Development and DevOps Integrations
Effective DevSecOps requires AppSec integration at each stage in the software development life cycle, and delivering security risk insight directly into the hands of the people who need it to fix issues, without breaking established workflows.
Black Duck solutions for application security testing and software composition analysis integrate into CI/CD pipelines and DevOps workflows to derive actionable security risk data and automate mechanisms to help you build secure, high-quality software faster.
- SCM
- IDE
- Package
manager - Build
and CI - Binary
repository - Workflow and
notifications - Security
testing - Vulnerability
management - Production
deployment
-
✕
- Black Duck
- Coverity
- Software Risk Manager
- Code Sight
- Polaris
- Seeker
Source code management (SCM) integrations
GitHub
coverity polaris black duck
Azure DevOps
polaris coverity black duck seeker
Azure Repos
coverity
Bitbucket
coverity software risk manager
GitLab
coverity polaris black duck
Integrated development environment (IDE) integrations
Android Studio
coverity
PhpStorm
code sight coverity
Visual Studio
software risk manager coverity code sight
Eclipse IDE
software risk manager coverity code sight
PyCharm
code sight coverity
Visual Studio Code
coverity code sight
IBM Engineering Workflow Management
coverity
QNX Momentics Tool Suite
coverity
WebStorm
code sight coverity
IntelliJ IDEA
software risk manager coverity code sight
RubyMine
code sight coverity
Wind River Workbench
coverity
Package manager integrations
Bazel
black duck
Composer
black duck
Go Module CLI
black duck
Maven
coverity black duck
Pip
black duck
Yarn
coverity black duck
Bower
coverity
Comprehensive Perl Archive Network (CPAN)
black duck
Go Vndr
black duck
npm
coverity black duck
Poetry
black duck
Yocto Project (YP)
black duck
Cargo
black duck
Conan
black duck
Gogradle
black duck
NuGet
black duck
Rebar3
black duck
CocoaPods
black duck
Conda
black duck
Lerna
black duck
Packrat
black duck
RubyGems
black duck
Build and CI integrations
AWS CodeBuild
black duck
CircleCI
black duck
sbt
black duck
GitHub
coverity polaris black duck
Azure DevOps
polaris coverity black duck seeker
CloudBees Software Delivery Automation
black duck
TeamCity
software risk manager black duck
GitLab
coverity polaris black duck
Azure Pipelines
tinfoil coverity black duck
CodeShip
black duck
Gradle
coverity black duck
Travis CI
black duck
Bamboo
tinfoil coverity black duck
Concourse
black duck
Jenkins
software risk manager coverity black duck seeker tinfoil
Wind River Studio
coverity
Binary repository integrations
Amazon Elastic Container Registry (ECR)
black duck
Google Container Registry
black duck
Artifactory
black duck
Nexus Repository
black duck
Azure Container Registry
black duck
Docker Registry
black duck
Workflow and notifications integrations
Azure Boards
black duck
Secure Code Warrior
software risk manager coverity seeker
Bugzilla
coverity
Slack
black duck seeker software risk manager
Jira Software
coverity black duck seeker polaris software risk manager
Software Package Data Exchange (SPDX)
black duck
Microsoft Teams
black duck software risk manager
Security testing integrations
Acunetix
software risk manager
Aqua Cloud Native Security Platform (CNAPP)
software risk manager
Checkmarx Interactive Application Security Testing (CxIAST)
software risk manager
Clang Static Analyzer
software risk manager
Contrast Assess
software risk manager
Errcheck
software risk manager
Fortify Software Security Center
software risk manager
Gendarme
software risk manager
HCL AppScan
software risk manager
JSHint
software risk manager coverity
Netsparker
software risk manager
NowSecure INTEL
software risk manager
Parasoft C/C++test
software risk manager
PHP_CodeSniffer
software risk manager
Qualys Vulnerability Management (VM)
software risk manager
Scalastyle
software risk manager
Snyk Container
software risk manager
Staticcheck
software risk manager
Trustwave App Scanner
software risk manager
Veracode Static Analysis
software risk manager
WhiteSource
software risk manager
Q-mast
software risk manager
Anchore Enterprise
software risk manager
Arachni
software risk manager
Checkmarx Software Composition Analysis (CxSCA)
software risk manager
Code Cracker
software risk manager
Cppcheck
software risk manager
Error Prone
software risk manager
Fortify Static Code Analyzer
software risk manager
Gocyclo
software risk manager
Ineffassign
software risk manager
Microsoft Threat Modeling Tool
software risk manager
Nexus Lifecycle
software risk manager
NowSecure Workstation
software risk manager
Parasoft dotTEST
software risk manager
phpcs-security-audit
software risk manager
Qualys Web Application Scanning (WAS)
software risk manager
SD Elements
software risk manager
Snyk Open Source
software risk manager
Tenable.io
software risk manager
Veracode Dynamic Analysis
software risk manager
Vet
software risk manager
CoGuard - Infrastructure Security and Automation
coverity
Android Studio Lint
software risk manager
Brakeman
software risk manager
Checkmarx Static Application Security Testing (CxSAST)
software risk manager
CodePeer
software risk manager
Dependency-Check
software risk manager
