Application Security | Open Source Security | SAST/DAST/SCA Tools | Black Duck
Live Last read · last published · next check
Most AppSec friction is administrative. A vulnerability gets fixed, but the ticket stays open. A triage decision made in Jira never reaches Polaris. Code on an internal server can’t be scanned without a firewall exception. Three repositories scan against a config file nobody has updated in a year. The latest Black Duck Polaris™ Platform release […] The post Polaris release update: Two-way bug…
When Polestar announced that it would stop selling new vehicles in the United States starting with model year 2027, it wasn’t a business strategy pivot driven by demand. It was a direct consequence of a regulatory decision that every automaker importing connected vehicles into the U.S. needs to understand. The Swedish EV maker was denied […] The post Polestar’s U.S. market exit is a warning for…
AI can dramatically accelerate software delivery, but speed without security creates new forms of risk Anyone who’s watched an AI coding assistant generate a working API endpoint, scaffold a microservice, produce a comprehensive test suite, or create a user interface understands deep in their core that software engineering has fundamentally changed. The velocity of AI […] The post The AI coding…
Frontier models can detect real vulnerabilities at scale. They reason across application logic, analyze authorization flows, identify multistep vulnerabilities, and propose context-aware remediation. That capability is real. But it can lead to a risky conclusion: that frontier model scanning alone can carry the weight a layered defense was built to distribute. Detection and assurance are […] The…
You download an open source AI model with an Apache 2.0 license and figure you’re safe to use it commercially. With the license green light, you go ahead and deploy it. But here’s the thing nobody talks about: 76% of open source AI models are trained on data whose license is incompatible with or materially more […] The post The hidden liabilities in open source AI model adoption appeared first on…
With key EU Cyber Resilience Act (CRA) deadlines approaching fast, the window to prepare is narrowing. In a recent Black Duck webinar, cybersecurity experts Emmanuel Gonzalez of Black Duck and Antti Tolvanen of DNV Cyber broke down exactly what’s at stake and what organizations need to do to prepare. Below is a brief Q&A based on their […] The post Countdown to the next EU CRA milestone appeared…
We are proud to announce that Black Duck Polaris™ Platform has achieved full Texas Risk and Authorization Management Program (TX-RAMP) certification, a meaningful milestone that reflects our ongoing commitment to serving state, local, and federal government organizations with the security tools they need to protect their software supply chains. What TX-RAMP means—and why it matters TX-RAMP is the…
Every security team is dealing with the same pressures: vulnerabilities arriving faster than teams can triage them, a growing catalog of confirmed active exploits, and development pipelines that can’t afford to slow down. The latest Black Duck Polaris™ Platform release addresses these issues directly, equipping teams with the intelligence to cut through the noise, the automation to […] The post…
If you’ve ever stared down a vulnerability report and thought “there is no way all this is real,” you’re not wrong. Modern containerized environments generate a lot of noise, findings that technically exist somewhere in the file system but have zero chance of being exploited in your running app. That’s part of why security-conscious teams […] The post What your scanner can’t see: Deep visibility…
Where the audit goes that the scan can’t A high-quality open source scan gives you a reasonable view of a codebase’s security vulnerabilities and its basic licensing picture. That’s most of what you need to know—but the deal-breaking issues tend to live in the part a scan can’t reach. A real audit goes deeper and […] The post What open source scans don’t see in M&A due diligence: stories from the…
The software supply chain is the new perimeter. Every dependency you pull, every open source library your teams consume, and every AI model your developers integrate represents a potential entry point for adversaries who are growing more sophisticated by the week. The stakes have never been higher, and the industry has taken notice. Today, I’m […] The post Black Duck named a Leader in the…
Since the announcement of Claude Mythos, one question has dominated security practitioners’ discussions: If AI can analyze code with growing sophistication, why keep investing in traditional static analysis? It is an understandable question. The ability of frontier models to detect vulnerabilities in code has advanced quickly. LLMs can identify logic flaws that traditional SAST tools […] The post…
