Black Duck CISO: Dom Glavach

What the company sells

Black Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA. Black Duck offers True Scale Application Security, which it says empowers organizations to build trust in their software. Black Duck's solutions identify, manage and remediate security vulnerabilities, license compliance risks and code quality issues across the entire software development life cycle. Black Duck says its solutions enable teams to secure proprietary and open source components and AI-generated code. Greg Hughes is CEO of Black Duck. Black Duck says 4,000+ organizations choose its products.

Black Duck Polaris Platform unifies scanning, automation and policy controls in one platform. Black Duck says teams can unify SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business. Black Duck Signal AI agents work as an extension of the customer's team, finding and fixing vulnerabilities. Coverity Static Analysis provides code scans with actionable suggestions so developers and security teams can resolve issues. Defensics Fuzzing uses black box fuzzing techniques on services and protocols to find obscure vulnerabilities before they are exploited.

Black Duck SCA identifies all open source dependencies in a customer's software and generates a Software Bill of Materials. Black Duck says it monitors components against vulnerability databases, including its proprietary KnowledgeBase, and alerts teams to new threats without requiring new scans. For licensing, Black Duck SCA surfaces the exact licenses used for every open source dependency it identifies. Black Duck says the EU CRA requires comprehensive SBOMs and timely vulnerability management. Black Duck uses LLMs and curated security intelligence to generate minimal patches for vulnerable dependencies, including cases with no upstream fix. Black Duck expands exploitability and reachability analysis across source code, binaries and containers. Black Duck detects embedded open source and hybrid AI models using signature-based analysis.

The Code Sight IDE plug-in integrates SAST and SCA scans into the developer IDE. Black Duck gives developers real-time analysis of security defects in their code and open source components directly within the IDE. Black Duck sources remediation guidance from the Cybersecurity Research Center (CyRC). Black Duck offers interactive application security testing that monitors application behavior in the background of preproduction runtime testing. Black Duck's security tools integrate with source code management solutions to enable scans on every pull or merge request. Black Duck's security tools integrate with build and CI tools to add security into CI/CD pipelines. Black Duck Jenkins Plugin automates building, uploading, and scanning of application code in Jenkins pipelines. Black Duck integrates with binary repositories to host approved open source packages and store build artifacts. The Black Duck plugin for JIRA creates issues based on vulnerabilities and issue policy violations detected by Black Duck. The Black Duck plugin for Slack lets teams create Slack notifications based on vulnerabilities and policy violations detected by Black Duck.

Black Duck offers an open platform that can integrate with several third-party security testing tools to consolidate SAST, SCA, DAST, Infrasec, CNAPP, IaC and pen testing in one place. Black Duck says its ASPM solution can ingest vulnerability findings from Checkmarx, Snyk and Veracode into Polaris. Black Duck helps track and prioritize issues against functional safety, security and industry standards, with native reports to prove compliance.

Open Source and Third-Party Software audits use software composition techniques, the Black Duck KnowledgeBase and open source-expert auditors. Static Application Security Testing audits combine automated scanning with expert source code review. Penetration Test audits simulate real-world attacks to evaluate security from the outside-in. Secure Design Review audits involve interviews with application engineers to assess the design of core security controls. Design Quality audits use insights from expert software architects and advanced analysis to assess modularity and hierarchy. Code Quality audits combine static analysis with manual code review. Black Duck acts as a technical advisor to private equity firms and their portfolio companies. Black Duck has advised acquirers on software due diligence in thousands of transactions.

Black Duck offers penetration testing that examines an attack surface including web apps, APIs, VPNs, storage and databases, VMs, and authentication and authorization practices. Black Duck offers CNAPP and cloud workload protection program (CWPP) accelerators and cloud security experts for solution design, implementation and SecOps training. Black Duck offers technical integration and configuration support, product education tutorials and security training to fast-track AppSec projects. Black Duck offers technical help through global support, account teams and experts in its community network.^{[1][4][5][6][7][8][9][10][11][12][14][15]}

Categories

• Software composition analysis (primary category)
• Static application security testing
• Dynamic application security testing
• Compare Black Duck with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Owned by Clearlake Capital Group and Francisco Partners since 2024^{[2][3][13][20]}

CISO on record

Dom Glavach, Chief Information Security Officer (CISO) (appointment announced in the week of April 6, 2026)

Website

blackduck.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Black Duck Polaris Platform^[6]

  A single SaaS platform for AppSec testing, automation and policy controls.

