Black Duck Reviews

Name: Black Duck
Brand: Synopsys
Rating: 4 (19 reviews)

Vendor: Synopsys

3.9 out of 5

19 reviews
82% willing to recommend

781 followers

Post review

What is Black Duck?

Organizations use Black Duck for compliance, internal audits, license management, and security, scanning software to identify vulnerabilities, non-compliant code, and dependencies in open-source projects.

Get the Black Duck Buyer's Guide and find out what your peers are saying about Black Duck, Veracode, GitLab and more!

Black Duck is the #1 ranked solution in top Software Composition Analysis (SCA) solutions. PeerSpot users give Black Duck an average rating of 7.8 out of 10. Black Duck is most commonly compared to Veracode: Black Duck vs Veracode. Black Duck is popular among the large enterprise segment, accounting for 75% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 21% of all views.

Helped 805,335 peers since 2012

Featured reviews

Saravanan_Radhakrishnan

Senior Manager at Happiest Minds Technologies

We use the solution for open-source security management. The product connects the entire customer entity into DevOps and DevSecOps. Solutions like Black Duck and Code Dx enable application testing and onboarding of different applications from entities for security. All the users in different…

Read full review

Aaron P

DevOps Engineer at a manufacturing company with 1,001-5,000 employees

The only thing I don't like about the product is that it is quite expensive and it is not very feasible as an open-source platform. One of the other things that I hate about the product stems from my dislike of contacting the support team of Black Duck to know if there are some issues since debugging some issues can be quite difficult. I don't find reliable or feasible documents to help me debug all those issues. The solution's pricing model and documentation areas of concern where improvement is needed. In our company, we get some issues or errors when we run a pipeline, and debugging those errors can be tedious and time-consuming. To minimize the time for debugging errors, I feel that Black Duck needs to add some documentation or something that will make it easy for users to debug the errors instead of seeking help from Black Duck's support team every time. Black Duck can add features, like viewing the vulnerability, to help users figure out the next step if they detect some vulnerability while also providing them some steps to help them follow some remedial steps, along with an explanation of measures to mitigate such issues. Black Duck's UI or server doesn't provide functionality to help users view the vulnerability, which is a process that needs to be automated. The solution's scalability is an area that needs to improve.

Read full review

Sagar Mody

Solutions Architect at a tech services company with 10,001+ employees

It's still a bit inconsistent. For example, sometimes a scan might reveal components or vulnerabilities, and the next day they might not show up. There's a lack of consistency at times. Of course, this could sometimes be due to new vulnerabilities being identified in the public domain after a scan. So, consistent inputs and more streamlined dependency management are needed. It doesn’t clearly show whether vulnerabilities are from direct or transitive dependencies. A clear classification between direct and indirect vulnerabilities is crucial. If I'm looking to improve my product, I need to know out of 'x' vulnerabilities, how many are direct dependencies. With direct dependencies, I can take action, like replacing a component. But with transitive dependencies, we are helpless at times. Often, we have to raise exceptions and work around them. A clear classification between direct and indirect dependencies is something I'd like to see improved.

Read full review

Black Duck mindshare

As of September 2024, the mindshare of Black Duck in the Software Composition Analysis (SCA) category stands at 28.2%, up from 26.9% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Key learnings from peers

Last updated Sep 1, 2024

Valuable Features

Black Duck's most valuable features include auto-analysis of components, vulnerability scanning, an extensive knowledge base, easy-to-use interface, seamless integration for Docker binary file scanning, strong security, policy management, reliable scanning and evaluating of open source software, dependency tree visualization, and effective binary file scanning. It helps protect information, onboard applications into DevOps, ensures license compliance, provides timely vulnerability updates, and offers robust management and policy features.

"We didn't have a central inventory to quickly identify issues or determine how many products were affected. Now under Black Duck, it's all consolidated. You search for a component and immediately see which products use it."
"The cloud option of the product is always available and a positive aspect of the solution."
"The most valuable feature for me in Black Duck is its ability to scan binary files effectively."

Room for Improvement

Users suggest Black Duck needs improvements in scanning speed, user interface ease, pricing, and documentation clarity. They also seek better integration with other tools and more automated features for identifying and managing vulnerabilities. They demand more comprehensive reporting capabilities and functionality that facilitates easier compliance and debugging. Additionally, a clearer classification of dependencies and enhanced customer support are needed.

"It's still a bit inconsistent. For example, if I scan today, it might not show the same results tomorrow."
"The tool's documentation and support are areas of concern where improvements are required."
"I would like to see improvements in Black Duck's reporting capabilities."

ROI

Users report that Black Duck significantly improves their software management by identifying vulnerabilities early, ultimately leading to cost savings. They highlight its effectiveness in ensuring license compliance, which prevents potential legal costs and issues. Black Duck also offers a quick integration with existing workflows, further boosting productivity. Its comprehensive reporting capabilities facilitate better decision-making and risk management. Its robust security features and user-friendly interface contribute to increased efficiency and reduced operational risks.

Pricing

Enterprise buyers evaluating Black Duck found the product's pricing to be high and recommended understanding code size for negotiating costs. There are multiple payment methods, including by product, scale, or code-based size. Some features come at an additional cost, and while Black Duck is fit for extensive licensing compliance needs, smaller organizations might prefer alternatives due to the high expense. Licensing is typically paid annually, with users often rating the price as expensive.

