CISO Tribune

Vendor comparison · 2 companies

Black Duck vs StackHawk

Black Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA. StackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications. CISO Tribune files both under Dynamic application security testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Black Duck
  • StackHawk
Black Duck vs StackHawk: Products, Customers and Funding Compared
Black DuckBlack Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA.blackduck.comStackHawkStackHawk sells two plans, Wingman and StackHawk Scale, that run on HawkScan, a runtime testing engine for running applications.stackhawk.com
What it sells
  • Black Duck Polaris Platform[6]A single SaaS platform for AppSec testing, automation and policy controls.
  • Coverity Static Analysis[1][8]Static code analysis built for developers and backed by security teams.
  • Black Duck SCA[8][9]Software composition analysis for open source and third-party code.
  • Defensics Fuzzing[8]Black box fuzzing of services and protocols.
  • Wingman[15][16]Runs inside a coding agent and tests the running app.
  • StackHawk Scale[15][16]The plan for security teams covering every app in the organization.
  • HawkScan[3][15]The runtime testing engine that tests the running application with real requests.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Owned by Clearlake Capital Group and Francisco Partners since 2024[2][3][13][20]Not stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • April 9, 2026Black Duck appointed Dom Glavach as Chief Information Security Officer to lead its global security strategy.[16]
  • February 11, 2026Black Duck signed a managed security service provider agreement with Accenture.[17]
  • December 10, 2025Black Duck launched Black Duck Signal, an agentic AI solution for detecting and remediating vulnerabilities in applications.[18]
  • December 3, 2025Black Duck appointed Roman Telerman as its new Chief Financial Officer.[19]
  • April 30, 2026StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.[12]
  • December 16, 2025StackHawk launched Business Logic Testing, automated multi-user authorization testing aimed at BOLA, BFLA and privilege escalation vulnerabilities.[14]
  • November 20, 2025StackHawk announced an integration that correlates findings from Endor Labs' SAST with StackHawk DAST findings.[13]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Black Duck sells mainly to development and DevOps teams and to security teams. Black Duck names enterprises, startups, PE firms and legal teams as users of its audits. Black Duck acts as a technical advisor to private equity firms and their portfolio companies. Black Duck says its tools work in the cloud or on premises.Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization. The industries named are financial services, health tech, insurance, media, transportation, education technology, and cloud analytics. Scans are described as fitting into any pipeline and any environment, with no vendor cloud.
Last verified
November 2, 2026November 2, 2026

Where they overlap

  • Black Duck and StackHawk are both filed under Dynamic application security testing.

Where they differ, field by field

  • Black Duck's primary category is Software composition analysis; StackHawk's is Dynamic application security testing.
  • Black Duck is also filed under Static application security testing. StackHawk is also filed under API security.
  • Black Duck lists Black Duck Polaris Platform, Coverity Static Analysis, Black Duck SCA and Defensics Fuzzing. StackHawk lists Wingman, StackHawk Scale and HawkScan.
  • Black Duck is owned by Clearlake Capital Group and Francisco Partners, since 2024.

What it sells: Black Duck

What Black Duck Polaris Platform does[6]
Black Duck describes Polaris as a platform that unifies SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business.
What Black Duck SCA does[8][9]
Black Duck SCA identifies all open source dependencies in software and generates a Software Bill of Materials. It surfaces the licenses used for each identified open source dependency.

What it sells: StackHawk

What Wingman does[15][16]
Wingman runs inside the coding agent that engineers already use. When the agent finishes a feature, Wingman tests the running app with HawkScan, hands the findings to the same agent, and rescans after the fix.
What StackHawk Scale does[15][16]
StackHawk Scale adds attack surface discovery and program reporting for security teams. StackHawk Scale is priced by team, not by usage.
What HawkScan does[3][15]
HawkScan tests the running application with real requests. StackHawk scans run as a CLI or Docker container that spins up and shuts down per scan. StackHawk scan configuration is YAML config-as-code, versioned alongside the app.

Questions about Black Duck and StackHawk

What do Black Duck and StackHawk sell?
Black Duck sells Black Duck Polaris Platform, Coverity Static Analysis, Black Duck SCA and Defensics Fuzzing. StackHawk sells Wingman, StackHawk Scale and HawkScan.
Are Black Duck and StackHawk in the same category?
They share Dynamic application security testing. Black Duck's primary category is Software composition analysis and StackHawk's is Dynamic application security testing.
Who owns Black Duck and StackHawk?
Black Duck is owned by Clearlake Capital Group and Francisco Partners, since 2024.
Who are Black Duck and StackHawk sold to?
From its own pages, Black Duck sells mainly to development and DevOps teams and to security teams. Application security and product security teams that need coverage across every app and API are named as buyers, and the Scale plan is for security teams covering every app in the organization.
What have Black Duck and StackHawk announced recently?
April 9, 2026: Black Duck appointed Dom Glavach as Chief Information Security Officer to lead its global security strategy. April 30, 2026: StackHawk connected its scan findings to Wiz, where they are synced automatically and shown as enrichment data on the Attack Surface Findings page.