ESLint
software risk manager
Fortify WebInspect
software risk manager
Golint
software risk manager
JFrog Xray
software risk manager
Mobile Secure
software risk manager
Nmap
software risk manager
OCLint
software risk manager
Parasoft Jtest
software risk manager
Prisma Cloud
software risk manager
Retire.js
software risk manager
Security Code Scan (SCS)
software risk manager
Snyk Open Source License Compliance Management
software risk manager
Tenable.sc
software risk manager
Veracode Manual Penetration Testing (MPT)
software risk manager
Vex
software risk manager
Cycode
black duck coverity
AppSpider
software risk manager
Burp Suite
software risk manager
Checkstyle
software risk manager
CodeSonar
software risk manager
Dependency-Track
software risk manager
Find Security Bugs
software risk manager
GDS PMD Secure Coding Ruleset
software risk manager
Gosec
software risk manager
Jlint
software risk manager
Nessus
software risk manager
NowSecure Auto
software risk manager
OWASP Zed Attack Proxy (ZAP)
software risk manager
PHP Mess Detector (PHPMD)
software risk manager
Pylint
software risk manager
SafeSQL
software risk manager
SpotBugs
software risk manager coverity
sqlmap
software risk manager
ThunderScan
software risk manager
Veracode Software Composition Analysis (SCA)
software risk manager
Visual Studio Code Analysis
software risk manager coverity
IriusRisk Threat Modeling
software risk manager
Vulnerability management integrations
Deepfactor Developer Security
black duck
SonarQube
coverity software risk manager
Botprise
seeker
Production deployment integrations
Amazon Web Services (AWS)
seeker
Kubernetes (K8s)
black duck
Cloud Foundry
seeker
Microsoft Azure
black duck
Google Cloud
black duck
Red Hat OpenShift
black duck seeker
IBM Cloud Pak for Applications
black duck
VMware Tanzu
seeker
Q-mast
Security testing
Q-mast, by Quokka, is an automated mobile application security testing (MAST) solution that discovers and delivers defense-grade insights into zero-day threats and exploits. The Q-mast integration with Software Risk Manager helps unify visibility and control over Q-mast analysis and results.
Integrates with Software Risk Manager
IriusRisk Threat Modeling
Security testing
IriusRisk makes secure design a standardized, scalable practice for all digital teams using their intelligent threat modeling solution. IriusRisk data can be exported and used by Software Risk Manager for greater threat analysis within a single source of truth alongside other security products.
Integrates with Software Risk Manager
Cycode
Security testing
Cycode enables organizations to develop secure applications faster, to amplify visibility, and to ensure end-to-end coverage. Cycode's connector with Black Duck SCA enables you to pull vulnerabilities from Black Duck and to correlate them with other AppSec tooling within Cycode. Cycode's connector with Coverity enables you to pull vulnerabilities from Coverity and to correlate them into Cycode's platform. with Coverity data that is searchable via Cycode’s Risk Intelligence Graph (RIG).
Integrates with Black Duck, and Coverity
CoGuard - Infrastructure Security and Automation
Security testing
CoGuard extends static analysis coverage to software, container, IaC, and cloud configurations and their dependencies. Organizations can apply the same robust static analysis processes, commonly applied to code, to infrastructure.
Integrates with Coverity
Botprise
Vulnerability management
Botprise is a Gen-AI, no-code automation and remediation platform. Botprise focuses on automation and remediation for SecOps, ITOps, and CloudOps.
Integrates with Seeker
AccuRev
Source code management (SCM)
Micro Focus AccuRev is a software configuration management tool that addresses complex parallel and distributed development environments with a stream-based architecture to accelerate development and improve asset reuse.
Integrates with Coverity
GitHub
Source code management (SCM)
Using the Black Duck GitHub Action, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Upload issues to GitHub Advanced Security, - Create projects and branches on the fly, - Break the build based on policies, - Export SARIF files
For more information and product-specific capabilities, please check out our documentation.,
Integrates with Black Duck, Polaris, and Coverity
GitHub
Build and CI
Using the Black Duck GitHub Action, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Upload issues to GitHub Advanced Security, - Create projects and branches on the fly, - Break the build based on policies, - Export SARIF files
For more information and product-specific capabilities, please check out our documentation.,
Integrates with Black Duck, Polaris, and Coverity
Subversion
Source code management (SCM)
Azure Repos
Source code management (SCM)
Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Coverity
GitLab
Source code management (SCM)
Using the Black Duck GitLab Template, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Create projects on the fly, - Break the build based on policies, - Create SARIF reports for non-MR/PR scans
For more information and product-specific capabilities, please check out our documentation.
