Does Black Duck SCA generate SBOMs?

Yes. Black Duck SCA generates SBOMs in SPDX and CycloneDX formats and imports SBOMs from upstream suppliers. New SBOMs are produced every time dependencies change. Supplier SBOMs are matched to KnowledgeBase components, so the inventory reflects both your own scans and what suppliers disclose. For executive-order and PCI 4.0 inventory audits, that SBOM workflow is the evidence trail.

Black Duck SCA | KnowledgeBase Software Composition Analysis

What it is

Black Duck SCA in the enterprise stack

Black Duck SCA is the Software Composition Analysis product backed by the Black Duck KnowledgeBase. The KnowledgeBase catalogs more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. The dataset depth is the practical reason Black Duck SCA produces useful findings on enterprise codebases where shallower datasets miss vulnerabilities.

Multiple scan technologies cover source code, build artifacts, containers, and firmware. Direct and transitive dependencies declared in package manifests get identified alongside dependencies the package manager does not declare (vendored code, copy-pasted snippets, AI-generated code that resembles open-source). Snippet matching is the differentiator that surfaces what manifest-based scanning misses, including AI-generated code from Copilot, Cursor, and Claude Code that resembles licensed open-source.

AI Model Risk Insights shipped in 2025 extending the SCA surface into open-source AI models. Visibility includes model usage, licensing, and data-origin information for the AI artifacts integrated into the customer's software. The capability addresses an emerging governance gap as enterprise programs adopt open-source AI models without the dependency-tracking discipline they apply to traditional libraries.

Black Duck SCA produces signal only when policy is authored. Default settings generate volume that gets ignored. Merito's standard SCA engagement begins with the dependency baseline, then policy authoring against the customer's risk tolerance and license tolerance, then SBOM lifecycle workflow, then audit-evidence flow. Programs that buy SCA and never write the policies generate noise that the security team learns to ignore.

Ideal use cases

One SCA program across package managers, container registries and build artifacts
License compliance and policy enforcement for regulated programs
SBOM generation and lifecycle management (SPDX and CycloneDX)
Snippet matching for AI-generated code and vendored open-source
AI Model Risk Insights for open-source AI model governance

Core capabilities

Black Duck SCA capabilities, grouped by outcome

Dependency identification

How Black Duck SCA finds the open-source code your application actually uses.

Manifest-based dependency identification
Direct and transitive dependencies declared in package managers (npm, Maven, NuGet, pip, gems, Go modules, Cargo, Composer) get identified and matched against the KnowledgeBase.
Build-artifact analysis
Post-build artifacts get scanned without source code access. Catches dependencies that exist in the deployed binary even when the package manifest is incomplete.
Snippet matching
Copy-pasted and AI-generated code gets matched against open-source projects. Catches what manifests cannot see, including code from Copilot, Cursor, or Claude Code that resembles licensed open-source.
Container and firmware scanning
Container images and firmware get scanned for embedded dependencies. Single-surface SCA misses the long tail of components shipped in deployed artifacts.

KnowledgeBase intelligence

The proprietary dataset that drives finding quality.

10 million open-source projects
Project metadata, version history, and component relationships catalog the open-source ecosystem at depth that exceeds free vulnerability feeds.
317,000 unique vulnerabilities
Vulnerability records exceed the standard NVD dataset and include private vulnerability research and earlier disclosure than the public databases.
2,650 unique licenses
License catalog covers permissive, copyleft, dual-license, and unusual project-specific licenses. Drives accurate license-compliance enforcement.

Policy and SBOM

Where SCA findings become enforced policy and audit-ready evidence.

Policy authoring
AppSec architects write policies covering vulnerability severity thresholds, license-compliance categories, snippet-match handling, and component age. Policies enforce automatically across the SDLC.
SBOM generation and import
Software Bill of Materials generated in SPDX and CycloneDX formats. SBOMs from upstream suppliers get imported and mapped to KnowledgeBase components.
Build-gate enforcement
A dependency that breaks policy fails the CI/CD build. Blocking only newly introduced components lets the team clear the existing backlog without stopping releases.

AI and supply-chain governance

Recent capabilities extending SCA into AI and software-supply-chain risk.

AI Model Risk Insights
Open-source AI models get the same dependency tracking traditional libraries get. Coverage includes model usage, licensing, and data-origin information.
Reachability with Black Duck Signal
Reachability analysis demotes findings in unreachable code paths, so the dependency backlog ranks the vulnerable components an attacker could actually exploit ahead of the rest.
Coverity Static pairing
Joint Coverity SAST and Black Duck SCA workflows produce automated SBOM generation and unified findings management.

