Black Duck vs Snyk comparison

Read 42 Snyk reviews

10,977 Views
7,686 Comparison Views

100% willing to recommend

Black Duck

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on May 22, 2022

We performed a comparison between Black Duck and Snyk based on our users’ reviews in five categories. After reading all of the collected data, you can find our conclusion below.

Ease of Deployment: While some Black Duck reviewers report the initial setup to be straightforward, others feel that the setup can be complex. Snyk users say the initial setup is straightforward and easy.

Features: Users of both products are happy with their ease-of-use, stability, and scalability. Black Duck reviewers like its vulnerability scanning abilities but say its analytics need to improve. Snyk users say it integrates well, has a good interface, and significantly reduces vulnerabilities. A couple of Snyk users mention that they would like improved reporting visibility.

Pricing: Most Black Duck users feel it is an expensive product, whereas most Snyk users say it is reasonably priced.
ROI: Black Duck reviewers do not mention ROI. Snyk users report a significant ROI.

Service and Support: Some Black Duck users are satisfied with the support they receive, while others write that the support’s response time is slow. Snyk users report being very satisfied with the level of support they receive.

Comparison Results: Snyk is the clear winner in this comparison. It is easy to deploy, secure, and powerful. In addition, it has excellent customer support and an impressive ROI.

To learn more, read our detailed Black Duck vs. Snyk Report (Updated: July 2024).

Download the complete report

Black Duck vs. Snyk

July 2024

Helped 793,295 peers since 2012

Categories and Ranking

Black Duck

Ranking in Software Composition Analysis (SCA)

1st

Average Rating

7.8

Number of Reviews

Ranking in other categories

No ranking in other categories

Snyk

Ranking in Software Composition Analysis (SCA)

2nd

Average Rating

8.2

Number of Reviews

Ranking in other categories

Application Security Tools (4th), Container Security (6th), Software Development Analytics (2nd), DevSecOps (1st)

Mindshare comparison

As of July 2024, in the Software Composition Analysis (SCA) category, the mindshare of Black Duck is 26.0%, down from 27.9% compared to the previous year. The mindshare of Snyk is 17.8%, down from 18.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Unique Categories:

No other categories found

Application Security Tools

7.8%

Container Security

4.8%

Featured Reviews

Sagar Mody

Solutions Architect at a tech services company with 10,001+ employees

Apr 12, 2024

Effectively flags operational vulnerabilities and recommendations for fixes are very helpful

It's still a bit inconsistent. For example, sometimes a scan might reveal components or vulnerabilities, and the next day they might not show up. There's a lack of consistency at times. Of course, this could sometimes be due to new vulnerabilities being identified in the public domain after a scan. So, consistent inputs and more streamlined dependency management are needed. It doesn’t clearly show whether vulnerabilities are from direct or transitive dependencies. A clear classification between direct and indirect vulnerabilities is crucial. If I'm looking to improve my product, I need to know out of 'x' vulnerabilities, how many are direct dependencies. With direct dependencies, I can take action, like replacing a component. But with transitive dependencies, we are helpless at times. Often, we have to raise exceptions and work around them. A clear classification between direct and indirect dependencies is something I'd like to see improved.

Read full review

Nixon Bagalkoti

Cyber Security Lead at a printing company with 201-500 employees

Aug 17, 2022

Does a good analysis from the licensing and open-source perspective, but the UI, reporting, and scanning should be better

