Black Duck Signal

Signal is Black Duck's agentic AI overlay across the AppSec stack. The platform combines twenty-plus years of AppSec intellectual property with LLM-powered analysis to detect, prioritize, and remediate vulnerabilities autonomously inside the customer's existing analysis-engine surface. Signal does not replace Coverity Static, Black Duck SCA, Polaris, or Continuous Dynamic. It augments them.

Reachability analysis is the core capability. Signal traces direct and transitive dependencies to confirm which vulnerabilities are actually exploitable from production entry points. Findings in unreachable code paths get demoted so the AppSec backlog reflects what an attacker can reach rather than every theoretically vulnerable line. Combined with CVSS 4.0 and EPSS exploitability scoring, the prioritization grounds in real-world exploit likelihood rather than raw severity.

Agentic SCA inside AI code-assistant workflows is the more recent capability. As Copilot, Cursor, and Claude Code generate substantial portions of new code, the open-source dependencies and snippet matches in AI-generated code need to be identified and resolved before the commit lands. Signal embeds inside AI development workflows and resolves open-source risks at generation time rather than at scanner time. The architecture moves AppSec further left than build-gate scanning can.

Reachability analysis genuinely improves the AppSec backlog. Programs running Coverity or SCA without it accept finding volumes that include unreachable code paths, which dilutes signal and erodes developer trust. Signal's reachability rollout is the practical way to ground prioritization in real exploit paths rather than syntactic vulnerability counts.

Agentic AI marketing tends to overstate autonomy. Signal augments developer and security workflow but does not replace the triage operating model. AppSec leaders adopting Signal expecting the platform to autonomously close findings without human review are setting up the wrong expectation. The autonomy applies to specific narrow cases (clearly unreachable findings, well-understood remediation paths). Complex business-logic decisions still require human judgment.

Agentic SCA inside AI code-assistant workflows is the right architecture for programs with significant Copilot, Cursor, or Claude Code adoption. Pre-commit risk identification moves AppSec further left than build-gate scanning can reach. Programs without significant AI code-assistant adoption get less value from this capability. Merito recommends adoption sequencing based on the customer's actual AI development posture.