Black Duck Seeker vs Contrast Assess

Black Duck Seeker is paid, self-hosted interactive application security testing software for web runtime targets. It tests APIs and can connect security checks to CI/CD pipelines. Instrumentation uses an agent, and listed language coverage includes Java, .NET, Node.js, Go, Python, and PHP. The software is listed for Linux, macOS, web, and Windows environments, while deployment remains self-hosted. This combination supports teams assessing web applications and APIs built with the covered languages as part of automated delivery workflows. Pricing is available on request rather than published as an amount. Black Duck lists its headquarters in Burlington, Massachusetts, United States. Organizations choosing Seeker need to account for its self-hosted model, agent instrumentation, supported runtime, and language list when matching it to their applications and infrastructure.

Contrast Assess is an Interactive Application Security Testing tool that analyzes application code while the software runs. An agent instruments the application with sensors and examines libraries, frameworks, custom code, configuration, runtime control and data flow, HTTP traffic, and back-end connections. Its approach combines static, dynamic, and interactive testing. Assess can identify vulnerabilities in custom code, open-source libraries, frameworks, and application configurations, including SQL injection, cross-site scripting, and insecure configurations. It continuously monitors applications and APIs, and presents vulnerability lists with remediation guidance, application scores, route coverage, flow maps, and compliance and policy reports. It is designed for developers and AppSec teams to use in IDE, test, and QA environments. Integration with Contrast SCA can identify vulnerable third-party libraries and determine whether their vulnerable methods are called by the running application. Supported languages include Java, Kotlin, Scala, .NET Framework, .NET Core, C#, VB.NET, Node.js, Python, Go, and PHP. Contrast states that source code and binaries stay on customer servers. Assess supports API, Linux, macOS, self-hosted, web, and Windows environments; pricing is on request, and hosted and on-premises customers require application licenses.