Black Duck portfolio
Polaris, Black Duck SCA, Coverity Static, Continuous Dynamic, Seeker Interactive, Defensics, Signal and Software Risk Manager under one Merito-led program, with policy, SBOM workflow and CI/CD integration designed around your stack.
Program pillars
Why Merito for Black Duck
Black Duck is a specialist AppSec vendor with depth across the analysis-engine surface most enterprise programs need. Coverity Static covers source-code SAST across 22 languages and 200-plus frameworks. Black Duck SCA covers open-source dependency, license, and supply-chain risk backed by a KnowledgeBase that catalogs more than 10 million open-source projects. Polaris unifies SAST, SCA, DAST, IaC scanning, and secrets detection in a single SaaS console with concurrent scan engines. Signal is the agentic AI overlay that grounds reachability and prioritization across the analysis engines.
Continuous Dynamic and Seeker Interactive cover runtime testing. Continuous Dynamic is a service-led DAST with Threat Research Center engineers configuring production-safe scans on customer applications. Seeker Interactive is the IAST platform that instruments running applications for real-time vulnerability detection during functional and automated test cycles. Defensics covers protocol fuzzing for IoT, ICS, and network-equipment programs that need zero-day discovery on standard or proprietary protocols.
Software Risk Manager is the ASPM platform that correlates findings from 150-plus security tools across SAST, DAST, IAST, SCA, and manual pentest. It deduplicates the same issue across multiple scanners and maps findings to 20-plus compliance frameworks. When Black Duck scanners run next to other vendors' tools, Software Risk Manager is where all of their findings come together.
Every Black Duck engagement runs the same way. Policy and rules come first, written so the program produces signal rather than noise, then the products are wired into CI/CD, IDE and ticketing surfaces and findings are tuned until someone clearly owns triage. The team stays through the false-positive review cycles that decide whether the AppSec investment earns developer trust.
The Black Duck toolchain
The static-mode analysis engines that catch vulnerabilities and license-compliance risks before code ships.
Static analysis
SAST engine covering 22 languages and 200-plus frameworks with Code Sight IDE integration, PR-time scanning, and custom rules. Path-sensitive analysis with low false-positive math.
Supply chain
Open-source dependency, license, and supply-chain risk management backed by the Black Duck KnowledgeBase. Snippet matching for AI-generated code, SBOM import and export, AI Model Risk Insights.
Production-safe DAST, runtime-instrumented IAST, and protocol fuzzing for the categories static analysis cannot cover.
Runtime testing
Service-led DAST with Black Duck Threat Research Center engineers configuring production-safe scans, AI verification, and manual business-logic testing on high-priority applications.
Runtime testing
IAST platform that instruments running applications during functional and automated test cycles. Active verification, sensitive-data flow tracking, real-time vulnerability detection.
Polaris consolidates the analysis engines under a single SaaS console. Signal adds reachability and agentic AI prioritization.
Unified platform
Cloud-native SaaS unifying SAST, SCA, DAST, IaC, and secrets detection under one console. Concurrent scan engines, single policy plane, automated SCM onboarding.
Agentic AI
Agentic AI overlay across the AppSec stack with reachability analysis, CVSS 4.0 and EPSS-grounded prioritization, and pre-commit risk identification inside AI code-assistant workflows.
Cross-vendor ASPM correlating findings from 150-plus tools and mapping evidence to compliance frameworks.
Posture management
ASPM platform correlating findings from 150-plus tools across SAST, DAST, IAST, SCA, and manual pentest. Compliance mapping covering 20-plus regulatory frameworks.
Merito services
Coverity rule design, SCA policy authoring, Polaris tenant setup, Continuous Dynamic engagement, Seeker instrumentation, Defensics lab setup, and Software Risk Manager integration onboarding.
AppSec program scoping for Black Duck adoption alongside Checkmarx, Semgrep, Snyk, Sonatype, and OpenText Application Security.
PR-time scanning gates, build-gate policy, IDE plugin rollout, and findings flowing into developer ticketing across Jenkins, GitHub Actions, GitLab CI, Azure DevOps, and Bitbucket.
Developer-facing AppSec adoption and AppSec champion programs across Coverity, SCA, and Polaris.
Named engineer, priority SLAs, and release-window coverage for Black Duck programs Merito implements.
Black Duck policies retuned as findings accumulate, triage ownership kept current, KnowledgeBase-driven policy maintained, and Software Risk Manager integrations kept healthy.
Training matched to each role on the Black Duck stack, from rule and policy authoring for AppSec architects to IDE findings for developers and the merged backlog for ASPM operators.
AppSec engineers and Black Duck specialists from Merito who join your team for the length of a long program.
Black Duck licensing
A named owner for the false-positive queue keeps those policies working after launch. Tell us which Black Duck products you run today and which gap you are trying to close.
Active development
Fresh analysis of recent Black Duck releases, reviewed by Merito as they ship.
View all product release updatesBlack Duck Detect 12.1.0 adds support for OpenJDK 25 and updated versions of pip, Pipenv, Setuptools, uv, Poetry, and Go. It also improves dependency visibility and corrects scan failures or inaccurate BOM results across several ecosystem detectors.
Black Duck Detect 12.0.0 improves software composition analysis governance by adding controls for UV dependency groups, npm workspaces, Bazel dependencies, and empty scan results. Java 8 support is removed, Java versions below 17 are deprecated ahead of Detect 13.0.0, and Docker Inspector is scheduled for removal in 13.0.0. Enterprises should update CI runner standards, firewall allow lists, and scan policies before upgrading.
Black Duck Detect 11.5.1 fixes a Gradle init-script regression in which phantom subprojects could receive an empty configuration set and report zero components. The release also resolves a component-location analysis exception triggered by spaces in version strings. For enterprises, the result is more dependable BOM evidence for release approvals, open-source risk decisions, and audit records.
Related solutions
Black Duck next to Semgrep, Checkmarx, Snyk, Sonatype and Akamai in one application security program.
Black Duck as the scanning layer behind CI/CD security gates, with findings handled the way developers already work.
Reachability-grounded AppSec reducing remediation cycle time across the analysis-engine surface.
Frequently Asked Questions
Consultation request
Share the AppSec program you are running and the gap you are trying to close. A Merito Black Duck specialist follows up within one business day.
Full Black Duck portfolio
Coverity Static, Black Duck SCA, Polaris, Signal, Continuous Dynamic, Seeker Interactive, Defensics, and Software Risk Manager.
MAPS-driven scoping
MAPS Assessment sizes the AppSec program before Black Duck implementation begins, including coverage gaps, integration points, and operating-model design.
Next step
The first Black Duck conversation is the AppSec maturity assessment. We recommend the product (or product mix) that fits the gap rather than pitching the full catalog.
Runtime testing
Generative model-based protocol fuzzer with 300 prebuilt suites covering RFCs, file formats, and protocols. Black-box testing for APIs, network protocols, and IoT.