Black Duck SCA vs FossID Workbench
Black Duck SCA
blackduck.com
FossID Workbench
fossid.comSide by side
| Figure | Black Duck SCA | FossID Workbench |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 1 |
| Spec score · Software Composition Analysis Software | 7.8 (#30) | 8.2 (#12) |
| Spec score · Dependency Management Software | 7.8 (#13) | 8.2 (#8) |
| Deployment | Black Duck SCA is available as hosted or on-premises software, including options for air-gapped environments. | FossID describes cloud, hybrid, and on-premises deployment options, including an offline air-gapped option. |
| Detection | It combines dependency, binary, and snippet analysis to identify components and build an SBOM. | It analyzes dependencies, scans unmanaged source code regardless of programming language, and detects open-source snippets embedded in source files. |
| Headquarters | Burlington, Massachusetts, United States | Stockholm, Sweden |
| Integrations | Black Duck lists integrations across IDEs, source control, CI/build tools, package managers, workflow tools, and production capabilities, and says it offers REST APIs. | Workbench can import code from GitHub, GitLab, and Bitbucket, and supports CI/CD workflows, a Workbench Agent, and an API for custom scans, gates, and notifications. |
| Purpose | Black Duck SCA helps teams manage security, quality, and license compliance risks in open source and third-party code. | FossID Workbench is a software composition analysis tool for identifying third-party components, licenses, and vulnerabilities in codebases. |
Plans
Black Duck SCA
- Open source detection (enterprise edition)Priced on request
- Standard EditionPriced on request
In their own words
Black Duck SCA
Black Duck SCA has no write-up on Specifiction yet; its figures are above.
FossID Workbench
FossID Workbench is a software composition analysis tool for identifying and governing third-party software in codebases. It analyzes direct and transitive dependencies, scans unmanaged source code across programming languages, and detects embedded open-source snippets, including modified code. ID Assist proposes component identifications, while License Extractor extracts file-level license text. Vulnerable Snippet Finder locates code blocks linked to CVEs, with VEX data adding exploitability context. Workbench creates, imports, consolidates, and exports software bills of materials with component, license, vulnerability, and usage information in SPDX or CycloneDX formats. Policy Management can enforce license, security, and usage rules across projects. GitHub, GitLab, and Bitbucket imports are supported, alongside CI/CD scanning, gating, pull-request notifications, and API workflows. Deployment options include cloud, hybrid, on-premises, and offline air-gapped setups. It supports many ecosystems, including JavaScript, Java/Kotlin, Python, Rust, Go, C/C++, .NET, and others. Pricing is available on request.