Forrester recognizes Black Duck as a Leader in software composition analysis

We believe this recognition from Forrester reflects our commitment to helping customers secure their software supply chains by managing the security, quality, and license compliance risks that come from the use of open source and third-party code in their applications and containers.

“Black Duck has a history of innovation, with the largest group in this evaluation and one of the largest open-source software knowledge bases. The Black Duck professional edition is the choice for manufacturing and regulated industries, where tracking components and licenses is a must.” – The Forrester Wave: Software Composition Analysis, Q4, 2024

Maintaining an SBOM is the cornerstone of a successful supply chain program

Forrester noted that Black Duck’s “SBOM management, generation, export, ingestion, and analysis capabilities are among the best in this evaluation.”

Our multifactor scanning, coupled with support for over 100 languages, delivers dependency analysis, binary analysis, codeprint analysis, code snippet detection, and custom component detection. By discovering both declared and undeclared dependencies in your applications, we provide the most complete and dynamic inventory of your applications’ contents and the associated vulnerabilities and licenses. All of this contributes to a complete Software Bill of Materials (SBOM), which is crucial for knowing what risks you’re exposed to.

And although completeness is crucial when evaluating risk, so is accuracy. Part of providing users with trust in their applications is assuring them that the issues identified are the ones that pose actual risk.

Identifying vulnerabilities is just one step in securing an application. Once you find vulnerabilities, they then have to be addressed. To this end, Black Duck offers Black Duck Security Advisories (BDSAs), which provide all the information you need to understand, prioritize, and remediate vulnerabilities. BDSAs include severity scoring, reachability, vulnerability descriptions, details on affected versions, and critical guidance on upgrades, patches, and workarounds. These powerful details are provided by the Black Duck Cybersecurity Research Center (CyRC). The CyRC leverages the Black Duck open source KnowledgeBase™, the industry's most comprehensive database of open source project, license, and security information, covering more than 8.7 million open source projects from nearly 60,000 forges and repositories.

Flexible policy management

Forrester wrote in its report about Black Duck: “Policy management is a strength, with more than 40 criteria for operational health, license risk, and security risk.”

Our flexible policy management helps define and capture an organization’s unique risk tolerance, which can then be automatically enforced by Black Duck in conjunction with tools used throughout the SDLC, such as IDEs, Jenkins, Slack, Artifactory, and so on. This capability helps reduce the noise produced by AppSec tools by focusing them on what matters most to the organization.

With Black Duck, you can configure your open source security and use policies based on criteria including license type, vulnerability severity, component version, and more. You can then enforce these policies with automatic workflow triggers, automated notifications, and seamless integrations with applications like Jira to help accelerate your remediation efforts.

Complete picture of license risk

Black Duck provides a complete picture of license risk and obligations by offering deep license data and copyright identification. Accelerating this capability is our code snippet analysis, which identifies partial bits of open source code that may have been pasted into projects and that still carry license obligations. After identifying the licenses in your applications, Black Duck further categorizes these findings, ranking them as declared, deep, or discovered. This helps you understand your level of risk and which obligations you need to address first. In addition to open source licenses, Black Duck also offers the ability to map and identify closed source and third-party licenses.