Black Duck Polaris

APIyesOSS—FREE—DOCS4/5

BD6.9#8 of 26

outWeb—Windows—Mac—Linux—Android—iOS

Ranked in DevSecOps Platforms ·Free trial

About

Black Duck Polaris is a cloud-native application security testing service for coordinating security analysis across the software development life cycle. It combines SAST through Polaris fAST Static, SCA through Polaris fAST SCA, and DAST through Polaris fAST Dynamic, alongside infrastructure-as-code analysis and secrets detection. Unified dashboards, correlated findings, contextual enrichment, portfolio analytics, and role-based views help teams prioritize risk. Polaris can produce software bills of materials using package-manager, signature, binary, and container analysis. It generates compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001, and maps findings to OWASP Top 10 and CWE. Repository integrations include Azure DevOps, Bitbucket, GitHub, and GitLab. Issue-tracking connections include Azure DevOps, Jira Cloud and Data Center, and ServiceNow; Jira and ServiceNow support two-way synchronization. APIs cover issue data, triage, test automation, service accounts, and repository integrations. A free trial is available, while pricing is on request. The service description limits an application to 1 million lines of code and five supporting projects.

Who it is for

Polaris suits development and security teams seeking a cloud service that combines code, dependency, dynamic, infrastructure-as-code, and secrets analysis. Its repository, issue-tracking, and automation API integrations may suit teams connecting security workflows to existing tools.

What is good

Combines SAST, SCA, DAST, IaC, and secrets analysis.
Generates SBOMs from package, signature, binary, and container analysis.
Connects with Azure DevOps, Bitbucket, GitHub, and GitLab.
APIs cover issue data, triage, and test automation.
Free trial is available.

What to know first

Each application is limited to 1 million lines of code.
Each subscription application may have up to five supporting projects.
Pricing is available on request.

Verdict

Polaris combines several security analysis types with reporting, integrations, and automation APIs. Teams should check the application-size and supporting-project limits against their code base before choosing it.

Compared on DevSecOps platforms

Deployment model: cloudblackduck.com
Container scanning: Yesblackduck.com
Policy as code: Yesblackduck.com
Remediation workflows: Yesblackduck.com
SBOM management: Yesblackduck.com
Compliance reporting: Yesblackduck.com

Facts

Product type: Polaris is a cloud-native, software-as-a-service application security testing platform for unifying and automating application security across the software development life cycle.blackduck.com · 1 Oct 2026
Analysis engines: The platform integrates SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic.blackduck.com · 1 Oct 2026
Additional scanning: Polaris combines SAST, SCA, and DAST with infrastructure-as-code analysis and secrets detection.blackduck.com · 1 Oct 2026
Risk management: Polaris provides unified dashboards, intelligent correlation, contextual enrichment, portfolio-wide analytics, and role-based views for risk prioritization.blackduck.com · 1 Oct 2026
SBOM: Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis.polaris.blackduck.com · 1 Oct 2026
SCM integrations: Polaris supports repository integrations with Azure DevOps, Bitbucket, GitHub, and GitLab.docs.blackduck.com · 1 Oct 2026
Issue tracking: Supported issue-tracking integrations include Azure DevOps, Jira Cloud and Data Center, and ServiceNow, with two-way synchronization available for Jira and ServiceNow.docs.blackduck.com · 1 Oct 2026
Automation API: Polaris provides APIs for issue data, triage, test automation, service accounts, and repository integrations.polaris.blackduck.com · 1 Oct 2026
Security controls: Black Duck states that customer data is encrypted in transit and at rest, with HTTPS/TLS 1.2 or better and AES-256 or better for persistent data.blackduck.com · 1 Oct 2026
Compliance certifications: Black Duck lists SOC 2 Type 2, SOC 3 Type 2, ISO 27001, ISO 27017, ISO 26262, CSA STAR self-assessment, TISAX, and TX-RAMP Level 2 covering Polaris.blackduck.com · 1 Oct 2026
Support: The Black Duck Developer Portal offers documentation, a community account, and a contact-support channel for Polaris users.polaris.blackduck.com · 1 Oct 2026
Subscription limit: The Polaris service description states that one application may not exceed 1 million lines of code and that a subscription application may have up to five supporting projects.blackduck.com · 1 Oct 2026