Integrates with Polaris, Black Duck, and Coverity
GitLab
Build and CI
Using the Black Duck GitLab Template, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Create projects on the fly, - Break the build based on policies, - Create SARIF reports for non-MR/PR scans
For more information and product-specific capabilities, please check out our documentation.
Integrates with Polaris, Black Duck, and Coverity,
Bitbucket
Source code management (SCM)
Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Software Risk Manager, and Coverity
Helix Core
Source code management (SCM)
Helix Core version control by Perforce is enterprise-class version control software that tracks and manages changes to all your digital assets.
Integrates with Coverity
Concurrent Versions System (CVS)
Source code management (SCM)
Concurrent Versions System (CVS) is a free, client-server-based version control system that records the history of sources files and documents.
Integrates with Coverity
Mercurial
Source code management (SCM)
Android Studio
Integrated development environment (IDE)
Android Studio by Google provides tools for building apps on every type of Android device.
Integrates with Coverity
PhpStorm
Integrated development environment (IDE)
PhpStorm by JetBrains is a PHP IDE that provides built-in tools for debugging, testing, and profiling PHP applications.
Integrates with Code Sight, and Coverity
Visual Studio
Integrated development environment (IDE)
Microsoft Visual Studio enables you to build web, mobile, and native applications for multiple operating systems and devices with C#, C++, Node.js, F#, Python, or Visual Basic.
Integrates with Software Risk Manager, Code Sight, and Coverity
Eclipse IDE
Integrated development environment (IDE)
The Eclipse IDE is known as a Java IDE, but also includes variants for C/C++, JavaScript/TypeScript, PHP, and more.
Integrates with Software Risk Manager, Code Sight, and Coverity
PyCharm
Integrated development environment (IDE)
PyCharm by JetBrains is a Python IDE that brings all Python tools together in one place.
Integrates with Code Sight, and Coverity
Visual Studio Code
Integrated development environment (IDE)
Microsoft Visual Studio Code is a streamlined open source code editor with support for development operations like debugging, task running, and version control.
Integrates with Code Sight, and Coverity
IBM Engineering Workflow Management
Integrated development environment (IDE)
IBM Engineering Workflow Management (formerly Rational Team Concert) is a collaborative software development tool that teams use to manage all aspects of their work.
Integrates with Coverity
QNX Momentics Tool Suite
Integrated development environment (IDE)
The QNX Momentics Tool Suite by Blackberry offers an Eclipse-based IDE and command-line tools that will be familiar to anyone who’s worked with Linux.
Integrates with Coverity
WebStorm
Integrated development environment (IDE)
WebStorm by JetBrains is a JavaScript IDE for intelligent code completion, on-the-fly error detection, powerful navigation, and refactoring for JavaScript, TypeScript, stylesheet languages, and other popular frameworks.
Integrates with Code Sight, and Coverity
IntelliJ IDEA
Integrated development environment (IDE)
IntelliJ IDEA by JetBrains is an IDE for JVM that helps maximize developer productivity with intelligent coding assistance and ergonomic design.
Integrates with Software Risk Manager, Code Sight, and Coverity
RubyMine
Integrated development environment (IDE)
RubyMine by JetBrains is an IDE that helps Ruby on Rails developers be more productive in every aspect of Ruby/Rails project development.
Integrates with Code Sight, and Coverity
Wind River Workbench
Integrated development environment (IDE)
Wind River Workbench is a complete suite of developer tools for software running on Wind River Systems platforms.
Integrates with Coverity
Bazel
Package manager
The Bazel build system by Google helps developers build and test software of any size.
Integrates with Black Duck
Composer
Package manager
Go Module CLI
Package manager
Maven
Package manager
Apache Maven is an open source software project management and comprehension tool that can manage a project's build, reporting, and documentation from a central piece of information.
Integrates with Black Duck, and Coverity
Pip
Package manager
Pip by the Python Packaging Authority (PyPA) is the open source package installer for Python that installs packages from the Python Package Index and other indexes.
Integrates with Black Duck
Yarn
Package manager
Yarn is an open source package manager that also functions as a project manager.
Integrates with Black Duck, and Coverity
Bower
Package manager
Bower manages web site components including frameworks, libraries, assets, and utilities.
Integrates with Coverity
Comprehensive Perl Archive Network (CPAN)
Package manager
Comprehensive Perl Archive Network (CPAN) is a large collection of Perl software and documentation.
Integrates with Black Duck
Go Vndr
Package manager
npm
Package manager
The open source npm registry is the center of JavaScript code-sharing and the largest software registry in the world.
Integrates with Black Duck, and Coverity
Poetry
Package manager
Yocto Project (YP)
Package manager
The Yocto Project (YP) is a Linux Foundation collaborative open source project that creates custom Linux distributions.
