Does Polaris support automated repository onboarding?

Yes. Polaris connects to GitHub, GitLab, Azure DevOps and Bitbucket, onboards repositories automatically and keeps them synchronized. AppSec programs scale to hundreds of repositories without per-repository manual configuration. Pull-request scanning runs at PR creation, update, or pre-merge with findings posted as PR comments inside the developer review workflow.

Is Polaris available in regulated regions?

Yes. Saudi Arabia in-region SaaS hosting launched in July 2025 for regulated Saudi Arabian enterprises. Additional regional hosting options expand over time. Programs with data-residency requirements should confirm region availability with Merito during MAPS Assessment.

Black Duck Polaris | Unified SaaS AppSec Platform

What it is

Black Duck Polaris in the enterprise stack

Polaris is Black Duck's cloud-native SaaS platform that consolidates the AppSec analysis-engine surface into a single console. The platform integrates Coverity Static (SAST), Black Duck SCA, fAST Dynamic (DAST), Infrastructure-as-Code scanning, and secrets detection. The architecture runs concurrent scan engines rather than sequential, with intelligent orchestration triggering scans by technology stack, criticality, and policy.

Automated SCM integration covers GitHub, GitLab, Azure DevOps, and Bitbucket. Repositories onboard automatically and synchronize continuously without manual configuration. Pull-request scanning runs at PR creation, update, or pre-merge, with findings posted as comments inside the developer review workflow. Code Sight extends coverage into VS Code, IntelliJ, Eclipse, and Visual Studio for authoring-time findings before the build-gate scan.

Black Duck Assist provides AI-driven remediation guidance against the customer's findings. Polaris also supplies a unified risk score combining environmental, business, and application context across SAST, SCA, and DAST findings. One policy engine governs every scan type so AppSec policy lives in one place rather than across multiple consoles. Saudi Arabia in-region SaaS hosting (July 2025) extends coverage for regulated workloads.

Polaris fits best where no standalone Coverity Server or Black Duck Hub deployment is already entrenched. Mature programs already running Coverity or Black Duck SCA at scale are usually better off keeping those products in production and adopting Polaris only for additional scan types. A MAPS Assessment settles which path fits, based on the scanners already in place.

Ideal use cases

Greenfield AppSec foundation with SAST, SCA, DAST, IaC, and secrets in one console
Consolidating multi-vendor AppSec stacks onto a single SaaS platform
Repositories in GitHub, GitLab, Azure DevOps and Bitbucket onboarded without manual setup
Unified policy authoring across SAST, SCA, and DAST findings
In-region SaaS hosting for regulated workloads

Core capabilities

Black Duck Polaris capabilities, grouped by outcome

Unified scan engines

The concurrent analysis surface that produces the platform's core findings.

fAST Static (SAST)
Coverity-derived static analysis engine running inside Polaris. Covers source code across the same language and framework breadth Coverity Static supports.
fAST SCA
Software Composition Analysis backed by the Black Duck KnowledgeBase. Same dataset depth as standalone Black Duck SCA.
fAST Dynamic (DAST)
Dynamic application security testing for running applications. Pairs with Continuous Dynamic for service-led configurations on production traffic.
Infrastructure-as-code scanning
Polaris checks Terraform and CloudFormation templates, Kubernetes manifests, Helm charts and Dockerfiles under the same policy as the application code.
Secrets detection
Identifies committed secrets (API keys, tokens, credentials) across source code and build artifacts.

Policy and orchestration

The unified policy engine that governs every scan type.

Single policy plane
Policy authored once applies across SAST, SCA, DAST, IaC, and secrets findings. Programs avoid parallel rulebooks.
Intelligent scan orchestration
Scans trigger automatically based on technology stack, criticality, schedule, and compliance posture. Reduces wasted scan cycles on code that does not need re-evaluation.
Risk scoring
Unified risk score combines environmental, business, and application context across SAST, SCA, and DAST. Drives prioritization beyond raw severity.

Developer and CI/CD integration

How Polaris meets developers and the pipeline.

Automated SCM onboarding
GitHub, GitLab, Azure DevOps, and Bitbucket repositories onboard automatically and synchronize continuously without manual configuration.
Pull-request scanning
Scans run at PR creation, update, or pre-merge. Findings post as PR comments inside the developer review workflow.
Code Sight IDE plugin
VS Code, IntelliJ, Eclipse, and Visual Studio plugins surface Polaris findings during authoring with summaries, suggested fixes, and Black Duck Assist guidance.

Hosting and compliance

The SaaS architecture options that meet regulated and in-region requirements.

Global SaaS hosting
Polaris runs as cloud-native SaaS with elastic scalability and continuous updates. Reduces operational overhead compared to standalone scanner deployments.
Saudi Arabia in-region SaaS
In-region hosting for Saudi Arabian enterprises (announced July 2025). Extends Polaris coverage for regulated workloads with data-residency requirements.
Compliance posture
SOC 2 Type II, ISO 27001, ISO 27017, ISO 27018 covering the SaaS deployment shape. GDPR, HIPAA-aligned design, SAML SSO, and audit logging across all deployments.

Black Duck Assist and ecosystem

AI guidance and where Polaris fits in the broader Black Duck stack.

