Blackduck has been a great product overall for everything related to OSS scanning and vulnerability checks for all of our projects scanning, it provides good insights on packages and dependencies. The integration with our CI/CD has been very smooth and adds significant value to our work.

Black Duck performs very poorly outside of a very narrow set of expected use cases. When used with C++ (via Bazel or other build systems) it did not identify components correctly, missed many, and many false alarms. I no longer use the product. Also, the integration tooling is very poor and doesn't even support some of our major platforms (e.g. arm64 macOS).