Integrates with Black Duck
Cargo
Package manager
Conan
Package manager
Conan by JFrog is an open source, decentralized, and multiplatform package manager used to create and share native binaries.
Integrates with Black Duck
Gogradle
Package manager
Gogradle is an open source Gradle plugin that provides modern build support for Golang.
Integrates with Black Duck
NuGet
Package manager
Rebar3
Package manager
Rebar3 is an Erlang tool that makes it easy to create, develop, and release Erlang libraries, applications, and systems in a repeatable manner.
Integrates with Black Duck
CocoaPods
Package manager
CocoaPods is an open source dependency manager for Swift and Objective-C Cocoa projects.
Integrates with Black Duck
Conda
Package manager
Conda is an open source package management system and environment management system that runs on Windows, macOS, and Linux.
Integrates with Black Duck
Lerna
Package manager
Lerna is an open source tool for managing JavaScript projects with multiple packages.
Integrates with Black Duck
Packrat
Package manager
Packrat by Rstudio is an open source dependency management system for the R programming language.
Integrates with Black Duck
RubyGems
Package manager
AWS CodeBuild
Build and CI
Amazon Web Services (AWS) CodeBuild is a fully managed, continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy.
Integrates with Black Duck
CircleCI
Build and CI
CircleCI by Circle Internet Services automates your development process with continuous integration in its cloud or on your own infrastructure.
Integrates with Black Duck
GitHub Actions
Build and CI
Trigger security scans based on code changes, provide actionable developer feedback through GitHub code scanning or annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Black Duck, and Coverity
sbt
Build and CI
sbt is an open source software build tool for building, testing, and deploying Scala and Java projects.
Integrates with Black Duck
Azure DevOps Server
Build and CI
Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Black Duck, Coverity, and Seeker
Azure DevOps
Source code management (SCM)
Using the Black Duck Security Scan Extension for Azure DevOps, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Create projects and project versions on the fly, - Break the build based on policies, - Configure sensitive data, - Create SARIF reports for non-MR/PR scans
For more information and product-specific capabilities, please check out our documentation.
Integrates with Polaris, Black Duck, Coverity, and Seeker
Azure DevOps
Build and CI
Using the Black Duck Security Scan Extension for Azure DevOps, users can automate application security tasks in the CI pipeline. This is facilitated by the Black Duck Bridge CLI and simplified, standardized product functions like:
- Perform scans on push and/or pull events, - Add security-related pull request comments, - Create projects and project versions on the fly, - Break the build based on policies, - Configure sensitive data, - Create SARIF reports for non-MR/PR scans
For more information and product-specific capabilities, please check out our documentation.
Integrates with Polaris, Black Duck, Coverity, and Seeker
CloudBees Software Delivery Automation
Build and CI
CloudBees Software Delivery Automation is a centralized solution that manages Jenkins Controllers, providing scalable security, compliance, and efficiency of Jenkins in enterprises.
Integrates with Black Duck
GitLab CI
Build and CI
Trigger security scans based on code changes, provide actionable developer feedback in the GitLab security center or annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Black Duck
TeamCity
Build and CI
TeamCity by JetBrains is a general-purpose CI/CD solution that allows flexibility for many types of workflows and development practices.
Integrates with Black Duck, and Software Risk Manager
Azure Pipelines
Build and CI
Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.
Integrates with Black Duck, and Software Risk Manager
CodeShip
Build and CI
CodeShip by CloudBees is a software-as-a-service (SaaS) solution that empowers engineering teams to implement and optimize CI and CD in the cloud.
Integrates with Black Duck
Gradle
Build and CI
Gradle is a build automation tool that helps teams build, automate, and deliver better software faster.
Integrates with Black Duck, and Coverity
Travis CI
Build and CI
Travis CI is a continuous integration platform that enables teams to test and ship applications with confidence.
Integrates with Black Duck
Bamboo
Build and CI
Bamboo by Atlassian for continuous integration, deployment, and delivery ties automated builds, tests, and releases together in a single workflow.
Integrates with Black Duck, and Software Risk Manager
Concourse
Build and CI
Concourse by VMware is an open source CI/CD platform that is flexible and can be used for many kinds of automation.
Integrates with Black Duck
Jenkins
Build and CI
Run security scan as part of your CI/CD pipeline and prevent security issues from escaping to production.
Integrates with Black Duck, Software Risk Manager, Coverity, and Seeker
Wind River Studio
Build and CI
Wind River Studio is a cloud-native platform for the development, deployment, operations, and servicing of mission-critical intelligent edge systems that require security, safety, and reliability.
Integrates with Coverity
Amazon Elastic Container Registry (ECR)
Binary repository
Amazon Elastic Container Registry (ECR) is a fully managed container registry that stores, manages, shares, and deploys your container images and artifacts anywhere.
Integrates with Black Duck
Google Container Registry
Binary repository
The Google Container Registry is a single place to manage Docker images, perform vulnerability analysis, and decide who can access what with fine-grained access control.
