Black Duck SCA

Software composition analysis product that inventories open source components and flags vulnerabilities.

Pricing: custom
License: proprietary
Open source: No

Editorial review

Black Duck SCA has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Tags(open-source;cloud-native): sca, software-supply-chain, sbom, open-source-security, license-complianceVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): SaaSVerified

Pricing · Licensing

License model(proprietary;open-source;source-available;dual-license): proprietaryVerified
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): customVerified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Software composition analysis (SCA), SBOM generation with dependency, binary, and snippet analysis, Vulnerability identification and risk insight via Security Advisories, Open source license compliance, Open source policy enforcement across every stage of developmentVerification pending

Security · Privacy · Compliance

Regulatory compliance(HIPAA;PCI DSS;FedRAMP;GDPR support): EU Cyber Resilience Act (CRA)Verification pending

Support · Docs · Services

Support channels(email;ticket;chat;phone;community): support portal, knowledge base, community discussionsVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Managing security, quality, and license compliance risks in open source and third-party code with complete SBOMs.Verification pending
Company-size fit(individual;SMB;mid-market;enterprise): mid-market, enterpriseVerification pending
Primary use cases(build;monitor;automate): Manage security, quality, and license compliance risks in open source and third-party code, Meet industry and customer requirements for secure development standards and SBOMs, Support regulatory compliance (e.g., EU CRA), Discover open source and third-party AI models and their license obligationsVerification pending
Skill level(beginner;intermediate;advanced;specialist): advancedVerified

Lifecycle · Versioning

Maintenance status(active;maintenance;deprecated;EOL;archived): activeVerified

Vendor · Maintainer

Founded year(2012): 2002Verified
Headquarters country(US): United StatesVerified
Vendor type(commercial;foundation;community;government;consortium;individual): commercialVerified

User reviews

Review policy

No published reviews yet.