Black Duck Polaris
Black Duck Polaris is a cloud-native application security testing platform that brings security analysis together across the software development life cycle.
What Black Duck Polaris is
Black Duck Polaris is a cloud-native application security testing platform that brings security analysis together across the software development life cycle. It combines static analysis (SAST), software composition analysis (SCA), and dynamic analysis (DAST), along with infrastructure-as-code scanning and secrets detection. Dashboards, correlation, contextual enrichment, portfolio analytics, and role-based views help teams organize security findings. Polaris can create software bills of materials through package-manager, signature, binary, and container analysis. It produces compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001, and maps findings to OWASP Top 10 and CWE. Repository integrations include Azure DevOps, Bitbucket, GitHub, and GitLab; issue tracking works with Azure DevOps, Jira, and ServiceNow. The service also provides APIs for issue data, triage, test automation, service accounts, and repositories. Pricing is on request, and a free trial is available. A service limit caps each application at 1 million lines of code and five supporting projects.
Good
- Combines SAST, SCA, and DAST.
- Includes IaC analysis and secrets detection.
- Generates SBOMs from multiple analysis methods.
- Integrates with repositories and issue trackers.
- Provides automated compliance reports.
Watch out
- Each application is limited to 1 million lines of code.
- Each application may have up to five supporting projects.
- Pricing is available on request.
Who it suits
Polaris may suit development and security teams seeking application testing across code, dependencies, APIs, infrastructure-as-code, and secrets. It is relevant to teams that need repository and issue-tracking integrations or compliance reporting.
Verdict
Polaris consolidates several application security checks with reporting, integrations, and SBOM generation. Its per-application limits and request-based pricing are important considerations for teams assessing fit.
Plans and prices
From Black Duck Polaris's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Build your own (à la carte) | Priced on request | Flexible packaging · comprehensive application security |
| Standard package | Priced on request | Polaris fAST Static · IaC analysis · secrets detection · Polaris fAST SCA · dependency and CodePrint scanning · Polaris fAST Dynamic · API scanning · DevOps integrations · centralized policy configuration · dashboards and reporting |
The facts
Each one read from Black Duck Polaris's own pages, with the date it was checked.
What it does
- Additional scanning
- Polaris combines SAST, SCA, and DAST with infrastructure-as-code analysis and secrets detection.checked 1 Oct 2026
- Analysis engines
- The platform integrates SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic.checked 1 Oct 2026
- Automation API
- Polaris provides APIs for issue data, triage, test automation, service accounts, and repository integrations.checked 1 Oct 2026
- Compliance certifications
- Black Duck lists SOC 2 Type 2, SOC 3 Type 2, ISO 27001, ISO 27017, ISO 26262, CSA STAR self-assessment, TISAX, and TX-RAMP Level 2 covering Polaris.checked 1 Oct 2026
- Compliance reporting
- Polaris generates automated compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001 and maps findings to OWASP Top 10 and CWE.checked 1 Oct 2026
- Issue tracking
- Supported issue-tracking integrations include Azure DevOps, Jira Cloud and Data Center, and ServiceNow, with two-way synchronization available for Jira and ServiceNow.checked 1 Oct 2026
- Product type
- Polaris is a cloud-native, software-as-a-service application security testing platform for unifying and automating application security across the software development life cycle.checked 1 Oct 2026
- Risk management
- Polaris provides unified dashboards, intelligent correlation, contextual enrichment, portfolio-wide analytics, and role-based views for risk prioritization.checked 1 Oct 2026
- SBOM
- Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis.checked 1 Oct 2026
- SCM integrations
- Polaris supports repository integrations with Azure DevOps, Bitbucket, GitHub, and GitLab.checked 1 Oct 2026
- Security controls
- Black Duck states that customer data is encrypted in transit and at rest, with HTTPS/TLS 1.2 or better and AES-256 or better for persistent data.checked 1 Oct 2026
- Subscription limit
- The Polaris service description states that one application may not exceed 1 million lines of code and that a subscription application may have up to five supporting projects.checked 1 Oct 2026
- Support
- The Black Duck Developer Portal offers documentation, a community account, and a contact-support channel for Polaris users.checked 1 Oct 2026
The company
- Headquarters
- Burlington, Massachusetts, United Stateschecked 28 Sep 2026
Alternatives to Black Duck Polaris
- 1
OWASP DefectDojo
Free planOpen sourceWebAPILinuxSelf-hosted8.0$100 usage-based - 2
Aikido CSPM
Free planWebAPILinuxmacOS7.9From $300 a month - 3
Endor Labs
Free planWebAPIExtensionLinux7.4Free plan - 4
OX Security
Free planWebAPIExtensionLinux7.4Free plan - 5
JFrog Artifactory
WebAPILinuxSelf-hosted7.1From $50 a month - 66.8From R$2,000 a month