Black Duck Software Composition Analysis
Know what’s in your software.
Control what ships.
Discover open source and third-party components, prioritize real risk, automate SBOMs, and build the evidence regulators and customers expect.
Your application is more than the code your team writes.
Modern software depends on open source, commercial components, containers, AI-generated code, and third-party models. If those dependencies are invisible, so are the vulnerabilities, license obligations, and operational risks they introduce.
Go beyond package manifests
Find what other scanners miss.
Black Duck combines complementary analysis methods to identify open source and third-party components across source code, compiled software, containers, firmware, and AI-assisted development.
Snippet Matching
Matches copied or modified code fragments back to their original open source projects—even when a complete component is not present. This is especially valuable for unmanaged code and code produced with AI coding assistants.
Source fragments → Open source originCodePrint Analysis
Uses Black Duck’s signature-based technology to identify open source dependencies in source files and directories, including components that were never declared by a package manager.
Undeclared code → Component identityDependency Analysis
Maps direct and transitive dependencies declared through package managers.
Binary Analysis
Detects dependencies in compiled applications, firmware, and other post-build artifacts without requiring source code.
Container Scanning
Examines container images layer by layer using binary and CodePrint analysis.
C/C++ Discovery
Identifies open source libraries in C and C++ applications where package-manager evidence may not exist.
AI Model Insights
Detects integrated third-party AI and ML models and surfaces associated quality, license, and compliance risk.
From composition to confident action.
Make software supply chain risk visible, measurable, and manageable—without slowing delivery.
Discover deeply
Identify direct and transitive dependencies in source, C/C++, binaries, firmware, containers, and other software artifacts.
Prioritize risk
Map components to vulnerabilities, component health, malicious package indicators, and actionable remediation guidance.
Manage licenses
Surface license obligations and conflicts—including open source matches in AI-generated code—and automate notice files.
Operationalize SBOMs
Import and export complete SBOMs in SPDX or CycloneDX, produce VEX reports, and continuously monitor dependencies.
Govern with policy
Apply risk-based policies, trigger workflows, notify owners, integrate with Jira or Azure, and stop risky components before release.
Innovate with AI
Detect third-party AI/ML models and evaluate AI-generated code for quality, security, license, and compliance risk.
One foundation.
Multiple mandates.
Black Duck SCA supports the shared practices behind modern software security expectations: secure-by-design development, component transparency, continuous vulnerability management, and auditable evidence.
Cyber Resilience Act
Support SBOM creation, ongoing vulnerability monitoring, security-by-design practices, and rapid incident response. Reporting obligations begin September 2026; full applicability follows in December 2027.
FDA Section 524B
Help medical device teams document software components, monitor postmarket vulnerabilities, and maintain the evidence needed for a reasonable assurance of cybersecurity.
SSDF SP 800-218
Align third-party component governance, secure development practices, automated testing, and vulnerability response with the SSDF’s outcome-based framework.
Turn requirements into a roadmap.
Two practical Black Duck guides for security, engineering, compliance, and product leaders.
Software
Supply Chain Your roadmap to CRA, FDA, and NIST compliance
Securing the Software Supply Chain
A practical roadmap to CRA, FDA Section 524B, and NIST SSDF compliance.
Open the guide ↗Shaping Software
Supply Chain Security And the role of SCA
Regulations Shaping Software Supply Chain Security
Compare the FDA requirements, EU CRA, and NIST SSDF—and understand where SCA fits.
Open the eBook ↗Lexington Soft + Black Duck
Let’s secure your software supply chain.
Tell us a little about your organization. We’ll help you evaluate Black Duck SCA against your SBOM, open source governance, and compliance priorities.