Skip to content
SPECIFICTION
Get listed

Black Duck Polaris

blackduck.com

Free trial WebAPI
Visit blackduck.com
Spec score 7.9 #9 of 25 in DevSecOps Platforms

What it is

Black Duck Polaris is a cloud application-security platform that brings several types of testing into software development workflows. Its engines cover static analysis through Polaris fAST Static, software composition analysis through Polaris fAST SCA, and dynamic analysis through Polaris fAST Dynamic. It also scans infrastructure as code and detects secrets. Dashboards, correlated and enriched findings, portfolio analytics, and role-based views help teams organize risk. Polaris can produce software bills of materials using package-manager, signature, binary, and container analysis. It generates compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001, and maps findings to OWASP Top 10 and CWE. Repository integrations include Azure DevOps, Bitbucket, GitHub, and GitLab. Issue tracking connects with Azure DevOps, Jira Cloud and Data Center, and ServiceNow; Jira and ServiceNow support two-way synchronization. Pricing is on request, and a free trial is available. The service description limits an application to 1 million lines of code and five supporting projects.

Spec sheet

Support
The Black Duck Developer Portal offers documentation, a community account, and a contact-support channel for Polaris users.Read 1 Oct 2026 · polaris.blackduck.com
Headquarters
Burlington, Massachusetts, United StatesRead 28 Sep 2026 · blackduck.com
Additional scanning
Polaris combines SAST, SCA, and DAST with infrastructure-as-code analysis and secrets detection.Read 1 Oct 2026 · blackduck.com
Analysis engines
The platform integrates SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic.Read 1 Oct 2026 · blackduck.com
Automation API
Polaris provides APIs for issue data, triage, test automation, service accounts, and repository integrations.Read 1 Oct 2026 · polaris.blackduck.com
Compliance certifications
Black Duck lists SOC 2 Type 2, SOC 3 Type 2, ISO 27001, ISO 27017, ISO 26262, CSA STAR self-assessment, TISAX, and TX-RAMP Level 2 covering Polaris.Read 1 Oct 2026 · blackduck.com
Compliance reporting
Polaris generates automated compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001 and maps findings to OWASP Top 10 and CWE.Read 1 Oct 2026 · blackduck.com
Issue tracking
Supported issue-tracking integrations include Azure DevOps, Jira Cloud and Data Center, and ServiceNow, with two-way synchronization available for Jira and ServiceNow.Read 1 Oct 2026 · docs.blackduck.com
Product type
Polaris is a cloud-native, software-as-a-service application security testing platform for unifying and automating application security across the software development life cycle.Read 1 Oct 2026 · blackduck.com
Risk management
Polaris provides unified dashboards, intelligent correlation, contextual enrichment, portfolio-wide analytics, and role-based views for risk prioritization.Read 1 Oct 2026 · blackduck.com
SBOM
Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis.Read 1 Oct 2026 · polaris.blackduck.com
SCM integrations
Polaris supports repository integrations with Azure DevOps, Bitbucket, GitHub, and GitLab.Read 1 Oct 2026 · docs.blackduck.com
Security controls
Black Duck states that customer data is encrypted in transit and at rest, with HTTPS/TLS 1.2 or better and AES-256 or better for persistent data.Read 1 Oct 2026 · blackduck.com
Subscription limit
The Polaris service description states that one application may not exceed 1 million lines of code and that a subscription application may have up to five supporting projects.Read 1 Oct 2026 · blackduck.com

Plans and prices

Build your own (à la carte) Priced on request Flexible packaging · comprehensive application security Read 1 Oct 2026 · blackduck.com
Standard package Priced on request Polaris fAST Static · IaC analysis · secrets detection · Polaris fAST SCA · dependency and CodePrint scanning · Polaris fAST Dynamic · API scanning · DevOps integrations · centralized policy configuration · dashboards and reporting Read 1 Oct 2026 · blackduck.com

Every Black Duck Polaris plan and price →

Strong points and limits

Strong points

  • Combines SAST, SCA, DAST, IaC scanning, and secrets detection.
  • Generates SBOMs from four analysis methods.
  • Supports two-way synchronization with Jira and ServiceNow.
  • Free trial is available.

Limits

  • Pricing is available on request.
  • Applications are capped at 1 million lines of code.
  • Each subscription application may have up to five supporting projects.

Who it suits

Polaris suits software teams seeking combined application-security scanning, compliance reporting, and repository or issue-tracker integrations. It is relevant to teams that need centralized risk views, subject to the stated application and project limits.

Verdict

Polaris brings multiple scanning methods, reporting, and workflow integrations into a cloud service. Check the application and supporting-project limits against your portfolio before choosing it.

Where Specifiction places it

Alternatives to Black Duck PolarisAll alternatives →