Black Duck vs JFrog Xray comparison

You must select at least 2 products to compare!
Synopsys Logo
14,718 views|10,174 comparisons
82% willing to recommend
JFrog Logo
5,691 views|4,251 comparisons
100% willing to recommend
Comparison Buyer's Guide
Executive Summary
Updated on Mar 6, 2024

We compared Black Duck and JFrog Security Essentials based on our user's reviews in several parameters.

In summary, Black Duck excels in comprehensive code scanning and open-source software management, with positive customer service feedback. JFrog Security Essentials stands out for its outstanding customer support and advanced security features, with competitive pricing. However, Black Duck needs improvement in user interface and documentation, while JFrog should focus on UI and performance enhancements.

Features: Black Duck's valuable features include comprehensive code scanning, open source software management, real-time vulnerability alerts, customizable dashboards, and integration with development tools. JFrog Security Essentials offers comprehensive security, seamless integration, efficient vulnerability scanning, reliable artifact analysis, and proactive alert notifications.

Pricing and ROI: Black Duck's setup cost is intuitive and adaptable, with flexible pricing options. On the other hand, JFrog Security Essentials offers a straightforward and hassle-free setup cost, ensuring a smooth installation process with flexible licensing agreements., The ROI from Black Duck has been positive according to user feedback. Users found JFrog Security Essentials to be highly effective in enhancing security measures, mitigating risks, and safeguarding valuable assets.

Room for Improvement: Black Duck could benefit from improving the user interface, search functionality, performance, and documentation. JFrog Security Essentials needs enhancements for its user interface, performance, documentation, and additional features for a more robust security solution.

Deployment and customer support: The reviews suggest that there may be variations in the duration required for establishing a new tech solution, depending on the specific context. For Black Duck, one user spent three months on deployment and an additional week on setup, while another user spent a week on both. As for JFrog Security Essentials, one user took three months for deployment and an extra week for setup, while another user took a week for both. These differences highlight the contrasting approaches to deployment and setup between Black Duck and JFrog Security Essentials., Black Duck's customer service receives positive feedback for their efficient assistance, responsiveness, and willingness to go above and beyond. JFrog Security Essentials excels in providing outstanding customer service with promptness, professionalism, and going the extra mile to resolve issues.

The summary above is based on 12 interviews we conducted recently with Black Duck and JFrog Security Essentials users. To access the review's full transcripts, download our report.

To learn more, read our detailed Black Duck vs. JFrog Xray Report (Updated: May 2024).
771,862 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
"The solution is stable.""I like the fact that the product auto analyzes components.""The most valuable feature is the vulnerability scanning, and that it's easy to use.""The most valuable feature for me in Black Duck is its ability to scan binary files effectively.""The solution is very good at scanning and evaluating open source software.""The solution works well on Mac products.""The cloud option of the product is always available and a positive aspect of the solution.""The UI is the solution's most valuable feature since it allows for easy pipeline integration."

More Black Duck Pros →

"The solution is stable and reliable.""JFrog Xray shows us a list of vulnerabilities that can impact our code.""If multiple dependencies and vulnerabilities are found in a project, JFrog Xray is intelligent enough to tell you which vulnerability to target first.""JFrog Xray's reporting feature has a lot of options in it, including scanning.""I would say that this solution has helped our organization by allowing us to automate a lot of the processes.""The most valuable feature of JFrog Xray is the display of the entire internal dependencies hierarchy.""Good reporting functionalities."

More JFrog Xray Pros →

"They are giving a lot of APIs and Python scripts for certain functionalities, but instead of using APIs and Python scripts, they should provide these functionalities through the UI. Users should be able to customize and add more fields through the UI. Users should be able to add more fields and generate reports. Currently, they are not giving flexibility in the UI. They're providing a script that simply generates an Excel file or CSV file. There is no flexibility.""It needs to be more user-friendly for developers and in general, to ensure compliance.""I would like to see improvements in Black Duck's reporting capabilities.""The solution must provide more open APIs.""It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance.""The product's pricing is higher compared to other competitor products.""Due to the fact that, with our software developer life cycle, we don't need to scan our source code every day or every week. For that reason, we find the cost is too high. We might only actually use it five to ten times a year, which makes it expensive.""Black Duck can improve the time it takes for a scan. Most of the time it's not ideal when integrated with the live DevSecOps pipeline. We have to create a separate job to scan the library because it takes a couple of hours to scan all those libraries. The scanning could be faster."

More Black Duck Cons →

"JFrog Xray's documentation and error logging could be improved.""Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore, we require customized reports from the Xray tool.""Lacks deeper reporting, the ability to compare things.""The speed of JFrog Xray should improve. Other solutions have better performance.""I think that the user interface should be expanded to provide customers with a better dashboard for reviewing their feedback regarding their images and the vulnerabilities that are associated with the images.""Since we have been using the solution via APIs, there are some limitations in the APIs.""JFrog Xray does not have a dashboard."