I had a list of what they can improve, and I did share that with them. They are coming up with a beta version. It can be improved from the reporting perspective and scanning perspective. They can also improve it on the UI front. When we started the PoC five months ago, we encountered all these things. So, I asked them to improve on them. They have come up with a lot of new features, but they are still lacking on the UI front and the reporting side of things. If you go to the UI front of Snyk, you won't find it so friendly. Another one is that you can't see the projects clearly. It gets all the sources from the repository. It pulls all the projects from the repository and creates a new project altogether for every new addition. So, you can't group them clearly. For example, if I have one product with different repositories, it creates a number of projects underneath in the Snyk UI. When it comes to reporting, if I run a scan on a particular project, I want the report only for that particular project in a PDF format that I can share with others. Currently, you get the notification over an email with all the projects but not in detail. You have to go to Snyk to find the details of a particular project. You only get a generic view, and you don't get a detailed view of a project. You need to go to the tool, export it as a CSV, and then find it, which is ridiculous. With other tools, once the scan is complete, we can just share the report with the development team that is working on that project, but Snyk doesn't let us do that. They still need to work a lot on the reporting structure. It also needs to be improved in terms of interdependencies. When you run a code scan, the code can have interdependencies. If you have found a vulnerable line somewhere, it might lead to other interdependencies. Currently, Snyk doesn't provide you with interdependencies. For example, it doesn't provide you with the best location to do the fix. Checkmarx does that, and after you fix a particular line of code, all the other dependencies are automatically fixed. Snyk doesn't offer that. So, you have to do the fix one by one, which is a tedious task for the development team. It takes a lot of effort. I shared this feedback with them, and they might be working on it. They told me that they'll consider that.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The cloud option of the product is always available and a positive aspect of the solution."

"The stability is okay."

"The knowledge base and the management system are the most valuable features of Black Duck Hub. It has a very helpful management environment. They offer an editor where we can check the discovered license, which is retrieved from their knowledge base. They have a huge knowledge base build over the years. It gives you some possibilities, such as this license with possibility A could cause a vulnerability issue or a potential breach."

"The solution is stable."

"We accidentally use third-party library APIs, which may not be secure. Our technical team may not have the end time or expertise to figure it out. Black Duck helps us with that and saves us time."

"Policy management is a valuable feature."

"I like the fact that the product auto analyzes components."

"Black Duck is pretty extensive in terms of the scan reserves and the vulnerability exposures. From that perspective, I'm happy with it."

More Black Duck pros

"It is easy for developers to use. The documentation is clear as well as the APIs are good and easily readable. It's a good solution overall."

"Provides clear information and is easy to follow with good feedback regarding code practices."

"Snyk helps me pinpoint security errors in my code."

"It has improved our vulnerability rating and reduced our vulnerabilities through the tool during the time that we've had it. It's definitely made us more aware, as we have removed scoping for existing vulnerabilities and platforms since we rolled it out up until now."

"There are many valuable features. For example, the way the scanning feature works. The integration is cool because I can integrate it and I don't need to wait until the CACD, I can plug it in to our local ID, and there I can do the scanning. That is the part I like best."

"Snyk categorizes the level of vulnerability into high, medium, and low, which helps organizations prioritize which issues to tackle first."

"Snyk is a good and scalable tool."

"The most valuable features are their GitLab and JIRA integrations. The GitLab integration lets us pull projects in pretty easily, so that it's pretty minimal for developers to get it set up. Using the JIRA integration, it's also pretty easy to get the information that is generated, as a result of that GitLab integration, back to our teams in a non-intrusive way and in a workflow that we are already using."

More Snyk pros

Cons

"The initial setup could be simplified. It was somewhat complex."

"It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance."

"I would like to see improvements in Black Duck's reporting capabilities."

"They are giving a lot of APIs and Python scripts for certain functionalities, but instead of using APIs and Python scripts, they should provide these functionalities through the UI. Users should be able to customize and add more fields through the UI. Users should be able to add more fields and generate reports. Currently, they are not giving flexibility in the UI. They're providing a script that simply generates an Excel file or CSV file. There is no flexibility."

"The solution must provide more open APIs."

"We have been having some issues with the latest releases where we are not able to scan our applications with the help of Black Duck."

"The documentation is quite scattered."

"The scanner client is limited by the size of software it can handle."

