Black Duck Polaris AppSec Platform

What it does

The platform is a cloud-native application security testing service that combines Static Application Security Testing (SAST), Software Composition Analysis (SCA), and Dynamic Application Security Testing (DAST) engines with infrastructure-as-code analysis and secrets detection in a single SaaS offering. Its distinctive mechanism is the fAST engine family (Polaris fAST Static, fAST SCA, and fAST Dynamic), which runs rapid scans on pull requests and full scans on merges so security testing keeps pace with development instead of gating releases at the end.

How it works

Polaris watches source code managers such as GitHub, GitLab, Bitbucket, and Azure DevOps, discovers new projects and repositories automatically, and triggers scans on SCM events: rapid scans on pull requests and full scans on merges. Results post as pull request comments, surface in IDEs, and push to issue trackers, while centrally managed policy-driven gates block builds that violate security thresholds. The fAST SCA engine maps entire dependency trees, draws component intelligence from the Black Duck KnowledgeBase covering 8.7 million-plus open source components, monitors dependencies for vulnerabilities and malware, and generates software bills of materials (SBOMs) in SPDX and CycloneDX formats.

Credentials and traction

Black Duck holds SOC 2 Type II, ISO 27001, and ISO 27017 certifications, and Polaris carries TX-RAMP Level 2 certification for Texas state agencies. The vendor was named a Leader in the inaugural 2026 Gartner Magic Quadrant for Software Supply Chain Security and, for the eighth consecutive time, a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing, placing highest for Ability to Execute. Over 4,000 organizations worldwide use Black Duck.