KnowledgeBase depth
10 million open-source projects, 317,000 unique vulnerabilities, 2,650 licenses. The dataset is the practical asset. Programs underestimate how much SCA value comes from the data rather than the engine.
Black Duck • Application security
Black Duck SCA
Black Duck SCA covers open-source dependency, license, and supply-chain risk against the Black Duck KnowledgeBase, which catalogs more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. Snippet matching detects copy-pasted and AI-generated code, and AI Model Risk Insights extends visibility into open-source AI model usage.
Merito sells Black Duck SCA and operates the policy authoring, snippet match tuning, SBOM lifecycle, and AI Model Risk Insights rollout that turn the scanner into a working supply-chain governance program.
- Best for
- AppSec leaders managing open-source dependency risk at enterprise scale, Supply-chain security teams responding to executive-order software supply chain expectations, Compliance leaders responding to license-audit requirements and SBOM mandates (PCI 4.0, EU CRA)
- Hosting
- SaaS / On-prem
- Time to value
- First repository or container scanning in one to two weeks. Policy authoring and SBOM workflow live in two to four weeks. Enterprise rollout across full repository inventory in three to six months.
- Security posture
- GDPR, HIPAA-aligned design, SAML SSO
- Last reviewed
- 2026-04-27
What it is
Black Duck SCA in the enterprise stack
Black Duck SCA is the Software Composition Analysis product backed by the Black Duck KnowledgeBase. The KnowledgeBase catalogs more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. The dataset depth is the practical reason Black Duck SCA produces useful findings on enterprise codebases where shallower datasets miss vulnerabilities.
Multiple scan technologies cover source code, build artifacts, containers, and firmware. Direct and transitive dependencies declared in package manifests get identified alongside dependencies the package manager does not declare (vendored code, copy-pasted snippets, AI-generated code that resembles open-source). Snippet matching is the differentiator that surfaces what manifest-based scanning misses, including AI-generated code from Copilot, Cursor, and Claude Code that resembles licensed open-source.
AI Model Risk Insights shipped in 2025 extending the SCA surface into open-source AI models. Visibility includes model usage, licensing, and data-origin information for the AI artifacts integrated into the customer's software. The capability addresses an emerging governance gap as enterprise programs adopt open-source AI models without the dependency-tracking discipline they apply to traditional libraries.
Black Duck SCA produces signal only when policy is authored. Default settings generate volume that gets ignored. Merito's standard SCA engagement begins with the dependency baseline, then policy authoring against the customer's risk tolerance and license tolerance, then SBOM lifecycle workflow, then audit-evidence flow. Programs that buy SCA and never write the policies generate noise that the security team learns to ignore.
Ideal use cases
- Enterprise SCA across mixed package managers, container registries, and build artifacts
- License compliance and policy enforcement for regulated programs
- SBOM generation and lifecycle management (SPDX and CycloneDX)
- Snippet matching for AI-generated code and vendored open-source
- AI Model Risk Insights for open-source AI model governance
What it is best at
Where Black Duck SCA earns its seat
Snippet matching for AI-generated code
Copy-pasted snippets and AI-generated code that resembles licensed open-source get matched back to source projects. Catches what manifest-based scanning misses entirely. The differentiator becomes more important as Copilot, Cursor, and Claude Code generate substantial portions of new code.
Multi-surface coverage
Source code, build artifacts, containers, and firmware all scan against the same KnowledgeBase. Single-surface SCA forces customers to stitch separate scanners; Black Duck covers the full footprint under one engine.
AI Model Risk Insights for open-source AI
Open-source AI models get the same dependency-tracking discipline traditional libraries already get. Visibility covers usage, licensing, and data origins for the AI artifacts integrated into customer software.
Core capabilities
Black Duck SCA capabilities, grouped by outcome
Dependency identification
How Black Duck SCA finds the open-source code your application actually uses.
Manifest-based dependency identification
Direct and transitive dependencies declared in package managers (npm, Maven, NuGet, pip, gems, Go modules, Cargo, Composer) get identified and matched against the KnowledgeBase.
Build-artifact analysis
Post-build artifacts get scanned without source code access. Catches dependencies that exist in the deployed binary even when the package manifest is incomplete.
Snippet matching
Copy-pasted and AI-generated code gets matched against open-source projects. Catches what manifests cannot see, including code from Copilot, Cursor, or Claude Code that resembles licensed open-source.
Container and firmware scanning
Container images and firmware get scanned for embedded dependencies. Single-surface SCA misses the long tail of components shipped in deployed artifacts.
KnowledgeBase intelligence
The proprietary dataset that drives finding quality.
10 million open-source projects
Project metadata, version history, and component relationships catalog the open-source ecosystem at depth that exceeds free vulnerability feeds.
317,000 unique vulnerabilities
Vulnerability records exceed the standard NVD dataset and include private vulnerability research and earlier disclosure than the public databases.