Integrates with Black Duck
Artifactory
Binary repository
Artifactory by JFrog is a repository manager that fully supports packages, container images, and Helm charts as they move across the entire DevOps pipeline.
Integrates with Black Duck
Nexus Repository
Binary repository
The Nexus Repository by Sonatype enables you to manage binaries and build artifacts across your software supply chain.
Integrates with Black Duck
Azure Container Registry
Binary repository
The Azure Container Registry by Microsoft enables you to build, store, secure, scan, replicate, and manage container images and artifacts with a fully managed, geo-replicated instance of OCI distribution.
Integrates with Black Duck
Docker Registry
Binary repository
The Docker Registry is a stateless, highly scalable, server-side application that stores and lets you distribute Docker images.
Integrates with Black Duck
Azure Boards
Workflow and notifications
Manage Black Duck security findings from within Azure Boards, and provide developers with actionable remediation giudance.
Integrates with Black Duck
Secure Code Warrior
Workflow and notifications
Secure Code Warrior® is an integrated platform that provides secure coding training and tools that helps shift developer focus from vulnerability reaction to prevention.
Integrates with Software Risk Manager, Coverity, and Seeker
Slack
Workflow and notifications
Slack is a channel-based messaging platform that enables teams to work together more effectively while connecting all their software tools and services.
Integrates with Software Risk Manager, Seeker, and Black Duck
Bugzilla
Workflow and notifications
Bugzilla is server software designed to help you manage software development.
Integrates with Coverity
Software Package Data Exchange (SPDX)
Workflow and notifications
Software Package Data Exchange (SPDX) by the Linux Foundation reduces redundant work by providing a common format for companies and communities to share important data, streamlining and improving compliance.
Integrates with Black Duck
Jira Software
Workflow and notifications
Manage Black Duck security findings from within Jira, and provide developers with actionable remediation guidance.
Integrates with Software Risk Manager, Black Duck, Coverity, and Seeker
Microsoft Teams
Workflow and notifications
Microsoft Teams enables you to meet, chat, call, and collaborate in one place.
Integrates with Software Risk Manager, and Black Duck
Acunetix
Security testing
Acunetix by Invicti Security is an automated web application security testing tool that audits web applications by checking for exploitable vulnerabilities.
Integrates with Software Risk Manager,
Aqua Cloud Native Security Platform (CNAPP)
Security testing
The Aqua Cloud Native Security Platform (CNAPP) protects your entire stack, on any cloud, across virtual machines (VMs), containers, and serverless.
Integrates with Software Risk Manager
Checkmarx Interactive Application Security Testing (CxIAST)
Security testing
Checkmarx Interactive Application Security Testing (CxIAST) automates the detection of runtime vulnerabilities during functional testing.
Integrates with Software Risk Manager
Clang Static Analyzer
Security testing
The Clang Static Analyzer is a source code analysis tool that finds bugs in C, C++, and Objective-C programs.
Integrates with Software Risk Manager
Contrast Assess
Security testing
Contrast Assess is an interactive application security testing solution that infuses software with vulnerability assessment capabilities so that security flaws are automatically identified.
Integrates with Software Risk Manager
Errcheck
Security testing
Errcheck is an open source program that searches for unchecked errors in Go programs.
Integrates with Software Risk Manager
Fortify Software Security Center
Security testing
Fortify Software Security Center by CyberRes, a Micro Focus line of business, is a suite of tightly integrated solutions that fix and prevent security vulnerabilities in applications.
Integrates with Software Risk Manager
Gendarme
Security testing
Gendarme by Mono (sponsored by Microsoft) is an open source, extensible, rule-based tool that finds problems in .NET applications and libraries.
Integrates with Software Risk Manager
HCL AppScan
Security testing
HCL AppScan delivers scalable application security testing and risk management capabilities to help enterprises manage risk and compliance.
Integrates with Software Risk Manager
JSHint
Security testing
JSHint is an open source static analysis tool that detects errors and potential problems in JavaScript code.
Integrates with Software Risk Manager, and Coverity
Netsparker
Security testing
Netsparker by Invicti is an automated, fully configurable web application security scanner that enables you to scan websites, web applications, and web services for security flaws.
Integrates with Software Risk Manager
NowSecure INTEL
Security testing
NowSecure INTEL provides third-party mobile app vetting to assess the security of any app on the Apple App Store or Google Play Store, to help you determine whether to allow the app within your environment.
Integrates with Software Risk Manager
Parasoft C/C++test
Security testing
Parasoft C/C++test is a unified, fully integrated testing solution for C/C++ software development.
Integrates with Software Risk Manager
PHP_CodeSniffer
Security testing
PHP_CodeSniffer is an open source tool for finding violations of PHP coding standards.
Integrates with Software Risk Manager
Qualys Vulnerability Management (VM)
Security testing
Qualys Vulnerability Management (VM) provides global visibility into where IT assets are vulnerable and how to protect them.