  Black Duck describes Polaris as a platform that unifies SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business.

• Coverity Static Analysis^[1][8]

  Static code analysis built for developers and backed by security teams.

• Black Duck SCA^[8][9]

  Software composition analysis for open source and third-party code.

  Black Duck SCA identifies all open source dependencies in software and generates a Software Bill of Materials. It surfaces the licenses used for each identified open source dependency.

• Defensics Fuzzing^[8]

  Black box fuzzing of services and protocols.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Black Duck's categories, then alphabetical. A list from the record, never a ranking.

• On software composition analysis, Black Duck competes with Mend.io, Endor Labs, Snyk, Sonatype, Checkmarx, Invicti, Veracode, Arnica, GitLab, JFrog and 10 more.

• On static application security testing, Black Duck competes with Checkmarx, Veracode, GitLab, Kiuwan, Semgrep, AISLE, GitHub Advanced Security, OpenText, Invicti, Mend.io and 13 more.

• On dynamic application security testing, Black Duck competes with Invicti, Beagle Security, Detectify, StackHawk, Checkmarx, Mend.io, Veracode, Fleuret AI, 42Crunch, Astra Security and 7 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 5.0 out of 5^[20]seen November 5, 2026
• Gartner Peer Insights · no rating shown · 433 reviews^[3]seen November 5, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• April 9, 2026

  Black Duck appointed Dom Glavach as Chief Information Security Officer to lead its global security strategy. Black Duck^[16]

• February 11, 2026

  Black Duck signed a managed security service provider agreement with Accenture. PR Newswire^[17]

• December 10, 2025

  Black Duck launched Black Duck Signal, an agentic AI solution for detecting and remediating vulnerabilities in applications. Black Duck^[18]

• December 3, 2025

  Black Duck appointed Roman Telerman as its new Chief Financial Officer. Black Duck^[19]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]blackduck.comBlack Duck · blackduck.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Clearlake and francisco partners complete acquisition of black duck software formerly known as synopsys software integrity group 302264926Clearlake Capital Group via PR Newswire · prnewswire.com · published October 1, 2024 · Tier A: the company, a regulator or a filing
3. [3]Black Duck Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 23, 2026 · Tier C
4. [4]Application Security Testing | Software Composition Analysis & Open Source Security | SAST/DAST/SCA | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
5. [5]Black Duck Named a Leader in the Inaugural 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security - Jun 22, 2026Black Duck · published June 22, 2026 · Tier A: the company, a regulator or a filing
6. [6]Polaris Demo | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
7. [7]Get pricing | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
8. [8]Embedded and ISV Software | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
9. [9]Open Source Security & License Compliance | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
10. [10]DevOps integrations for developers | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
11. [11]Security Solutions for development and DevOps teams | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
12. [12]Software Audit Services | Security & Due Diligence | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
13. [13]Mergers & Acquisitions | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
14. [14]Application Security Solutions for Cloud Security | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
15. [15]Black Duck Customer Success | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
16. [16]Black Duck Appoints Dom Glavach as Chief Information Security OfficerBlack Duck · published April 9, 2026 · Tier A: the company, a regulator or a filing
17. [17]Black Duck Announces MSSP Agreement with Accenture, Combining World-Class Application Security Technology and ServicesPR Newswire · published February 11, 2026 · Tier A: the company, a regulator or a filing
18. [18]Introducing Black Duck Signal™: Agentic AI Application Security for Modern DevelopmentBlack Duck · published December 10, 2025 · Tier A: the company, a regulator or a filing
19. [19]Black Duck Appoints Roman Telerman as Chief Financial Officer to Drive Strategic GrowthBlack Duck · published December 3, 2025 · Tier A: the company, a regulator or a filing
20. [20]Black Duck Polaris Platform Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed November 5, 2026 · Tier C

Last verified November 2, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 5, 2026 from the references above.

Work for Black Duck? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.