2,650 unique licenses
License catalog covers permissive, copyleft, dual-license, and unusual project-specific licenses. Drives accurate license-compliance enforcement.
Policy and SBOM
Where SCA findings become enforced policy and audit-ready evidence.
Policy authoring
AppSec architects write policies covering vulnerability severity thresholds, license-compliance categories, snippet-match handling, and component age. Policies enforce automatically across the SDLC.
SBOM generation and import
Software Bill of Materials generated in SPDX and CycloneDX formats. SBOMs from upstream suppliers get imported and mapped to KnowledgeBase components.
Build-gate enforcement
Policy violations gate CI/CD builds. Block-on-introduce policy stops new vulnerabilities while triage works the legacy backlog.
AI and supply-chain governance
Recent capabilities extending SCA into AI and software-supply-chain risk.
AI Model Risk Insights
Open-source AI models get the same dependency tracking traditional libraries get. Coverage includes model usage, licensing, and data-origin information.
Reachability with Black Duck Signal
Reachability analysis demotes findings in unreachable code paths. The backlog reflects what an attacker can exploit rather than every vulnerable line.
Coverity Static pairing
Joint Coverity SAST and Black Duck SCA workflows produce automated SBOM generation and unified findings management.
Where it fits in the stack
How Black Duck SCA connects to the rest of your landscape
Black Duck platform (native)
Native- Black Duck Coverity StaticJoint SAST and SCA workflows produce combined SBOM generation and unified findings management.
- PolarisSCA capabilities under the Polaris unified SaaS console alongside SAST, DAST, IaC, and secrets.
- Black Duck SignalReachability analysis and EPSS-grounded prioritization across the SCA findings surface.
- Software Risk ManagerSCA findings flow into Software Risk Manager (ASPM) for cross-tool correlation.
CI/CD and registries (certified)
Certified- Jenkins, GitHub Actions, GitLab CI, Azure Pipelines, Bitbucket PipelinesPR-time and build-gate scanning with native CI plugins.
- Container registries (Docker Hub, ECR, GCR, ACR, Harbor)Container image scanning across the build, registry, and runtime surface.
- Package managers (npm, Maven, NuGet, pip, gems, Go modules, Cargo)Direct and transitive dependency identification across the major package ecosystems.
- Jira, Azure Boards, ServiceNowFindings flow into ticketing as trackable work items.
SBOM and compliance (certified)
Certified- SPDX and CycloneDX SBOM toolingSBOM generation and import in industry-standard formats for upstream and downstream supply-chain handoffs.
- GRC platforms (Drata, Vanta, ServiceNow GRC)Compliance posture evidence flows into the customer's broader GRC platform.
Custom integrations
Custom- Internal artifact pipelinesREST and webhook integration for non-standard build systems and bespoke artifact workflows.
- Custom license-policy authoringPer-customer license categories and approval workflows tied to legal-team review processes.
- Internal compliance reportingCustomer-specific evidence packages for PCI 4.0, EU CRA, executive-order software supply chain, and SOC 2 audits.
Deployment and implementation
How it rolls out
- Hosting
- SaaS / On-prem (Customer-controlled (on-prem), Polaris SaaS regions)
- Implementation complexity
- Moderate
- Typical time to value
- First repository or container scanning in one to two weeks. Policy authoring and SBOM workflow live in two to four weeks. Enterprise rollout across full repository inventory in three to six months.
- Prerequisites
- Repository, container registry, and build-artifact inventory
- Package-manager and build-system catalog
- License-tolerance policy decision
- SBOM consumption and audit workflow
- What Merito usually handles
- Black Duck SCA deploys as on-prem (Black Duck Server) or SaaS (through Polaris). Merito handles installation, scan-source onboarding, KnowledgeBase calibration, policy authoring, SBOM workflow setup, and the operating model that decides who owns the open-source approval queue.
Licensing and packaging
How it is bought
- Model
- Subscription
- What to expect
- Black Duck SCA is licensed by application count, scanner type, and edition. On-prem (Black Duck Server) and SaaS (through Polaris) editions are sold separately. Pricing varies based on scan-source breadth, snippet-matching usage, and AI Model Risk Insights inclusion. Merito sells the license and scopes implementation, policy authoring, and SBOM workflow as separately priced services.
- Editions and modules
Black Duck SCA (on-prem)
Customer-hosted SCA platform with full KnowledgeBase access and custom policy authoring depth.
Best for: Programs with regulatory or operational requirements that mandate on-prem deployment.
Black Duck SCA through Polaris (SaaS)
SaaS SCA capabilities under the Polaris unified console alongside SAST, DAST, IaC, and secrets.
Best for: Programs adopting unified SaaS AppSec rather than running standalone scanners.
AI Model Risk Insights add-on
Extends SCA into open-source AI model dependency tracking, licensing, and data-origin visibility.