About Black Duck

Black Duck sells application security testing products and services, including agentic AI AppSec, SAST, DAST, IAST and SCA. Black Duck offers True Scale Application Security, which it says empowers organizations to build trust in their software. Black Duck's solutions identify, manage and remediate security vulnerabilities, license compliance risks and code quality issues across the entire software development life cycle. Black Duck says its solutions enable teams to secure proprietary and open source components and AI-generated code. Greg Hughes is CEO of Black Duck. Black Duck says 4,000+ organizations choose its products.[1][4][5][10][12]

Black Duck Polaris Platform unifies scanning, automation and policy controls in one platform. Black Duck says teams can unify SAST, SCA, DAST, DevOps automation, policy controls and AppSec analytics in one SaaS platform. Black Duck says its application security platform has flexible pricing and plans that scale with the business. Black Duck Signal AI agents work as an extension of the customer's team, finding and fixing vulnerabilities. Coverity Static Analysis provides code scans with actionable suggestions so developers and security teams can resolve issues. Defensics Fuzzing uses black box fuzzing techniques on services and protocols to find obscure vulnerabilities before they are exploited.[1][4][5][6][7][8][11]

Black Duck SCA identifies all open source dependencies in a customer's software and generates a Software Bill of Materials. Black Duck says it monitors components against vulnerability databases, including its proprietary KnowledgeBase, and alerts teams to new threats without requiring new scans. For licensing, Black Duck SCA surfaces the exact licenses used for every open source dependency it identifies. Black Duck says the EU CRA requires comprehensive SBOMs and timely vulnerability management. Black Duck uses LLMs and curated security intelligence to generate minimal patches for vulnerable dependencies, including cases with no upstream fix. Black Duck expands exploitability and reachability analysis across source code, binaries and containers. Black Duck detects embedded open source and hybrid AI models using signature-based analysis.[1][4][5][8][9]

The Code Sight IDE plug-in integrates SAST and SCA scans into the developer IDE. Black Duck gives developers real-time analysis of security defects in their code and open source components directly within the IDE. Black Duck sources remediation guidance from the Cybersecurity Research Center (CyRC). Black Duck offers interactive application security testing that monitors application behavior in the background of preproduction runtime testing. Black Duck's security tools integrate with source code management solutions to enable scans on every pull or merge request. Black Duck's security tools integrate with build and CI tools to add security into CI/CD pipelines. Black Duck Jenkins Plugin automates building, uploading, and scanning of application code in Jenkins pipelines. Black Duck integrates with binary repositories to host approved open source packages and store build artifacts. The Black Duck plugin for JIRA creates issues based on vulnerabilities and issue policy violations detected by Black Duck. The Black Duck plugin for Slack lets teams create Slack notifications based on vulnerabilities and policy violations detected by Black Duck.[9][10][11]

Black Duck offers an open platform that can integrate with several third-party security testing tools to consolidate SAST, SCA, DAST, Infrasec, CNAPP, IaC and pen testing in one place. Black Duck says its ASPM solution can ingest vulnerability findings from Checkmarx, Snyk and Veracode into Polaris. Black Duck helps track and prioritize issues against functional safety, security and industry standards, with native reports to prove compliance.[8][10]

Open Source and Third-Party Software audits use software composition techniques, the Black Duck KnowledgeBase and open source-expert auditors. Static Application Security Testing audits combine automated scanning with expert source code review. Penetration Test audits simulate real-world attacks to evaluate security from the outside-in. Secure Design Review audits involve interviews with application engineers to assess the design of core security controls. Design Quality audits use insights from expert software architects and advanced analysis to assess modularity and hierarchy. Code Quality audits combine static analysis with manual code review. Black Duck acts as a technical advisor to private equity firms and their portfolio companies. Black Duck has advised acquirers on software due diligence in thousands of transactions.[12]

Black Duck offers penetration testing that examines an attack surface including web apps, APIs, VPNs, storage and databases, VMs, and authentication and authorization practices. Black Duck offers CNAPP and cloud workload protection program (CWPP) accelerators and cloud security experts for solution design, implementation and SecOps training. Black Duck offers technical integration and configuration support, product education tutorials and security training to fast-track AppSec projects. Black Duck offers technical help through global support, account teams and experts in its community network.[12][14][15]