Integrates with Software Risk Manager
Scalastyle
Security testing
Scalastyle is an open source Scala-style checker that examines Scala code and indicates potential problems with it.
Integrates with Software Risk Manager
Snyk Container
Security testing
Snyk Container is a vulnerability management tool for container and Kubernetes security to help developers find and fix vulnerabilities in cloud-native applications.
Integrates with Software Risk Manager
sqlmap
Security testing
sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.
Integrates with Software Risk Manager
ThunderScan
Security testing
DefenseCode ThunderScan is a static application security testing (SAST) solution that performs deep and extensive security analysis of application source code.
Integrates with Software Risk Manager
Veracode Software Composition Analysis (SCA)
Security testing
Veracode Software Composition Analysis (SCA) detects open source vulnerabilities to manage open source risk.
Integrates with Software Risk Manager
Visual Studio Code Analysis
Security testing
Visual Studio Code Analysis is the Microsoft Visual Studio built-in static source code analyzer for .NET and C++.
Integrates with Software Risk Manager, and Coverity
Anchore Enterprise
Security testing
Anchore Enterprise is a complete container security workflow solution.
Integrates with Software Risk Manager
Arachni
Security testing
Arachni is an open source web application security scanner framework that creates automated security reports for your website as it evolves.
Integrates with Software Risk Manager
Checkmarx Software Composition Analysis (CxSCA)
Security testing
Checkmarx Software Composition Analysis (CxSCA) provides accurate, relevant, and actionable open source risk insight.
Integrates with Software Risk Manager
Code Cracker
Security testing
Code Cracker is an open source analyzer library for C# and Visual Basic that uses Roslyn to produce refactorings, code analysis, and more.
Integrates with Software Risk Manager
Cppcheck
Security testing
Cppcheck is an open source static analysis tool for the C and C++ programming languages.
Integrates with Software Risk Manager
Error Prone
Security testing
Error Prone is an open source static analysis tool for Java that can help find potential issues within the Android codebase.
Integrates with Software Risk Manager
Fortify Static Code Analyzer
Security testing
Fortify Static Code Analyzer by CyberRes, a Micro Focus line of business, is a static application security testing tool that enables developers to find and fix security defects in real time during the coding process.
Integrates with Software Risk Manager
Gocyclo
Security testing
Gocyclo calculates cyclomatic complexities of functions in Go source code.
Integrates with Software Risk Manager
Ineffassign
Security testing
Microsoft Threat Modeling Tool
Security testing
The Microsoft Threat Modeling Tool makes threat modeling easier for all developers through a standard notation for visualizing system components, data flows, and security boundaries.
Integrates with Software Risk Manager
Nexus Lifecycle
Security testing
Nexus Lifecycle by Sonatype is a software composition analysis tool that continuously monitors and identifies potential issues and uses your policies to automatically fix them for you.
Integrates with Software Risk Manager
NowSecure Workstation
Security testing
NowSecure Workstation is a preconfigured hardware and software kit that compresses mobile app vulnerability assessment down to hours and enables repeatable, standards-based testing with pre-formatted reporting.
Integrates with Software Risk Manager
Parasoft dotTEST
Security testing
Parasoft dotTEST is a C# and .NET static analysis tool that verifies C# and VB.NET code quality and checks compliance with industry and security standards.
Integrates with Software Risk Manager
phpcs-security-audit
Security testing
The phpcs-security-audit analyzer is a set of PHP_CodeSniffer rules for finding security vulnerabilities and weaknesses in PHP code.
Integrates with Software Risk Manager
Qualys Web Application Scanning (WAS)
Security testing
Qualys Web Application Scanning (WAS) is a robust cloud solution for continuous web app discovery and detection of vulnerabilities and misconfigurations.
Integrates with Software Risk Manager
SD Elements
Security testing
SD Elements by Security Compass provides tailored security requirements, design advice, secure coding standards, and step-by-step testing instructions on how to build secure applications from the ground up.
Integrates with Software Risk Manager
Snyk Open Source
Security testing
Snyk Open Source automatically detects vulnerabilities and accelerates fixing them throughout your development process.
Integrates with Software Risk Manager
Staticcheck
Security testing
Staticcheck is an open source linter for the Go programming language that uses static analysis to finds bugs and performance issues, offers simplifications, and enforces style rules.
Integrates with Software Risk Manager
Trustwave App Scanner
Security testing
Trustwave App Scanner automates the process of finding security vulnerabilities in web applications and services.
Integrates with Software Risk Manager
Veracode Static Analysis
Security testing
Veracode Static Analysis provides fast, automated feedback to developers in the IDE and CI/CD pipeline, conducts a full policy scan before deployment, and gives clear guidance on how to find, prioritize, and fix issues fast.
