We performed a comparison between Black Duck, FlexNet Code Insight, and Mend.io based on real PeerSpot user reviews.
Find out what your peers are saying about Synopsys, Snyk, Veracode and others in Software Composition Analysis (SCA)."The cloud option of the product is always available and a positive aspect of the solution."
"I like the fact that the product auto analyzes components."
"We accidentally use third-party library APIs, which may not be secure. Our technical team may not have the end time or expertise to figure it out. Black Duck helps us with that and saves us time."
"It highlights what the developers have done, and it shows the impact from an intellectual property point of view."
"The solution works well on Mac products."
"The most valuable feature for me in Black Duck is its ability to scan binary files effectively."
"We didn't have a central inventory to quickly identify issues or determine how many products were affected. Now under Black Duck, it's all consolidated. You search for a component and immediately see which products use it."
"The most valuable feature of Black Duck is the seamless integration to scan our Docker binary files, it provides us all open vulnerabilities, and it ensures a reference point from where it finds the vulnerability is up to date. For example, if there is any new vulnerability found, they are immediately available in the Black Duck. There is no delay in finding the vulnerabilities, they are called out in our code immediately."
"It had a web interface into the reporting tools that was decent, and open source components could be reported per project and/or aggregated similar to other software composition tools."
"We set the solution up and enabled it and we had everything running pretty quickly."
"What is very nice is that the product is very easy to set up. When you want to implement Mend.io, it just takes a few minutes to create your organization, create your products, and scan them. It's really convenient to have Mend scanning your products in less than one hour."
"The dashboard view and the management view are most valuable."
"The vulnerability analysis is the best aspect of the solution."
"Its ease of use and good results are the most valuable."
"The inventory management as well as the ability to identify security vulnerabilities has been the most valuable for our business."
"We can take some measures to improve things, replace a library, or update a library which was too old or showed severe bugs."
"The overall support that we receive is pretty good. "
"The documentation is quite scattered."
"Due to the fact that, with our software developer life cycle, we don't need to scan our source code every day or every week. For that reason, we find the cost is too high. We might only actually use it five to ten times a year, which makes it expensive."
"The solution's pricing model and documentation areas of concern where improvement is needed."
"It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance."
"I would like to see more integration with other solutions, such as IntelliJ IDEA."
"The scanner client is limited by the size of software it can handle."
"I would like to see improvements in Black Duck's reporting capabilities."
"It's still a bit inconsistent. For example, if I scan today, it might not show the same results tomorrow."
"I found the user interface cumbersome and difficult to use."
"It should support multiple SBOM formats to be able to integrate with old industry standards."
"The UI can be slow once in a while, and we're not sure if it's because of the amount of data we have, or it is just a slow product, but it would be nice if it could be improved."
"We specifically use this solution within our CICD pipelines in Azure DevOps, and we would like to have a gate so that if the score falls below a certain value then we can block the pipeline from running."
"The only thing that I don't find support for on Mend Prioritize is C++."
"At times, the latency of getting items out of the findings after they're remediated is higher than it should be."
"WhiteSource only produces a report, which is nice to look at. However, you have to check that report every week, to see if something was found that you don't want. It would be great if the build that's generating a report would fail if it finds a very important vulnerability, for instance."
"Needs better ACL and more role definitions. This product could be used by large organisations and it definitely needs a better role/action model."
"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."
Earn 20 points
