- Home
- DevSecOps Platforms
- Black Duck Polaris
Black Duck Polaris
Burlington, Massachusetts, United States
What it is
Black Duck Polaris is a cloud-based application security testing platform for coordinating security work across the software development life cycle. It combines static analysis through Polaris fAST Static, software composition analysis through Polaris fAST SCA, and dynamic analysis through Polaris fAST Dynamic. The platform also analyzes infrastructure as code and detects secrets. Unified dashboards, correlated findings, contextual enrichment, portfolio analytics, and role-based views support risk prioritization. Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis. It produces compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001, and maps findings to OWASP Top 10 and CWE. Repository integrations include Azure DevOps, Bitbucket, GitHub, and GitLab. Issue tracking connects with Azure DevOps, Jira Cloud and Data Center, and ServiceNow; Jira and ServiceNow support two-way synchronization. Pricing is on request, and a free trial is available. Each application is limited to 1 million lines of code and five supporting projects.
For and against
For
- Combines SAST, SCA, DAST, IaC, and secrets analysis.
- Generates SBOMs through four analysis methods.
- Supports compliance reporting for five listed standards.
- Integrates with major repository and issue-tracking systems.
Against
- Pricing is available on request.
- Applications are capped at 1 million lines of code.
- Each application allows up to five supporting projects.
The verdict
Polaris brings multiple application security analysis methods, reporting, and workflow integrations into one cloud service. Check the application and project limits against your needs, and request pricing to assess fit.
Who it suits
Polaris suits software teams seeking security analysis and risk management across development workflows. Its repository, issue-tracking, and compliance features may also fit teams with those integration and reporting needs.
Plans and prices
Build your own (à la carte)
Flexible packaging · comprehensive application security
Read 1 Oct 2026 · blackduck.com
Standard package
Polaris fAST Static · IaC analysis · secrets detection · Polaris fAST SCA
Read 1 Oct 2026 · blackduck.com
On the record
- Additional scanning
- Polaris combines SAST, SCA, and DAST with infrastructure-as-code analysis and secrets detection.blackduck.com · read 1 Oct 2026
- Analysis engines
- The platform integrates SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic.blackduck.com · read 1 Oct 2026
- Automation API
- Polaris provides APIs for issue data, triage, test automation, service accounts, and repository integrations.polaris.blackduck.com · read 1 Oct 2026
- Compliance certifications
- Black Duck lists SOC 2 Type 2, SOC 3 Type 2, ISO 27001, ISO 27017, ISO 26262, CSA STAR self-assessment, TISAX, and TX-RAMP Level 2 covering Polaris.blackduck.com · read 1 Oct 2026
- Compliance reporting
- Polaris generates automated compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001 and maps findings to OWASP Top 10 and CWE.blackduck.com · read 1 Oct 2026
- Issue tracking
- Supported issue-tracking integrations include Azure DevOps, Jira Cloud and Data Center, and ServiceNow, with two-way synchronization available for Jira and ServiceNow.docs.blackduck.com · read 1 Oct 2026
- Product type
- Polaris is a cloud-native, software-as-a-service application security testing platform for unifying and automating application security across the software development life cycle.blackduck.com · read 1 Oct 2026
- Risk management
- Polaris provides unified dashboards, intelligent correlation, contextual enrichment, portfolio-wide analytics, and role-based views for risk prioritization.blackduck.com · read 1 Oct 2026
- SBOM
- Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis.polaris.blackduck.com · read 1 Oct 2026
- SCM integrations
- Polaris supports repository integrations with Azure DevOps, Bitbucket, GitHub, and GitLab.docs.blackduck.com · read 1 Oct 2026
- Security controls
- Black Duck states that customer data is encrypted in transit and at rest, with HTTPS/TLS 1.2 or better and AES-256 or better for persistent data.blackduck.com · read 1 Oct 2026
- Subscription limit
- The Polaris service description states that one application may not exceed 1 million lines of code and that a subscription application may have up to five supporting projects.blackduck.com · read 1 Oct 2026
- Support
- The Black Duck Developer Portal offers documentation, a community account, and a contact-support channel for Polaris users.polaris.blackduck.com · read 1 Oct 2026