"The price charged by Black Duck is exorbitant."
"The pricing is a little high."
"I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price."

Popular Use Cases

Companies utilize Black Duck primarily for compliance and vulnerability scanning in open-source software. It is integrated into DevSecOps pipelines to examine code for license compliance, detect vulnerabilities, and conduct internal audits during development. Users manage open-source licenses and obligations, implement it in CI/CD integration, and perform extensive security checks on Java code and other third-party applications. Black Duck is essential for ensuring software security and compliance during the M&A process and daily operations.

Service and Support

Customer service and support of Black Duck receive mixed feedback. Many appreciate their unique features and helpful technical team, with quick response times and competent engineers. However, issues such as slow responses, complex processes, and delays, particularly during overlapping workweeks or vacation periods, are highlighted. Some struggle with the support system's efficiency, requiring improvements like a chatbot. A few find delays in technical responses frustrating. Training videos and community site interaction receive positive notes.

Deployment

Initial setup complexity for Black Duck varies by scale. Some find cloud setup simple, while on-premises can be complex and time-consuming, requiring Linux-based installation and regular updates. Documentation quality influences ease, with some needing expert help. Upgrades and integrations may be challenging and manual. Deployment duration is influenced by organizational needs, with some needing weeks and dedicated resources. Both SaaS and on-premises versions are used, with Synopsys managing some installations for smooth operation.

Scalability

Black Duck is well-regarded for its scalability across various organizations, suitable for both large and small enterprises. It supports multiple users and projects, with hundreds of users in some cases. Challenges include occasional delays and pricing policies for increased storage. Its adaptability spans different environments, from laptops to CI/CD pipelines, integrating well with tools like Jira. Many rate its scalability positively, typically around seven or eight out of ten.

Stability

Users find Black Duck's stability good, with many describing it as stable, reliable, and free from crashes. They report minimal bugs but caution about potential issues when transitioning from other tools. Most users rate stability highly, with scores ranging from seven to ten out of ten. Regular maintenance by administrators is mentioned.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Black Duck Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

21%

Manufacturing Company

16%

Computer Software Company

15%

Healthcare Company

Insurance Company

Retailer

Real Estate/Law Firm

Government

Educational Organization

Energy/Utilities Company

Non Profit

Construction Company

Media Company

Logistics Company

University

Transportation Company

Comms Service Provider

Wholesaler/Distributor

Legal Firm

Recreational Facilities/Services Company

Hospitality Company

Outsourcing Company

Consumer Goods Company

Marketing Services Firm

Aerospace/Defense Firm

Pharma/Biotech Company

Performing Arts

Compare Black Duck with alternative products

Learn more about Black Duck

Black Duck integrates into CI/CD pipelines and DevSecOps processes, helping multiple industries detect and handle risks associated with open-source usage. Users leverage it for source and binary analysis to ensure security and compliance before software release. Automatic component analysis, effective vulnerability scanning, and a comprehensive knowledge base are some of its valuable features. Despite needing improvements in scanning speed, UI, and documentation, Black Duck remains crucial for ensuring open-source security and compliance.

What are Black Duck's most important features?

Automatic Component Analysis: Provides automatic identification and analysis of open-source components.
Effective Vulnerability Scanning: Scans for vulnerabilities in both source code and binary files.
Comprehensive Knowledge Base: Offers expansive information on open-source components.
Policy Management: Enables the creation and enforcement of security and compliance policies.
Binary File Scanning: Capable of scanning binary files for in-depth security checks.
Ease of Use: Demonstrates ease of use, particularly on Mac products.
Stability: Known for its stable performance.
Docker Integration: Smooth integration with Docker for enhanced deployment.
Open-source Evaluation: Excellent evaluation capabilities for open-source software.
License Management: Manages open-source licenses effectively.
Easy Installation: Simple installation process.
Secure Onboarding: Ensures secure application onboarding.
API Availability: Provides APIs for custom integrations.
Community Support: Backed by an active community.
Dependency Tree Visualization: Visualizes dependencies for better management.

What benefits or ROI should users look for in reviews?

Improved Compliance: Helps maintain compliance with legal and regulatory requirements.
Risk Mitigation: Reduces risks associated with open-source vulnerabilities.
Enhanced Security: Strengthens software security by identifying and addressing potential issues early.
Time-saving: Automates many aspects of vulnerability scanning and analysis, saving valuable time.
Cost Efficiency: Detects issues early, potentially saving costs related to compliance breaches and security incidents.
Integration Ease: Seamlessly integrates with existing CI/CD pipelines and DevSecOps practices.
Knowledge Resource: Access to comprehensive information aiding better decision-making.

Black Duck is implemented by industries ranging from finance to healthcare, addressing security and compliance in open-source usage. Financial institutions employ it to manage license risks and ensure audit readiness. Healthcare organizations use it to comply with stringent data protection regulations, ensuring patient data security and privacy. Tech companies integrate Black Duck within CI/CD pipelines to maintain the security and compliance of software products before release. Its deployment varies, tailored to meet the specific risk management and compliance needs dictated by each sector's regulatory environment.

Black Duck was previously known as Blackduck Hub, Black Duck Protex, Black Duck Security Checker.