Black Duck SCA

What Black Duck SCA is

Black Duck SCA helps teams manage security, quality, and license compliance risks in open-source and third-party code. It identifies components through dependency, binary, and snippet analysis, then builds a software bill of materials (SBOM). For vulnerability work, it provides Black Duck Security Advisories, prioritization, reachability metrics, remediation guidance, and malicious-package detection. License capabilities include identifying open-source licenses and producing notices reports; the enterprise feature list also includes full license text and obligation tracking. Teams can import and export SBOMs in SPDX and CycloneDX formats, and scan pull requests. The enterprise list adds AI/ML model detection and information for evaluating model origin, use, and model cards. Integrations span development environments, source control, CI and build tools, package managers, workflow tools, and production capabilities, with REST APIs. It can run as hosted or on-premises software, including in air-gapped environments, and scans Docker and other containers. Pricing is available on request; no plan price is displayed.