Integrates with Software Risk Manager
WhiteSource
Security testing
WhiteSource software composition analysis (SCA) for security and license automates open source management workflows.
Integrates with Software Risk Manager
Android Studio Lint
Security testing
The Android Studio Lint tool by Google scans Android project sources for potential bugs.
Integrates with Software Risk Manager
Brakeman
Security testing
Brakeman is an open source vulnerability scanner specifically designed for Ruby on Rails applications that statically analyzes Rails application code to find security issues at any stage of development.
Integrates with Software Risk Manager
Checkmarx Static Application Security Testing (CxSAST)
Security testing
Checkmarx Static Application Security Testing (CxSAST) is a static analysis solution that identifies security vulnerabilities in custom code.
Integrates with Software Risk Manager
CodePeer
Security testing
CodePeer by AdaCore is an Ada source code analyzer that detects runtime and logic errors and assesses potential bugs before program execution.
Integrates with Software Risk Manager
Deepfactor Developer Security
Vulnerability management
Deepfactor enables engineering teams to quickly discover and resolve security vulnerabilities, software supply chain risks, and compliance violations early in development and testing.
Integrates with Black Duck
Dependency-Check
Security testing
OWASP Dependency-Check is an open source software composition analysis (SCA) tool that detects publicly disclosed vulnerabilities within a project's dependencies.
Integrates with Software Risk Manager
ESLint
Security testing
ESLint is an open source static analysis tool that identifies problematic patterns in JavaScript code.
Integrates with Software Risk Manager
Fortify WebInspect
Security testing
Fortify WebInspect is an automated and configurable web application security testing tool that mimics real-world hacking techniques and attacks.
Integrates with Software Risk Manager
Golint
Security testing
JFrog Xray
Security testing
JFrog Xray is a universal impact analysis product that enhances artifact security, container security, and open source software license compliance across your DevSecOps pipeline.
Integrates with Software Risk Manager
Mobile Secure
Security testing
Mobile Secure by Data Theorem is a continuous automated security service that finds vulnerabilities and data privacy issues within mobile (iOS and Android) applications.
Integrates with Software Risk Manager
Nmap
Security testing
Nmap (Network Mapper) is a free and open source license security scanner utility for network discovery and security auditing.
Integrates with Software Risk Manager
OCLint
Security testing
OCLint is an open source static analysis tool for improving quality and reducing defects by inspecting C, C++, and Objective-C code for potential problems.
Integrates with Software Risk Manager
Parasoft Jtest
Security testing
Parasoft Jtest is an integrated Java testing tool for application software development.
Integrates with Software Risk Manager
Prisma Cloud
Security testing
Prisma Cloud by Palo Alto Networks is a cloud-native security platform that secures infrastructure, applications, data, and entitlements across hybrid and multicloud environments.
Integrates with Software Risk Manager
Retire.js
Security testing
Retire.js helps you detect the use of JavaScript library versions with known vulnerabilities.
Integrates with Software Risk Manager
Security Code Scan (SCS)
Security testing
Security Code Scan (SCS) is an open source static code analyzer for .NET.
Integrates with Software Risk Manager
Snyk Open Source License Compliance Management
Security testing
Snyk Open Source License Compliance Management helps you maintain a rapid development pace while remaining compliant with the open source software licenses in your projects.
Integrates with Software Risk Manager
Tenable.io
Security testing
Tenable.io container security provides visibility into the security of container images, identifying vulnerabilities, malware, and policy violations through integration with the build process.
Integrates with Software Risk Manager
Veracode Dynamic Analysis
Security testing
Veracode Dynamic Analysis scans web applications, finds exploitable vulnerabilities, and addresses issues immediately.
Integrates with Software Risk Manager
Vet
Security testing
Vet examines Go source code and reports suspicious constructs.
Integrates with Software Risk Manager
AppSpider
Security testing
AppSpider by Rapid7 is a dynamic application security testing solution that enables you to scan web and mobile applications for vulnerabilities.
Integrates with Software Risk Manager
Burp Suite
Security testing
Burp Suite by PortSwigger is a set of tools used to penetration test web applications.
Integrates with Software Risk Manager
Checkstyle
Security testing
Checkstyle is an open source static analysis tool that checks if Java source code is compliant with specified coding rules.
Integrates with Software Risk Manager
CodeSonar
Security testing
CodeSonar by GrammaTech is a static analysis tool used to find and fix bugs and security vulnerabilities in source and binary code.
Integrates with Software Risk Manager
Dependency-Track
Security testing
OWASP Dependency-Track is an intelligent component analysis platform that enables you to identify and reduce risk in the software supply chain.
Integrates with Software Risk Manager
Find Security Bugs
Security testing
OWASP Find Security Bugs is a SpotBugs plugin for security audits of Java web and Android applications.
Integrates with Software Risk Manager
GDS PMD Secure Coding Ruleset
Security testing
GDS PMD Secure Coding Ruleset is a set of custom rules for the PMD static analyzer that finds security weaknesses.
