CISO Tribune

Vendor comparison · 2 companies

Black Duck vs Data Theorem

Black Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA. Data Theorem sells application security products that secure code, mobile apps, APIs and cloud. CISO Tribune files both under Static application security testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Black Duck
  • Data Theorem
Black Duck vs Data Theorem: Products, Customers and Funding Compared
Black DuckBlack Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA.blackduck.comData TheoremData Theorem sells application security products that secure code, mobile apps, APIs and cloud.datatheorem.com
What it sells
  • Black Duck Polaris Platform[6]A single SaaS platform for AppSec testing, automation and policy controls.
  • Coverity Static Analysis[1][8]Static code analysis built for developers and backed by security teams.
  • Black Duck SCA[8][9]Software composition analysis for open source and third-party code.
  • Defensics Fuzzing[8]Black box fuzzing of services and protocols.
  • Mobile Secure[2][6][8]Automated security and privacy testing for every iOS and Android release.
  • Mobile Protect[2][3][7][13]Mobile Protect defends the app on the device.
  • Code SAST Secure[3][5][8][14][16]SAST, SCA and SBOM across every repo, in more than 20 languages.
  • API Secure[2][5][8][13][15]API Secure discovers every REST, GraphQL, gRPC, SOAP and serverless API.
  • Cloud Secure[2][5][8][16]Cloud Secure extends API Secure into the cloud your APIs and apps run on.
Categories
Headquarters
Not stated on its pagesPalo Alto, United States[1]
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Owned by Clearlake Capital Group and Francisco Partners since 2024[2][3][13][20]Not stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • April 9, 2026Black Duck appointed Dom Glavach as Chief Information Security Officer to lead its global security strategy.[16]
  • February 11, 2026Black Duck signed a managed security service provider agreement with Accenture.[17]
  • December 10, 2025Black Duck launched Black Duck Signal, an agentic AI solution for detecting and remediating vulnerabilities in applications.[18]
  • December 3, 2025Black Duck appointed Roman Telerman as its new Chief Financial Officer.[19]
  • June 30, 2026Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense.[17]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Black Duck sells mainly to development and DevOps teams and to security teams. Black Duck names enterprises, startups, PE firms and legal teams as users of its audits. Black Duck acts as a technical advisor to private equity firms and their portfolio companies. Black Duck says its tools work in the cloud or on premises.From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about. It addresses teams that want to catch issues in code and the pipeline and hand auditors reports built from real scans. Game publishers are addressed with Mobile Protect for Gaming, which stops cheats, tampering and clones in the game.
Last verified
November 2, 2026September 27, 2026

Where they overlap

  • Black Duck and Data Theorem are both filed under Static application security testing.

Where they differ, field by field

  • Black Duck's primary category is Software composition analysis; Data Theorem's is API security.
  • Black Duck is also filed under Dynamic application security testing. Data Theorem is also filed under Mobile security and Cloud-native application protection (CNAPP).
  • Black Duck lists Black Duck Polaris Platform, Coverity Static Analysis, Black Duck SCA and Defensics Fuzzing. Data Theorem lists Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure.
  • Data Theorem is headquartered in Palo Alto, United States.
  • Black Duck is owned by Clearlake Capital Group and Francisco Partners, since 2024.

What it sells: Black Duck

What Black Duck Polaris Platform does[6]
Black Duck describes Polaris as a platform that unifies SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business.
What Black Duck SCA does[8][9]
Black Duck SCA identifies all open source dependencies in software and generates a Software Bill of Materials. It surfaces the licenses used for each identified open source dependency.

What it sells: Data Theorem

What Mobile Secure does[2][6][8]
Mobile Secure provides automated security and privacy testing for every iOS and Android release. Mobile Secure signs in to your apps and tests every screen of every release.
What Mobile Protect does[2][3][7][13]
Mobile Protect blocks hooking frameworks, debuggers and re-signed copies inside the app. Mobile Protect scores every session and flags likely fraud to your team. Mobile Protect includes SSL pinning built on TrustKit.
What Code SAST Secure does[3][5][8][14][16]
Code SAST Secure scans your code and dependencies. Code SAST Secure secures your code, open source libraries and vendor SBOMs in one place. Code SAST Secure catches infrastructure as code misconfigurations in the repository, before they ship.
What API Secure does[2][5][8][13][15]
API Secure scores every operation on its own across authentication. API Secure probes your APIs from outside, then signs in as two different users. API Secure spots the abuse and tells the WAF you already run what to block.
What Cloud Secure does[2][5][8][16]
Cloud Secure covers the resources, roles and data behind the APIs. Cloud Secure runs the same IaC checks on what is deployed, and secures the containers and registry images your APIs and apps run on.

