# Black Duck

> Black Duck is an enterprise application-security company that scans proprietary code, open source dependencies, running applications and protocols, then helps large organizations prioritize and remediate what it finds. Founded as an open source compliance specialist in 2002, acquired by Synopsys for $565 million in 2017 and relaunched as an independent company after a 2024 carve-out valued at up to $2.1 billion, it now sells a broad cloud, on-premises and hybrid portfolio led by Polaris, Black Duck SCA, Coverity and the agentic Signal product.

- **Founded:** 2002
- **Headquarters:** Burlington, Massachusetts, United States
- **Founders:** Douglas Levin (Founder and first CEO)
- **Team size:** Approximately 1,300-1,400 employees are visible or estimated from current directory data; the company does not publish a definitive headcount.
- **Products:** Black Duck SCA, Coverity Static Analysis, Black Duck Polaris Platform, Software Risk Manager, Seeker Interactive Analysis
- **Notable:** Recognized as a Leader in the Gartner Magic Quadrant for Application Security Testing for the eighth consecutive evaluation in 2025, with the highest Ability to Execute position for the sixth consecutive time., More than 4,000 organizations are cited as customers across Black Duck's application-security portfolio., The ContextAI knowledge base claims coverage of 10 million open source projects, 320,000 vulnerabilities, 3,000 licenses and more than 63,000 Black Duck Security Advisories.

## Products & services

- **Black Duck SCA** — Software composition analysis that identifies open source and third-party components, vulnerabilities, licenses and policy violations, produces SBOMs and continuously monitors deployed inventories.
- **Coverity Static Analysis** — On-premises and cloud-capable static analysis for security vulnerabilities, quality defects and coding-standard compliance in proprietary source code.
- **Black Duck Polaris Platform** — A cloud-native SaaS platform combining SAST, SCA, DAST, infrastructure-as-code analysis, secrets detection, orchestration, analytics and risk reporting.
- **Software Risk Manager** — Application security posture management for policy, test orchestration, finding correlation, prioritization and portfolio-wide reporting.
- **Seeker Interactive Analysis** — Interactive application security testing with active verification and sensitive-data tracking for web applications.
- **Defensics Fuzzing** — Protocol fuzz testing that sends malformed and unexpected inputs to uncover unknown defects and vulnerabilities in connected and embedded systems.
- **Continuous Dynamic** — Production-safe SaaS dynamic testing for web applications and APIs, combining continuous scans with deeper on-demand tests.
- **Code Sight and Black Duck Assist** — IDE-based security feedback and AI-assisted fixes for proprietary, open source and AI-generated code before commit.
- **Black Duck Signal** — Agentic application security that uses specialized AI agents and the ContextAI knowledge base to analyze code, assess impact and guide remediation in autonomous development workflows.
- **Audit and advisory services** — Open source audits, software risk assessments, BSIMM assessments, penetration testing, M&A due diligence, consulting, implementation, training and managed services.

## Achievements

- Recognized as a Leader in the Gartner Magic Quadrant for Application Security Testing for the eighth consecutive evaluation in 2025, with the highest Ability to Execute position for the sixth consecutive time.
- More than 4,000 organizations are cited as customers across Black Duck's application-security portfolio.
- The ContextAI knowledge base claims coverage of 10 million open source projects, 320,000 vulnerabilities, 3,000 licenses and more than 63,000 Black Duck Security Advisories.
- MEGA International reported fixing nearly 40,000 defect instances found by Coverity and identifying more than 1,700 external components with Black Duck SCA.
- FPT Software reports using Coverity and Black Duck SCA across roughly 200 projects per year, with its evaluation finding fewer than 10% false positives or negatives.
- Launched what it describes as the first application-security SaaS platform hosted in Saudi Arabia in 2025.
- The Black Duck SCA product brand survived a $565 million acquisition and became the name of the entire independent company after the 2024 carve-out.

## Latest updates

- **2026-07** — Released AI-assisted triage, compliance workflows and usability enhancements across Coverity, including support aimed at EU Cyber Resilience Act readiness.
- **2026-06** — Announced new Polaris capabilities for software-supply-chain defenses and automated remediation pipelines, alongside research on enterprise AI-coding adoption and governance.
- **2026-04** — Appointed Dom Glavach as chief information security officer to oversee enterprise security, governance, risk, compliance and product security.
- **2026-03** — Made Black Duck Signal generally available as an agentic security product for AI-generated code, powered by ContextAI.
- **2026-02** — Expanded native Polaris integrations across GitHub, GitLab, Azure DevOps and Bitbucket, and released the 2026 OSSRA study of 947 codebases.
- **2025-08** — Added AI-generated-code scanning and AI-driven fixes to Black Duck Assist in Code Sight, and released a GitHub Marketplace app for automated repository scanning.
- **2025-07** — Launched a Saudi Arabia-hosted Polaris region on Google Cloud with in-country data residency.
- **2024-10** — Clearlake Capital and Francisco Partners completed the carve-out from Synopsys and relaunched the business as Black Duck Software.

## Links

- Website: https://www.blackduck.com/
- LinkedIn: https://www.linkedin.com/company/black-duck-software
- Twitter/X: https://twitter.com/whitehatsec
- GitHub: https://github.com/blackducksoftware
- YouTube: https://www.youtube.com/@BlackDuckSoftware
- Facebook: http://www.facebook.com/pages/Santa-Clara-CA/WhiteHat-Security/1

---

Profile page: https://yespress.io/black-duck
Published by YesPress — https://yespress.io
Last updated: 2026-09-01