Integrates with Software Risk Manager
Gosec
Security testing
Gosec is a Golang security checker static analysis tool that inspects source code for security problems by scanning the Go AST.
Integrates with Software Risk Manager
Jlint
Security testing
Jlint checks Java code for bugs, inconsistencies, and synchronization problems by performing data flow analysis and building the lock graph.
Integrates with Software Risk Manager
Nessus
Security testing
Nessus is a vulnerability assessment solution that scans network computers for vulnerabilities.
Integrates with Software Risk Manager
NowSecure Auto
Security testing
NowSecure Auto makes it easy to integrate security testing into your mobile software development life cycle by automating the static, dynamic, and interactive analysis of your Android and iOS apps.
Integrates with Software Risk Manager
OWASP Zed Attack Proxy (ZAP)
Security testing
OWASP Zed Attack Proxy (ZAP) is an open source web application security scanner.
Integrates with Software Risk Manager
PHP Mess Detector (PHPMD)
Security testing
PHP Mess Detector (PHPMD) looks for potential quality problems within a given PHP source codebase.
Integrates with Software Risk Manager
Pylint
Security testing
Pylint is a source code, bug, and quality checker for the Python programming language.
Integrates with Software Risk Manager
SafeSQL
Security testing
SafeSQL is an open source static analysis tool for Go that protects against SQL injections.
Integrates with Software Risk Manager
Sentinel
Security testing
Sentinel by NTT Security AppSec Solutions (formerly WhiteHat Security) is a software-as-a-service platform that enables businesses to deploy a scalable application security program across the entire software development life cycle.
Integrates with Software Risk Manager
SpotBugs
Security testing
SpotBugs is an open source program that uses static analysis to look for bugs in Java code.
Integrates with Software Risk Manager, and Coverity
Tenable.sc
Security testing
Tenable.sc consolidates and evaluates vulnerability data across the enterprise, prioritizing security risks and providing a clear view of your security posture.
Integrates with Software Risk Manager
Veracode Manual Penetration Testing (MPT)
Security testing
Veracode Manual Penetration Testing (MPT) combines the skills of penetration testers with automated security testing scan results to reduce application risk, meet compliance requirements, and help teams understand and report on security posture.
Integrates with Software Risk Manager
Vex
Security testing
Vex vulnerability explorer is a web application security scanner.
Integrates with Software Risk Manager
Brinqa
Vulnerability management
Brinqa is a unified risk management tool that enables stakeholders, governance organizations, and infrastructure and security teams to manage technology risk effectively.
Integrates with Black Duck, and Coverity
ZeroNorth
Vulnerability management
ZeroNorth brings security, DevOps, and business teams together to improve application security performance and reduce organizational risk.
Integrates with Black Duck, and Coverity
Kenna Security
Vulnerability management
Kenna Security, part of Cisco, is modern, risk-based vulnerability management software.
Integrates with Black Duck, and Coverity
SonarQube
Vulnerability management
SonarQube by SonarSource is a vulnerability management tool for code quality and security.
Integrates with Software Risk Manager, and Coverity
ThreadFix
Vulnerability management
ThreadFix by the Denim Group provides a comprehensive risk view from applications and their supporting infrastructure.
Integrates with Black Duck, and Coverity
Amazon Web Services (AWS)
Production deployment
The Amazon Web Services (AWS) cloud computing platform provides the flexibility to launch applications regardless of use case or industry.
Integrates with Seeker
Kubernetes (K8s)
Production deployment
Kubernetes (K8s) open source container-orchestration system that provides automated container deployment, scaling, and management.
Integrates with Black Duck
Cloud Foundry
Production deployment
Cloud Foundry by the Cloud Native Computing Foundation (CNCF) provides a model for cloud-native application delivery on top of Kubernetes.
Integrates with Seeker
Microsoft Azure
Production deployment
Microsoft Azure is a cloud platform that helps you build, run, and manage applications across multiple clouds, on premises, hybrid, or at the edge, with the tools and frameworks of your choice.
Integrates with Black Duck
Google Cloud
Production deployment
Google Cloud is a suite of cloud computing services, including data management, hybrid and multicloud, and AI and ML, that consist of physical assets and virtual resources contained in Google data centers.
Integrates with Black Duck
Red Hat OpenShift
Production deployment
Red Hat OpenShift is a hybrid cloud platform that works anywhere, so you can build anything.
Integrates with Black Duck, and Seeker
IBM Cloud Pak for Applications
Production deployment
IBM Cloud Pak for Applications is an enterprise-ready, containerized software solution for modernizing existing applications and developing new cloud-native apps that run on Red Hat OpenShift.
Integrates with Black Duck
VMware Tanzu
Production deployment
VMware Tanzu is a suite of products and solutions that enables you to build, run, and manage Kubernetes-controlled, container-based applications.
Integrates with Seeker