More JFrog Xray Cons →

Pricing and Cost Advice
  • "Depending on the use case, the cost could range from $10,000 USD to $70,000 USD."
  • "The price is quite high because the behavior of the software during the scan is similar to competing products."
  • "The price is low. It's not an expensive solution."
  • "Black Duck is more suitable if you require a lot of licensing compliance. For smaller organizations, WhiteSource is better because its pricing policies are not really suitable for huge organizations."
  • "It is expensive."
  • "I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price."
  • "The pricing is a little high."
  • "The price charged by Black Duck is exorbitant."
  • More Black Duck Pricing and Cost Advice →

    Information Not Available
    Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
    771,862 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license… more »
    Top Answer:The cloud option of the product is always available and a positive aspect of the solution.
    Top Answer:The price charged by Black Duck is exorbitant. For the features provided by the product, I would not want to pay a high price. There are many other products in the market that offer better features… more »
    Top Answer:JFrog Xray shows us a list of vulnerabilities that can impact our code.
    Top Answer:There is a tool called DefectDojo for reporting. Reporting is crucial, but it is lacking in the current tool. Every organization seeks specific data points rather than general information. Therefore… more »
    Top Answer:We use this solution to identify vulnerabilities in the dependency file. We have the Artifactory package which integrates with Xray-like plugins. We can automatically plug this tool into Xray to… more »
    Average Words per Review
    Average Words per Review
    Snyk logo
    Compared 23% of the time. logo
    Compared 10% of the time.
    FOSSA logo
    Compared 7% of the time.
    Sonatype Lifecycle logo
    Compared 6% of the time.
    Snyk logo
    Compared 10% of the time. logo
    Compared 8% of the time.
    Veracode logo
    Compared 8% of the time.
    Trivy logo
    Compared 6% of the time.
    Also Known As
    Blackduck Hub, Black Duck Protex, Black Duck Security Checker
    JFrog Security Essentials
    Learn More

    Black Duck is a comprehensive solution for managing security, license compliance, and code quality risks that come from the use of open source in applications and containers. Named a leader in software composition analysis (SCA) by Forrester, Black Duck gives you unmatched visibility into third-party code, enabling you to control it across your software supply chain and throughout the application life cycle.

    JFrog is on a mission to enable continuous updates through Liquid Software, empowering developers to code high-quality applications that securely flow to end-users with zero downtime. The world’s top brands such as Amazon, Facebook, Google, Netflix, Uber, VMware, and Spotify are among the 4500 companies that already depend on JFrog to manage binaries for their mission-critical applications. JFrog is a privately-held, global company, and is a proud sponsor of the Cloud Native Computing Foundation [CNCF].

    If you are a team player and you care and you play to WIN, we have just the job you're looking for.

    As we say at JFrog: "Once You Leap Forward You Won't Go Back!"​

    Sample Customers
    Samsung, Siemens, ScienceLogic, Noser Engineering AG, ClickFox, Dynatrace, CopperLeaf
    google, amazon, cisco, netflix, oracle, vmware, facebook
    Top Industries
    Manufacturing Company67%
    Computer Software Company17%
    Financial Services Firm17%
    Financial Services Firm21%
    Manufacturing Company15%
    Computer Software Company15%
    Healthcare Company4%
    Financial Services Firm24%
    Manufacturing Company15%
    Computer Software Company12%
    Insurance Company5%
    Company Size
    Small Business32%
    Large Enterprise68%
    Small Business15%
    Midsize Enterprise10%
    Large Enterprise75%
    Midsize Enterprise29%
    Large Enterprise71%
    Small Business14%
    Midsize Enterprise10%
    Large Enterprise76%
    Buyer's Guide
    Black Duck vs. JFrog Xray
    May 2024
    Find out what your peers are saying about Black Duck vs. JFrog Xray and other solutions. Updated: May 2024.
    771,862 professionals have used our research since 2012.

    Black Duck is ranked 1st in Software Composition Analysis (SCA) with 19 reviews while JFrog Xray is ranked 7th in Software Composition Analysis (SCA) with 7 reviews. Black Duck is rated 7.8, while JFrog Xray is rated 8.2. The top reviewer of Black Duck writes "Enables applications to be secure, but it must provide more open APIs". On the other hand, the top reviewer of JFrog Xray writes "An intelligent solution that prioritizes which vulnerability to target first in your project". Black Duck is most compared with Snyk, Fortify Static Code Analyzer,, FOSSA and Sonatype Lifecycle, whereas JFrog Xray is most compared with Snyk,, Veracode, Trivy and Fortify Static Code Analyzer. See our Black Duck vs. JFrog Xray report.

    See our list of best Software Composition Analysis (SCA) vendors.

    We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.