More Black Duck cons

"For the areas that they're new in, it's very early stages for them. For example, their expertise is in looking at third-party components and packages, which is their bread-and-butter and what they've been doing for ages, but for newer features such as static analysis I don't think they've got compatibility for all the languages and frameworks yet."

"We have to integrate with their database, which means we need to send our entire code to them to scan, and they send us the report. A company working in the financial domain usually won't like to share its code or any information outside its network with any third-party provider."

"They were a couple of issues which happened because Snyk lacked some documentation on the integration side. Snyk is lacking a lot of documentation, and I would like to see them improve this. This is where we struggle a bit. For example, if something breaks, we can't figure out how to fix that issue. It may be a very simple thing, but because we don't have the proper documentation around an issue, it takes us a bit longer."

"It can be improved from the reporting perspective and scanning perspective. They can also improve it on the UI front."

"We would like to have upfront knowledge on how easy it should be to just pull in an upgraded dependency, e.g., even introduce full automation for dependencies supposed to have no impact on the business side of things. Therefore, we would like some output when you get the report with the dependencies. We want to get additional information on the expected impact of the business code that is using the dependency with the newer version. This probably won't be easy to add, but it would be helpful."

"I use Snyk alongside Sonar, and Snyk tends to generate a lot of false positives. Improving the overall report quality and reducing false positives would be beneficial. I don't need additional features; just improving the existing ones would be enough."

"Scalability has some issues because we have a lot of code and its use is mandatory. Therefore, it can be slow at times, especially because there are a lot of projects and reporting. Some UI improvements could help with this."

"The solution could improve the reports. They have been working on improving the reports but more work could be done."

More Snyk cons

Pricing and Cost Advice

"It is expensive."

"I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price."

"Black Duck is more suitable if you require a lot of licensing compliance. For smaller organizations, WhiteSource is better because its pricing policies are not really suitable for huge organizations."

"The price is low. It's not an expensive solution."

"The price charged by Black Duck is exorbitant."

"The pricing is a little high."

"The price is quite high because the behavior of the software during the scan is similar to competing products."

"Depending on the use case, the cost could range from $10,000 USD to $70,000 USD."

"For what Snyk offers, it has the best cost-benefit I have ever seen because you're buying the license per user."

"The solution is less expensive than Black Duck."

"We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon"

"You can get a good deal with Snyk for pricing. It's a little expensive, but it is worth it."

"Pricing-wise, it is not expensive as compared to other tools. If you have a couple of licenses, you can scan a certain number of projects. It just needs to be attached to them."

"It is pretty expensive. It is not a cheap product."

"Cost-wise, it's similar to Veracode, but I don't know the exact cost."

"Despite Snyk's coverage, scalability, reliability, and stability, it is available at a very competitive price."

More Snyk pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

793,295 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Manufacturing Company

16%

Computer Software Company

15%

Healthcare Company

Computer Software Company

16%

Financial Services Firm

15%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How does WhiteSource compare with Black Duck?

We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license compl...

What do you like most about Black Duck?

The cloud option of the product is always available and a positive aspect of the solution.

What is your experience regarding pricing and costs for Black Duck?

The price charged by Black Duck is exorbitant. For the features provided by the product, I would not want to pay a high price. There are many other products in the market that offer better features...

How does Snyk compare with SonarQube?

Snyk does a great job identifying and reducing vulnerabilities. This solution is fully automated and monitors 24/7 to find any issues reported on the internet. It will store dependencies that you a...

What do you like most about Snyk?

The most effective feature in securing project dependencies stems from its ability to highlight security vulnerabilities.

What needs improvement with Snyk?

I use Snyk alongside Sonar, and Snyk tends to generate a lot of false positives. Improving the overall report quality and reducing false positives would be beneficial. I don't need additional featu...