Frequently Asked Questions

Black Duck SCA FAQs

Black Duck SCA (Software Composition Analysis) covers open-source dependency, license, and supply-chain risk against the Black Duck KnowledgeBase. The KnowledgeBase catalogs more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. Multiple scan technologies cover source code, build artifacts, containers, and firmware. Snippet matching detects copy-pasted code, and code written by AI assistants, that manifests cannot see. AI Model Risk Insights (2025) extends SCA into open-source AI model dependency tracking.

The KnowledgeBase is Black Duck's proprietary catalog of the open-source ecosystem. It covers more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. The dataset depth exceeds free vulnerability feeds like NVD because Black Duck includes private research, earlier disclosure data, and project-specific license records. The KnowledgeBase is the practical asset that drives Black Duck SCA finding quality.

Snippet matching identifies copy-pasted code and AI-generated code that resembles licensed open-source projects. Manifest-based SCA only sees what the package manager declares. Snippet matching catches everything else, including vendored code, copy-pasted snippets, and AI-generated code from Copilot, Cursor, or Claude Code that resembles licensed open-source. As AI assistants generate substantial portions of new code, snippet matching becomes more important for programs that need to maintain license compliance and vulnerability tracking on AI-generated code.

AI Model Risk Insights (released in Black Duck SCA 2025.10.0 and later) extends the SCA surface into open-source AI models. The capability provides visibility into model usage, licensing, and data origins for AI artifacts integrated into customer software. Programs adopting open-source AI models without dependency-tracking discipline miss the same governance gap that traditional libraries already manage. AI Model Risk Insights closes that gap. It is not a complete AI governance solution and does not cover model behavior monitoring.

All three vendors run SCA platforms. Black Duck differentiates on KnowledgeBase depth (10 million projects, 317,000 vulnerabilities, 2,650 licenses) and on snippet-matching capability that catches AI-generated and copy-pasted code that manifests miss. Snyk differentiates on developer experience and IDE integration. Sonatype differentiates on Nexus repository governance and lifecycle policy depth. The choice turns on how dependencies are managed today and how much AI-assisted code the teams produce.

Black Duck SCA is licensed by application count, scanner type, and edition. On-prem (Black Duck Server) and SaaS (through Polaris) editions are sold separately. AI Model Risk Insights is sold as an add-on. Pricing varies based on scan-source breadth, snippet-matching usage, and AI Model Risk Insights inclusion. Pairing SCA with Coverity Static puts SAST and SCA findings in one backlog with combined SBOM generation.

You can buy Black Duck SCA through Merito or directly from Black Duck. It comes in two separately sold editions, on-premises Black Duck Server and SaaS through Polaris, and it is licensed by application count, scanner type and edition, with snippet matching and AI Model Risk Insights affecting the price. Tell Merito which edition, how many applications and which scan sources you need to get a quote.

Request Black Duck SCA pricing

Policy comes first, because default SCA settings produce volume that gets ignored. After a dependency baseline, the work is writing vulnerability and license policies, setting snippet-match handling and building the SBOM workflow auditors rely on, on Black Duck Server or in a Polaris tenant. Once it is live, Premium Support, Managed Services, training or staff augmentation keep the program running.

Black Duck SCA

Black Duck SCA in the enterprise stack

Where Black Duck SCA earns its seat

KnowledgeBase depth

Snippet matching for AI-generated code

Multi-surface coverage

AI Model Risk Insights for open-source AI

Black Duck SCA capabilities, grouped by outcome

Dependency identification

KnowledgeBase intelligence

Policy and SBOM

AI and supply-chain governance

How Black Duck SCA connects to the rest of your landscape

Black Duck platform (native)

CI/CD and registries (certified)

SBOM and compliance (certified)

Custom integrations

How it rolls out

How it is bought

How Merito helps you win with Black Duck SCA

Black Duck SCA policies and an SBOM workflow that auditors can rely on.

The KnowledgeBase is the asset. Default policy is the noise. Tuning is the work.

Related reading and proof for Black Duck SCA

Latest Product Release Updates

Continue exploring Black Duck SCA on Merito

Black Duck SCA FAQs

Talk to Merito about Black Duck SCA

10M projects, 317K vulns, 2,650 licenses

Coverage for AI-generated and copy-pasted code

Author the policies before the dependency backlog hits 100,000.

Related reading and proof for Black Duck SCA