Questions about Black Duck and Data Theorem

What do Black Duck and Data Theorem sell?
Black Duck sells Black Duck Polaris Platform, Coverity Static Analysis, Black Duck SCA and Defensics Fuzzing. Data Theorem sells Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure.
Are Black Duck and Data Theorem in the same category?
They share Static application security testing. Black Duck's primary category is Software composition analysis and Data Theorem's is API security.
Where are Black Duck and Data Theorem headquartered?
Data Theorem is headquartered in Palo Alto, United States.
Who owns Black Duck and Data Theorem?
Black Duck is owned by Clearlake Capital Group and Francisco Partners, since 2024.
Who are Black Duck and Data Theorem sold to?
From its own pages, Black Duck sells mainly to development and DevOps teams and to security teams. From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about.
What have Black Duck and Data Theorem announced recently?
April 9, 2026: Black Duck appointed Dom Glavach as Chief Information Security Officer to lead its global security strategy. June 30, 2026: Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense.

About Black Duck

Black Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA. Black Duck offers True Scale Application Security, which it says empowers organizations to build trust in their software. Black Duck's solutions identify, manage and remediate security vulnerabilities, license compliance risks and code quality issues across the entire software development life cycle. Black Duck says its solutions enable teams to secure proprietary and open source components and AI-generated code. Greg Hughes is CEO of Black Duck. Black Duck says 4,000+ organizations choose its products.[1][4][5][10][12]

Black Duck Polaris Platform unifies scanning, automation and policy controls in one platform. Black Duck says teams can unify SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business. Black Duck Signal AI agents work as an extension of the customer's team, finding and fixing vulnerabilities. Coverity Static Analysis provides code scans with actionable suggestions so developers and security teams can resolve issues. Defensics Fuzzing uses black box fuzzing techniques on services and protocols to find obscure vulnerabilities before they are exploited.[1][4][5][6][7][8][11]

Black Duck SCA identifies all open source dependencies in a customer's software and generates a Software Bill of Materials. Black Duck says it monitors components against vulnerability databases, including its proprietary KnowledgeBase, and alerts teams to new threats without requiring new scans. For licensing, Black Duck SCA surfaces the exact licenses used for every open source dependency it identifies. Black Duck says the EU CRA requires comprehensive SBOMs and timely vulnerability management. Black Duck uses LLMs and curated security intelligence to generate minimal patches for vulnerable dependencies, including cases with no upstream fix. Black Duck expands exploitability and reachability analysis across source code, binaries and containers. Black Duck detects embedded open source and hybrid AI models using signature-based analysis.[1][4][5][8][9]

The Code Sight IDE plug-in integrates SAST and SCA scans into the developer IDE. Black Duck gives developers real-time analysis of security defects in their code and open source components directly within the IDE. Black Duck sources remediation guidance from the Cybersecurity Research Center (CyRC). Black Duck offers interactive application security testing that monitors application behavior in the background of preproduction runtime testing. Black Duck's security tools integrate with source code management solutions to enable scans on every pull or merge request. Black Duck's security tools integrate with build and CI tools to add security into CI/CD pipelines. Black Duck Jenkins Plugin automates building, uploading, and scanning of application code in Jenkins pipelines. Black Duck integrates with binary repositories to host approved open source packages and store build artifacts. The Black Duck plugin for JIRA creates issues based on vulnerabilities and issue policy violations detected by Black Duck. The Black Duck plugin for Slack lets teams create Slack notifications based on vulnerabilities and policy violations detected by Black Duck.[9][10][11]

Black Duck offers an open platform that can integrate with several third-party security testing tools to consolidate SAST, SCA, DAST, Infrasec, CNAPP, IaC and pen testing in one place. Black Duck says its ASPM solution can ingest vulnerability findings from Checkmarx, Snyk and Veracode into Polaris. Black Duck helps track and prioritize issues against functional safety, security and industry standards, with native reports to prove compliance.[8][10]

