5000 employees employees)

Pros

  • Quick inventory scan: Black Duck helps us scan the code repositories in no time. And quickly list the components and I now really know what is in my code.
  • Security and License risk management: Black Duck being rich in its knowledge base about the vulnerabilities and license issues of open source components, quickly compares the identified inventory to the Black Duck knowledge base and lists all the vulnerabilities and license issues in the code.
  • Integration for automatic scanning: Black Duck is part of devops which provides us automatic scanning. Black Duck is not just for devops but also SecOps.

Cons

  • Governance: I am expecting better governance of teams. I have various teams using the capacity. And I am quite unsure or have to spend more time in figuring out which team is using how much.
  • Tenancy: Black Duck can come up with something called tenancy. Like team A, a separate hyperlink for them. A kind of a zone where the admins or users have complete view of team A.

Return on Investment

  • Increased time to market
  • Dwells well with devops
  • Significantly negates the speck of a chance of security risks in a software release
  • Orchestrates the policies

Alternatives Considered

Vega

Other Software Used

VMware ESXi, VMware NSX, VMware Service Manager, VMware Business Continuity & Disaster Recovery, Cisco Unified Computing System Manager, Cisco UCS B-Series, Cisco UCS C-Series, EMC Clariion CX4 Series, Dell EMC Unity, EMC Documentum, Data Domain, JIRA Software, Jenkins, Atlassian Confluence, Bitbucket, Amazon Elastic Compute Cloud (EC2), Amazon Relational Database Service, AWS Elastic Beanstalk, AWS Lambda, Microsoft Azure, Microsoft Access, Azure SQL Database, Azure API Management

Great open source governance tool that protects our IP!

Incentivized
Emmanuel CanaanView profile
Project Manager, Technology Operations in Information Technology at Thomson Reuters (10,001+ employees employees)

Pros

  • Black Duck Hub performs scans very quickly
  • Black Duck Hub is easy to use
  • Black Duck Hub has a robust set of integrations available for CI tools such as Jenkins and Bamboo
  • Black Duck has the most extensive open source KB in the industry

Cons

  • License model based on usage is costly.
  • Documentation is extensive, but often confusing.
  • Black Duck Hub could use some feature improvements for more robust governance capabilities

Return on Investment

  • It is hard to measure ROI since Black Duck Hub saves us from costly legal battles that have thankfully never had to happen.

Black Duck's use in an Enterprise Software company

Incentivized
Verified User
Engineer in Product Management (1-10 employees employees)

Pros

  • Security scanning very accurate.
  • License scanning is fantastic.

Cons

  • Very slow.
  • Bad UX.
  • Outdated design.
  • Too expensive.

Return on Investment

  • Too expensive and time-consuming to use/add in the CI/CD.

Related Products

Products similar to Black Duck Software Composition Analysis (SCA) that may also meet your needs.
All comparisons
Checkmarx
CompareLearn more
Veracode
CompareLearn more
Snyk
CompareLearn more