Fortify Static Code Analyzer vs Black Duck

Comparisons

Compared 19% of the time

JFrog Xray vs Black Duck

Compared 12% of the time

Mend.io vs Black Duck

Compared 9% of the time

FOSSA vs Black Duck

Compared 7% of the time

Sonatype Lifecycle vs Black Duck

Compared 6% of the time

More Black Duck Competitors

SonarQube vs Snyk

Compared 14% of the time

GitHub Advanced Security vs Snyk

Compared 10% of the time

Fortify Static Code Analyzer vs Snyk

Compared 6% of the time

Veracode vs Snyk

Compared 6% of the time

Wiz vs Snyk

Compared 5% of the time

More Snyk Competitors

Product Reports

Download Black Duck product report

Black Duck

July 2024

Download Snyk product report

June 2024

Also Known As

Blackduck Hub, Black Duck Protex, Black Duck Security Checker

No data available

Learn More

Synopsys

Overview

Black Duck is a comprehensive solution for managing security, license compliance, and code quality risks that come from the use of open source in applications and containers. Named a leader in software composition analysis (SCA) by Forrester, Black Duck gives you unmatched visibility into third-party code, enabling you to control it across your software supply chain and throughout the application life cycle.

Snyk is a user-friendly security solution that enables users to safely develop and use open source code. Users can create automatic scans that allow them to keep a close eye on their code and prevent bad actors from exploiting vulnerabilities. This enables users to find and remove vulnerabilities soon after they appear.

Benefits of Snyk

Some of the benefits of using Snyk include:

Conserves resources: Snyk easily integrates with other security solutions and uses their security features to ensure that the work that users are doing is completely secure. These integrations allow them to protect themselves without pulling resources from their continued integration or continued delivery workflows. Resources can be conserved for areas of the greatest need.

Highly flexible: Snyk enables users to customize the system’s security automation features to meet their needs. Users can guarantee that the automation performs the functions that are most essential for their current project. Additionally, users are able to maintain platform governance consistency across their system.

Keeps users ahead of emerging threats. Snyk employs a database of threats that help it detect and keep track of potential issues. This database is constantly being updated to reflect the changes that take place in the realm of cybersecurity. It also uses machine learning. Users are prepared to deal with new issues as they arise.

Automatically scans projects for threats. Snyk’s command-line interface enables users to schedule the solution to run automatic scans of their projects. Time and manpower can be conserved for the areas of greatest need without sacrificing security.

Reviews from Real Users

Snyk is a security platform for developers that stands out among its competitors for a number of reasons. Two major ones are its ability to integrate with other security solutions and important insights that it can enable users to discover. Snyk enables users to combine its already existing security features with those of other solutions to create far more robust and flexible layers of security than what it can supply on its own. It gives users the ability to dig into the security issues that they may experience. Users are given a clear view of the root causes of these problems. This equips them to address the problem and prevent similar issues in the future.

Cameron G., a security software engineer at a tech company, writes, “The most valuable features are their GitLab and JIRA integrations.The GitLab integration lets us pull projects in pretty easily, so that it's pretty minimal for developers to get it set up. Using the JIRA integration, it's also pretty easy to get the information that is generated, as a result of that GitLab integration, back to our teams in a non-intrusive way and in a workflow that we are already using. Snyk is something of a bridge that we use; we get our projects into it and then get the information out of it. Those two integrations are crucial for us to be able to do that pretty simply.”

Sean M., the chief information security officer of a technology vendor, writes, "From the software composition analysis perspective, it first makes sure that we understand what is happening from a third-party perspective for the particular product that we use. This is very difficult when you are building software and incorporating dependencies from other libraries, because those dependencies have dependencies and that chain of dependencies can go pretty deep. There could be a vulnerability in something that is seven layers deep, and it would be very difficult to understand that is even affecting us. Therefore, Snyk provides fantastic visibility to know, "Yes, we have a problem. Here is where it ultimately comes from." It may not be with what we're incorporating, but something much deeper than that."

Sample Customers

Samsung, Siemens, ScienceLogic, BryterCX, Dynatrace

StartApp, Segment, Skyscanner, DigitalOcean, Comic Relief