Black Duck Software Composition Analysis Alternatives

Mend provides a mature platform with extensive coverage across SCA, SAST and container security which has helped improve visibility across our software supply chain. However, customer communication and out-of-date documentation has been a challenge.

I have had a great experience using GitHub so far.It makes managing code and collabrating with team members much easier and more organized.Feature like pull requests,issue tracking,and version history are very helpful for day to day development work. Overall, GitHub has Improved the way our team works together and has madhe project management much more efficeint

It is highly valuable for consolidating development and protection into a single dashboard. By anchoring dependency risk tracking and cryptographic build validation directly into the version control interface, it allows our engineers to prevent malicious code injection and verify artifact lineage without jumping between multiple specialized security vendors.

It does what it says on the tin for supply chain security but it can be of a heavy lift to manage dat to day. Getting it integrated into Pipelines was fine, but we spend way too much time sifting through vuln reports for dev dependencies that dont actually reach production.

We use Tenable internally as our solution for vulnerability scanning and malware detection in our infrastructure. The tool has exceeded our corporate expectations, delivering granular visibility into the attack surface. It has proven to be an indispensable asset for validating and auditing the coverage of our PCI environments, providing highly relevant technical data that speeds up the targeting and handling of vulnerabilities by remediation teams.

We use many SAASes and I've personally selected and onboarded several of them. It's safe to say I'm by far and away happiest with the choice of Aikido out of all of them. The product is great and does everything we need, but the support is phenomenal, world class and makes it a joy to work with them.

An excellent and highly accurate vulnerability analysis tool for third-party software using SCA, although it should be noted that the CLI still needs improvements to allow for real-time vulnerability monitoring. Additionally, the results and reports management lacks features for efficient results handling, as it currently only allows for individual modifications per result, not global ones.

RapidFort has been very responsive to our requirements. We were starting off on migrating out product to FedRAMP SaaS, by containerizing the components and making them FIPS compliant. RapidFort truly partnered with us, being very flexible in their pricing, to provide us "everything that we need to meet the FedRAMP goals", rather than limiting us to a particular count. Plus, they got us what we needed, within short time - for example, we were using a couple of components that they did not have in their curated list, and they committed to and delivered them in 2 weeks - helping us to stay on course.