Open Source and Third-Party Software audits use software composition techniques, the Black Duck KnowledgeBase and open source-expert auditors. Static Application Security Testing audits combine automated scanning with expert source code review. Penetration Test audits simulate real-world attacks to evaluate security from the outside-in. Secure Design Review audits involve interviews with application engineers to assess the design of core security controls. Design Quality audits use insights from expert software architects and advanced analysis to assess modularity and hierarchy. Code Quality audits combine static analysis with manual code review. Black Duck acts as a technical advisor to private equity firms and their portfolio companies. Black Duck has advised acquirers on software due diligence in thousands of transactions.[12]

Black Duck offers penetration testing that examines an attack surface including web apps, APIs, VPNs, storage and databases, VMs, and authentication and authorization practices. Black Duck offers CNAPP and cloud workload protection program (CWPP) accelerators and cloud security experts for solution design, implementation and SecOps training. Black Duck offers technical integration and configuration support, product education tutorials and security training to fast-track AppSec projects. Black Duck offers technical help through global support, account teams and experts in its community network.[12][14][15]

Black Duck on the record

Sources

Black Duck full record

  1. [1]blackduck.comBlack Duck · blackduck.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Clearlake and francisco partners complete acquisition of black duck software formerly known as synopsys software integrity group 302264926Clearlake Capital Group via PR Newswire · prnewswire.com · published October 1, 2024 · Tier A
  3. [3]Black Duck Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 23, 2026 · Tier C
  4. [4]Application Security Testing | Software Composition Analysis & Open Source Security | SAST/DAST/SCA | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  5. [5]Black Duck Named a Leader in the Inaugural 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security - Jun 22, 2026Black Duck · published June 22, 2026 · Tier A
  6. [6]Polaris Demo | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  7. [7]Get pricing | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  8. [8]Embedded and ISV Software | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  9. [9]Open Source Security & License Compliance | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  10. [10]DevOps integrations for developers | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  11. [11]Security Solutions for development and DevOps teams | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  12. [12]Software Audit Services | Security & Due Diligence | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  13. [13]Mergers & Acquisitions | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  14. [14]Application Security Solutions for Cloud Security | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  15. [15]Black Duck Customer Success | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  16. [16]Black Duck Appoints Dom Glavach as Chief Information Security OfficerBlack Duck · published April 9, 2026 · Tier A
  17. [17]Black Duck Announces MSSP Agreement with Accenture, Combining World-Class Application Security Technology and ServicesPR Newswire · published February 11, 2026 · Tier A
  18. [18]Introducing Black Duck Signal™: Agentic AI Application Security for Modern DevelopmentBlack Duck · published December 10, 2025 · Tier A
  19. [19]Black Duck Appoints Roman Telerman as Chief Financial Officer to Drive Strategic GrowthBlack Duck · published December 3, 2025 · Tier A
  20. [20]Black Duck Polaris Platform Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed November 5, 2026 · Tier C

Data Theorem full record

  1. [1]Data theorem unveils code secure fully integrated ast product with sast sca and sbom management 302269428Data Theorem via PR Newswire · prnewswire.com · published October 8, 2024 · Tier A
  2. [2]datatheorem.comData Theorem · datatheorem.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Solutions | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  4. [4]DevSecOps: Security in Every Stage, From Code to Runtime | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  5. [5]Products | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  6. [6]Mobile SecureData Theorem · undated page, accessed October 24, 2026 · Tier A
  7. [7]Mobile ProtectData Theorem · undated page, accessed October 24, 2026 · Tier A
  8. [8]Data Theorem | AppSec | API Security | Cloud SecurityData Theorem · undated page, accessed October 24, 2026 · Tier A
  9. [9]ASPM: Application Security Posture Management | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  10. [10]Data Theorem Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 24, 2026 · Tier C
  11. [11]Regulatory Compliance | Audit-Ready Reports | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  12. [12]AI-Driven Application Security (AppSec) | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  13. [13]AI Runtime Protection for Apps and APIs | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  14. [14]Code SAST Secure: SAST, SCA, SBOM and AI Auto-RemediationData Theorem · undated page, accessed November 3, 2026 · Tier A
  15. [15]API Security Testing and Runtime Protection | API SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  16. [16]Cloud Security for APIs and Cloud-Native Apps | Cloud SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  17. [17]Data Theorem Launches the Industry’s First Closed-Loop AI Security PlatformData Theorem · published June 30, 2026 · Tier A

Spot a factual error? Request a correction.