Compare products

Put two or three cybersecurity products side by side and see how they differ on deployment, pricing, features, integrations and compliance.

Black Duck SASTSemgrep Code2 of 3 products

Side-by-side comparison of Black Duck SAST, Semgrep Code
Product	Black Duck SAST by Black Duck View product	Semgrep Code by Semgrep View product
Overview
What it is	Black Duck SAST is a static application security testing used for code auditing. Highlights include OWASP Top 10 analysis. Compare it with other SAST tools.	What does Semgrep Code do? It covers taint analysis, PR review comments and custom rule writing. See typical use cases, cloud deployment and how it compares to rivals.
Product type	Static Application Security Testing	Static Application Security Testing (SAST) Engine
Best for	Cross-industry, Technology, FinTech, Software	Technology, Financial Services, E-commerce, Healthcare, Software Development
Pricing
Pricing model	Contact Vendor	Contact Vendor
Free trial	Free trial: yes	Free trial: yes
Deployment
Deployment options	SaaSCloudOn-Premise	SaaSCloud
Deployment details	Cloud; On-premises; Cloud SaaS; On-premises enterprise server	Cloud SaaS; CLI / Local; CI/CD Pipeline; Developer CLI; CI/CD container runner; Cloud SaaS
Data residency	Global; US; EU; APAC	Local scanning / United States (Cloud)
Key features
What it offers	Static application security testing Proprietary code scanning OWASP Top 10 analysis Deep dataflow tracing Code auditing AppSec compliance	Ultra-fast semantic pattern matching Uncompiled code analysis PR review comments OWASP Top 10 rule registry Custom rule writing Taint analysis Low false positive rate Fast SAST code reviews
Platform & access
API access	API access: yes	API access: yes
Single sign-on (SSO)	SSO: yes	SSO: yes
Role-based access (RBAC)	RBAC: yes	RBAC: yes
Multi-tenant	Multi-tenant: yes	Multi-tenant: yes
Mobile app	Mobile app: no	Mobile app: no
Supported platforms	Source Code RepositoriesCI/CD Build Systems	Source code repositoriesGit hosting platforms
Compliance	OWASP Top 10CWEPCI DSSISO 27001	SOC 2 Type IIISO 27001GDPR
Integrations & coverage
Integrations	GitHubGitLabJenkinsAzure DevOpsJiraPolaris	GitHub ActionsGitLab CIBitbucket PipelinesJenkinsJiraVS Code
Industries	Cross-industryTechnologyFinTechSoftware	TechnologyFinancial ServicesE-commerceHealthcareSoftware Development
Regions	Global	Global
Vendor
Company	Black Duck	Semgrep
Headquarters	Burlington, Massachusetts, USA	San Francisco, California, USA
Company size	1,001-5,000	201-500
Founded	2001	2017

Black Duck SAST

by Black Duck

View product

Semgrep Code

by Semgrep

View product

Overview

What it is

Black Duck SAST

Black Duck SAST is a static application security testing used for code auditing. Highlights include OWASP Top 10 analysis. Compare it with other SAST tools.

Semgrep Code

What does Semgrep Code do? It covers taint analysis, PR review comments and custom rule writing. See typical use cases, cloud deployment and how it compares to rivals.

Product type

Black Duck SAST

Static Application Security Testing

Semgrep Code

Static Application Security Testing (SAST) Engine

Best for

Black Duck SAST

Cross-industry, Technology, FinTech, Software

Semgrep Code

Technology, Financial Services, E-commerce, Healthcare, Software Development

Pricing

Pricing model

Black Duck SAST

Contact Vendor

Semgrep Code

Contact Vendor

Free trial

Black Duck SAST

Semgrep Code

Deployment

Deployment options

Black Duck SAST

SaaSCloudOn-Premise

Semgrep Code

SaaSCloud

Deployment details

Black Duck SAST

Cloud; On-premises; Cloud SaaS; On-premises enterprise server

Semgrep Code

Cloud SaaS; CLI / Local; CI/CD Pipeline; Developer CLI; CI/CD container runner; Cloud SaaS

Data residency

Black Duck SAST

Global; US; EU; APAC

Semgrep Code

Local scanning / United States (Cloud)

Key features

What it offers

Black Duck SAST

Static application security testing
Proprietary code scanning
OWASP Top 10 analysis
Deep dataflow tracing
Code auditing
AppSec compliance

Semgrep Code

Ultra-fast semantic pattern matching
Uncompiled code analysis
PR review comments
OWASP Top 10 rule registry
Custom rule writing
Taint analysis
Low false positive rate
Fast SAST code reviews

Platform & access

API access

Black Duck SAST

Semgrep Code

Single sign-on (SSO)

Black Duck SAST

Semgrep Code

Role-based access (RBAC)

Black Duck SAST

Semgrep Code

Multi-tenant

Black Duck SAST

Semgrep Code

Mobile app

Black Duck SAST

Semgrep Code

Supported platforms

Black Duck SAST

Source Code RepositoriesCI/CD Build Systems

Semgrep Code

Source code repositoriesGit hosting platforms

Compliance

Black Duck SAST

OWASP Top 10CWEPCI DSSISO 27001

Semgrep Code

SOC 2 Type IIISO 27001GDPR

Integrations & coverage

Integrations

Black Duck SAST

GitHubGitLabJenkinsAzure DevOpsJiraPolaris

Semgrep Code

GitHub ActionsGitLab CIBitbucket PipelinesJenkinsJiraVS Code

Industries

Black Duck SAST

Cross-industryTechnologyFinTechSoftware

Semgrep Code

TechnologyFinancial ServicesE-commerceHealthcareSoftware Development

Regions

Black Duck SAST

Global

Semgrep Code

Global

Vendor

Company

Black Duck SAST

Black Duck

Semgrep Code

Semgrep

Headquarters

Black Duck SAST

Burlington, Massachusetts, USA

Semgrep Code

San Francisco, California, USA

Company size

Black Duck SAST

1,001-5,000

Semgrep Code

201-500

Founded

Black Duck SAST

2001

Semgrep Code

2017