Best for: Programs adopting open-source AI models and needing AI governance discipline.
- Common expansion areas
- Add Coverity Static for paired SAST and SCA workflows
- Add Polaris for unified SaaS console across SAST, SCA, DAST, and IaC
- Add Black Duck Signal for reachability and prioritization on SCA findings
- Add Software Risk Manager for cross-tool ASPM correlation
- Add AI Model Risk Insights for open-source AI model governance
Merito services
How Merito helps you win with Black Duck SCA
Merito sells licenses and the delivery work around them. Pick the service that matches where you are in the lifecycle.
01
SCA Implementation
Installation or Polaris tenant setup, scan-source onboarding, KnowledgeBase calibration, and policy authoring.
Explore service02MAPS Assessment
Supply-chain program scoping for SCA adoption alongside Snyk Open Source, Sonatype Lifecycle, Checkmarx SCA, and OpenText SCA.
Explore service03DevOps Consulting
Build-gate SCA in Jenkins, GitHub Actions, GitLab CI, Azure DevOps, and Bitbucket. Container registry and package manager wiring.
Explore service04CRAFT Enablement
Developer-facing open-source approval workflows and AppSec champion programs.
Explore service05Premium Support
Named engineer, priority SLAs, and release-window coverage for Black Duck SCA in production.
Explore service06Managed Services
Long-term run support including ongoing policy tuning, snippet-match maintenance, SBOM workflow operations, and license-compliance review.
Explore service07Training and Enablement
Role-based training for AppSec architects, security engineers, and developers using Black Duck SCA findings.
Explore serviceBlack Duck SCA licensing
Buy Black Duck SCA from the partner that authors the policies and runs the SBOM workflow.
The KnowledgeBase is the asset. Default policy is the noise. Buy SCA through Merito and get the policy authoring, snippet-match tuning, and SBOM lifecycle together.
Merito point of view
The KnowledgeBase is the asset. Default policy is the noise. Tuning is the work.
Black Duck SCA's KnowledgeBase catalogs more than 10 million open-source projects, 317,000 unique vulnerabilities, and 2,650 unique licenses. The dataset depth is genuinely the differentiator. Programs that adopt SCA with shallow datasets miss vulnerabilities that Black Duck catches because the data is not in the free feeds. Merito's recommendation for customers comparing SCA tools is to weight dataset depth more heavily than engine architecture.
Snippet matching for AI-generated code is the recent capability that matters most for programs with significant Copilot, Cursor, or Claude Code adoption. AI assistants generate code that resembles licensed open-source, and manifest-based SCA cannot see it. Black Duck SCA matches snippets back to source projects so the license and vulnerability state of AI-generated code becomes part of the same backlog the rest of the SCA program manages.
AI Model Risk Insights extends governance to open-source AI models. The capability is necessary but not sufficient for AI governance. Customers that buy SCA for AI Model Risk Insights expecting it to cover model behavior monitoring are buying the wrong product. Merito treats AI Model Risk Insights as a dependency-discipline extension rather than a complete AI governance solution.
What buyers usually underestimate
- Shipping vendor-default SCA policies to production without tuning to the customer's risk and license tolerance
- Skipping snippet matching on programs with significant AI-generated code
- Treating AI Model Risk Insights as a complete AI governance solution rather than dependency discipline
- Letting SBOM generation drift after onboarding so audit evidence becomes stale
- Wiring SCA into CI/CD without a paired triage operating model that addresses the findings volume
Related from Merito
Continue exploring Black Duck SCA on Merito
Related solutions
Related services
Related products
- Black Duck Coverity StaticStatic analysis paired with SCA for combined SAST plus supply-chain workflows.
- Black Duck PolarisUnified SaaS platform that bundles SCA capabilities with SAST, DAST, IaC, and secrets.
- Black Duck SignalReachability analysis and EPSS-grounded prioritization across the SCA findings surface.
- Black Duck (vendor portfolio)Black Duck AppSec portfolio sold and operated by Merito.
Frequently Asked Questions
Black Duck SCA FAQs
Consultation request
Talk to Merito about Black Duck SCA
Share your dependency surface, current SCA tooling, and supply-chain governance posture. A Merito Black Duck SCA specialist follows up within one business day.
KnowledgeBase depth
10M projects, 317K vulns, 2,650 licenses
The dataset is the practical asset. Programs underestimate how much SCA value comes from data depth rather than engine architecture.
Snippet matching
Coverage for AI-generated and copy-pasted code
Manifest-based SCA misses what package managers do not declare. Snippet matching catches the rest, including AI-generated code from Copilot, Cursor, and Claude Code.
Next step
Author the policies before the dependency backlog hits 100,000.
A Black Duck SCA engagement with Merito starts with the dependency baseline, then policy authoring, then SBOM workflow. Default settings produce volume the security team learns to ignore.