Black Duck on the record

Sources

Black Duck full record

  1. [1]blackduck.comBlack Duck · blackduck.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Clearlake and francisco partners complete acquisition of black duck software formerly known as synopsys software integrity group 302264926Clearlake Capital Group via PR Newswire · prnewswire.com · published October 1, 2024 · Tier A
  3. [3]Black Duck Reviews, Ratings & Features 2026 | Gartner Peer InsightsGartner Peer Insights · undated page, accessed October 23, 2026 · Tier C
  4. [4]Application Security Testing | Software Composition Analysis & Open Source Security | SAST/DAST/SCA | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  5. [5]Black Duck Named a Leader in the Inaugural 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security - Jun 22, 2026Black Duck · published June 22, 2026 · Tier A
  6. [6]Polaris Demo | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  7. [7]Get pricing | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  8. [8]Embedded and ISV Software | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  9. [9]Open Source Security & License Compliance | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  10. [10]DevOps integrations for developers | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  11. [11]Security Solutions for development and DevOps teams | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  12. [12]Software Audit Services | Security & Due Diligence | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  13. [13]Mergers & Acquisitions | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  14. [14]Application Security Solutions for Cloud Security | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  15. [15]Black Duck Customer Success | Black DuckBlack Duck · undated page, accessed November 5, 2026 · Tier A
  16. [16]Black Duck Appoints Dom Glavach as Chief Information Security OfficerBlack Duck · published April 9, 2026 · Tier A
  17. [17]Black Duck Announces MSSP Agreement with Accenture, Combining World-Class Application Security Technology and ServicesPR Newswire · published February 11, 2026 · Tier A
  18. [18]Introducing Black Duck Signal™: Agentic AI Application Security for Modern DevelopmentBlack Duck · published December 10, 2025 · Tier A
  19. [19]Black Duck Appoints Roman Telerman as Chief Financial Officer to Drive Strategic GrowthBlack Duck · published December 3, 2025 · Tier A
  20. [20]Black Duck Polaris Platform Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed November 5, 2026 · Tier C

StackHawk full record

  1. [1]stackhawk.comStackHawk · stackhawk.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Stackhawk launches sensitive data identification to help security teams protect high risk apis 302476776StackHawk via PR Newswire · prnewswire.com · published June 12, 2025 · Tier A
  3. [3]AI Coding Agent Security Platform | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  4. [4]AI Coding Agent Security for Modern Security Teams | StackHawk, Inc.StackHawk · undated page, accessed October 28, 2026 · Tier A
  5. [5]API Security Testing Trusted by HealthTechStackHawk · undated page, accessed October 28, 2026 · Tier A
  6. [6]API Security that keeps pace with FinTech InnovationStackHawk · undated page, accessed October 28, 2026 · Tier A
  7. [7]Getting Started | Delivering Secure Applications, SimplifiedStackHawk · undated page, accessed October 28, 2026 · Tier A
  8. [8]OWASP Top 10 Solution Page with StackHawk InsightsStackHawk · undated page, accessed October 28, 2026 · Tier A
  9. [9]StackHawk: Your AppSec Intelligence PlatformStackHawk · undated page, accessed October 28, 2026 · Tier A
  10. [10]Secure Vibe Coding with StackHawkStackHawk · undated page, accessed October 28, 2026 · Tier A
  11. [11]Runtime Application Business Logic Testing for API-Driven AppsStackHawk · undated page, accessed October 28, 2026 · Tier A
  12. [12]StackHawk and Wiz: One Risk Picture Across the Application and Cloud LayerStackHawk · published April 30, 2026 · Tier A
  13. [13]StackHawk + Endor Labs: Correlating and Prioritizing SAST and DAST FindingsStackHawk · published November 20, 2025 · Tier A
  14. [14]Introducing Intelligent Business Logic Testing: Find Authorization Flaws Pre-ProductionStackHawk · published December 16, 2025 · Tier A
  15. [15]About StackHawk | Security Feedback for Coding AgentsStackHawk · undated page, accessed November 10, 2026 · Tier A
  16. [16]Pricing for StackHawk's AI Coding Agent Security PlatformStackHawk · undated page, accessed November 10, 2026 · Tier A
  17. [17]Modern DAST | StackHawk Dynamic Application Security TestingStackHawk · undated page, accessed November 10, 2026 · Tier A
  18. [18]The Developer-First Alternative to Bright SecurityStackHawk · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.