BlackDuck

BlackDuck is an application security and software composition analysis (SCA) platform designed to manage the risks associated with open source and third-party components across the software supply chain. It identifies open source libraries, detects known vulnerabilities, and monitors license obligations to help organizations maintain secure, compliant, and reliable applications. The tool supports both traditional and cloud-native development environments, integrating into existing DevOps pipelines to provide continuous visibility and control.

Key capabilities include automated discovery of open source components through source code, binaries, and container images, along with detailed vulnerability data mapped to public databases such as the National Vulnerability Database (NVD). BlackDuck provides license compliance management, including policy enforcement and reporting on license obligations and restrictions. It offers policy-driven governance, enabling organizations to define and enforce rules for acceptable components, versions, and licenses. The platform also supports SBOM (Software Bill of Materials) generation and management, helping teams document and track dependencies across microservices and distributed architectures.