Freedom251 › DevSecOps Platforms
Black Duck Polaris
What Black Duck Polaris is
Black Duck Polaris is a cloud-based application security testing platform that brings several types of analysis into the software development life cycle. Its tools cover static analysis, software composition analysis, and dynamic testing, alongside infrastructure-as-code analysis and secrets detection. Dashboards, correlated findings, contextual enrichment, portfolio analytics, and role-based views help organize risks across applications. Polaris can generate software bills of materials through package-manager, signature, binary, and container analysis. It also creates compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001, and maps findings to OWASP Top 10 and CWE. Repository integrations include Azure DevOps, Bitbucket, GitHub, and GitLab; issue tracking connects with Azure DevOps, Jira Cloud and Data Center, and ServiceNow. Two-way synchronization is available for Jira and ServiceNow. Pricing is on request, and a free trial is available. Each application is limited to 1 million lines of code and five supporting projects.
Who it suits
Polaris suits software teams that need application security analysis, risk prioritization, and compliance reporting across development workflows. Its integrations and APIs may fit teams using the listed repositories and issue trackers.
What it does well
- Combines SAST, SCA, DAST, IaC analysis, and secrets detection.
- Generates SBOMs through four analysis methods.
- Produces reports for five listed compliance standards.
- Connects with four listed repository services.
- Free trial is available.
What to know first
- Each application is capped at 1 million lines of code.
- Each subscription application allows up to five supporting projects.
- Pricing is available on request.
Limits
A subscription application can contain no more than 1 million lines of code and up to five supporting projects. The service is paid, with pricing available on request.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| Standard package | Polaris fAST Static · IaC analysis · secrets detection · Polaris fAST SCA · dependency and CodePrint scanning · Polaris fAST Dynamic · API scanning · DevOps integrations · centralized policy configuration · dashboards and reporting | On request |
| Build your own (à la carte) | Flexible packaging · comprehensive application security | On request |
As blackduck.com lists them, read 1 Oct 2026. The maker's own page has the final word.
Getting started
- Visit Black Duck's DevSecOps page for Polaris.
- Request pricing or use the available free trial.
- Connect a repository through Azure DevOps, Bitbucket, GitHub or GitLab.
- Set up issue tracking with a supported service if needed.
- Use the dashboards and reporting to review findings and risk.
Verdict
Polaris brings multiple application security analyses, reporting, and workflow integrations together in a cloud service. Teams should consider its per-application size and project limits and request pricing before choosing it.
Questions
How is Polaris priced?
Pricing is available on request. A free trial is listed.
What analysis does Polaris provide?
It combines SAST, SCA and DAST with infrastructure-as-code analysis and secrets detection.
Which repository integrations are supported?
Azure DevOps, Bitbucket, GitHub and GitLab are supported.
Which issue trackers can it connect to?
Supported options are Azure DevOps, Jira Cloud and Data Center, and ServiceNow. Jira and ServiceNow support two-way synchronization.
What are the application limits?
One application may not exceed 1 million lines of code and may have up to five supporting projects.
What compliance reports can it generate?
Automated reports cover PCI DSS, HIPAA, GDPR, SOC 2 and ISO 27001. Polaris also maps findings to OWASP Top 10 and CWE.
Facts from Black Duck Polaris's own pages
- Additional scanning
- Polaris combines SAST, SCA, and DAST with infrastructure-as-code analysis and secrets detection. · blackduck.com, 1 Oct 2026
- Analysis engines
- The platform integrates SAST with Polaris fAST Static, SCA with Polaris fAST SCA, and DAST with Polaris fAST Dynamic. · blackduck.com, 1 Oct 2026
- Automation API
- Polaris provides APIs for issue data, triage, test automation, service accounts, and repository integrations. · polaris.blackduck.com, 1 Oct 2026
- Compliance certifications
- Black Duck lists SOC 2 Type 2, SOC 3 Type 2, ISO 27001, ISO 27017, ISO 26262, CSA STAR self-assessment, TISAX, and TX-RAMP Level 2 covering Polaris. · blackduck.com, 1 Oct 2026
- Compliance reporting
- Polaris generates automated compliance reports for PCI DSS, HIPAA, GDPR, SOC 2, and ISO 27001 and maps findings to OWASP Top 10 and CWE. · blackduck.com, 1 Oct 2026
- Headquarters
- Burlington, Massachusetts, United States · blackduck.com, 28 Sept 2026
- Issue tracking
- Supported issue-tracking integrations include Azure DevOps, Jira Cloud and Data Center, and ServiceNow, with two-way synchronization available for Jira and ServiceNow. · docs.blackduck.com, 1 Oct 2026
- Product type
- Polaris is a cloud-native, software-as-a-service application security testing platform for unifying and automating application security across the software development life cycle. · blackduck.com, 1 Oct 2026
- Risk management
- Polaris provides unified dashboards, intelligent correlation, contextual enrichment, portfolio-wide analytics, and role-based views for risk prioritization. · blackduck.com, 1 Oct 2026
- SBOM
- Polaris can generate software bills of materials using package-manager, signature, binary, and container analysis. · polaris.blackduck.com, 1 Oct 2026
- SCM integrations
- Polaris supports repository integrations with Azure DevOps, Bitbucket, GitHub, and GitLab. · docs.blackduck.com, 1 Oct 2026
- Security controls
- Black Duck states that customer data is encrypted in transit and at rest, with HTTPS/TLS 1.2 or better and AES-256 or better for persistent data. · blackduck.com, 1 Oct 2026
- Subscription limit
- The Polaris service description states that one application may not exceed 1 million lines of code and that a subscription application may have up to five supporting projects. · blackduck.com, 1 Oct 2026
- Support
- The Black Duck Developer Portal offers documentation, a community account, and a contact-support channel for Polaris users. · polaris.blackduck.com, 1 Oct 2026