The full Black Duck AppSec stack, sold and operated by Merito.

Black Duck is a specialist AppSec vendor with depth across the analysis-engine surface most enterprise programs need. Coverity Static covers source-code SAST across 22 languages and 200-plus frameworks. Black Duck SCA covers open-source dependency, license, and supply-chain risk backed by a KnowledgeBase that catalogs more than 10 million open-source projects. Polaris unifies SAST, SCA, DAST, IaC scanning, and secrets detection in a single SaaS console with concurrent scan engines. Signal is the agentic AI overlay that grounds reachability and prioritization across the analysis engines.

Continuous Dynamic and Seeker Interactive cover runtime testing. Continuous Dynamic is a service-led DAST with Threat Research Center engineers configuring production-safe scans on customer applications. Seeker Interactive is the IAST platform that instruments running applications for real-time vulnerability detection during functional and automated test cycles. Defensics covers protocol fuzzing for IoT, ICS, and network-equipment programs that need zero-day discovery on standard or proprietary protocols.