Black Duck Assist
AI-driven remediation guidance grounded in the customer's findings and policy rather than generic LLM output. Surfaces inside the Polaris console and Code Sight IDE.
Signal pairing
Black Duck Signal layers reachability and CVSS 4.0 / EPSS prioritization across the Polaris findings surface for additional triage automation.
Software Risk Manager correlation
When scanners outside the Polaris console are in play, Software Risk Manager (ASPM) pulls their results and the Polaris findings into one view.

Frequently Asked Questions

Black Duck Polaris FAQs

Polaris is Black Duck's cloud-native SaaS platform that consolidates SAST, SCA, DAST, Infrastructure-as-Code scanning, and secrets detection under one console. The architecture runs concurrent scan engines (fAST Static for SAST, fAST SCA for supply chain, fAST Dynamic for runtime) rather than sequential. Automated SCM onboarding covers GitHub, GitLab, Azure DevOps, and Bitbucket. Code Sight extends the platform into the IDE for authoring-time findings. Black Duck Assist provides AI-driven remediation grounded in the customer's findings.

Polaris bundles Coverity-derived SAST and Black Duck SCA capabilities under a single SaaS console with a unified policy engine, plus DAST, IaC, and secrets scanning. Standalone Coverity Static and Black Duck SCA give the same core engine depth but require parallel policy authoring and parallel triage. Programs with mature standalone deployments are usually better off staying on those products. Greenfield programs and consolidation projects get the most value from Polaris.

Polaris architecture runs fAST Static, fAST SCA, and fAST Dynamic in parallel rather than sequentially. Programs see findings across the analysis-engine surface without waiting for one scanner to finish before the next runs. Combined with the unified policy plane, the architecture means a developer commits code and gets SAST, SCA, DAST, IaC, and secrets findings together rather than stitched across separate scanner cycles.

Black Duck Assist is the AI-driven remediation guidance system inside Polaris and the Code Sight IDE plugin. It produces fix recommendations grounded in the customer's actual findings and policy rather than generic LLM output. The recommendations surface inside the Polaris console and during code authoring in the IDE. Programs that authored unified policy first get the most value because Assist has customer-specific context to ground in.

All three vendors run cloud-native SaaS AppSec platforms unifying SAST, SCA, DAST, and supporting capabilities. Polaris stands apart on SCA through the Black Duck KnowledgeBase (10 million open-source projects, 317,000 vulnerabilities), on Coverity-derived SAST language breadth (22 languages, 200-plus frameworks), and on the automated SCM onboarding model. Checkmarx One differentiates on supply-chain governance depth and AI-augmented triage. OpenText Core differentiates on Aviator AI grounding. Which platform fits depends on the scanners you already own and what the program needs first.

Polaris pricing depends on application count, traffic volume and which scan engines are in scope, from SAST and SCA to DAST, IaC and secrets. Saudi Arabia in-region hosting and Black Duck Assist are add-ons. Merito quotes Polaris from those inputs, and if you already run Coverity Server or Black Duck Hub, the quote can cover only the extra scan types, with implementation, policy authoring and SCM rollout priced on their own lines.

Black Duck Polaris

Black Duck Polaris in the enterprise stack

Where Black Duck Polaris earns its seat

Concurrent scan engines

One policy plane across scan types

Automated SCM onboarding

Code Sight extends Polaris into the IDE

Black Duck Assist AI remediation

Black Duck Polaris capabilities, grouped by outcome

Unified scan engines

Policy and orchestration

Developer and CI/CD integration

Hosting and compliance

Black Duck Assist and ecosystem

How Black Duck Polaris connects to the rest of your landscape

Black Duck platform (native)

SCM and CI/CD (certified)

Custom integrations

How it rolls out

How it is bought

How Merito helps you win with Black Duck Polaris

Polaris Implementation

MAPS Assessment

DevOps Consulting

CRAFT Enablement

Premium Support

Managed Services

Training and Enablement

One Polaris policy for SAST, SCA, DAST, IaC and secrets, written before the first scan.

Polaris suits new AppSec programs best. Mature programs need a delta justification.

Black Duck Polaris FAQs

Talk to Merito about Polaris

SAST, SCA, DAST, IaC, secrets in parallel

One policy engine across scan types

Author the unified policy before the platform sits idle.

Black Duck Polaris

Black Duck Polaris in the enterprise stack

Where Black Duck Polaris earns its seat

Concurrent scan engines

One policy plane across scan types

Automated SCM onboarding

Code Sight extends Polaris into the IDE

Black Duck Assist AI remediation

Black Duck Polaris capabilities, grouped by outcome

Unified scan engines

Policy and orchestration

Developer and CI/CD integration

Hosting and compliance

Black Duck Assist and ecosystem

How Black Duck Polaris connects to the rest of your landscape

Black Duck platform (native)

SCM and CI/CD (certified)

Custom integrations

How it rolls out

How it is bought

How Merito helps you win with Black Duck Polaris

Polaris Implementation

MAPS Assessment

DevOps Consulting

CRAFT Enablement

Premium Support

Managed Services

Training and Enablement

One Polaris policy for SAST, SCA, DAST, IaC and secrets, written before the first scan.

Polaris suits new AppSec programs best. Mature programs need a delta justification.

Continue exploring Black Duck Polaris on Merito

Black Duck Polaris FAQs

Talk to Merito about Polaris

SAST, SCA, DAST, IaC, secrets in parallel

One policy engine across scan types

Author the unified policy before the platform sits idle.