Comparison

SecPortal vs Black Duck
enterprise SCA console vs security testing workspace

Black Duck (acquired by Synopsys in 2017 and spun back out as Black Duck Software in 2024) is one of the dominant enterprise open-source software composition analysis platforms. The product covers SCA through the Black Duck KnowledgeBase with license-risk classification and policy-driven build gating, SAST through Coverity, DAST through WhiteHat Dynamic, container and image scanning through Black Duck Binary Analysis, and audit-ready open-source attribution reporting through Black Duck Audit Services on the Polaris Software Integrity Platform. SecPortal is a different shape: scoped engagements, manual finding entry, AI report generation, branded client portal, native external and authenticated web scanning, and SAST plus dependency analysis on connected repositories all live inside one workspace. This page is the side-by-side for buyers comparing a portfolio-wide enterprise SCA console to a security testing workspace that scans, records, reports, and delivers findings on its own.

Get Started Free

No credit card required. Free plan available forever.

Feature	SecPortal	Black Duck
Primary use case	Security testing and remediation workspace with scanning, findings, AI reports, and branded portal on one tenant	Enterprise open-source SCA console with KnowledgeBase, license-risk classification, policy-driven build gating, Coverity SAST, WhiteHat Dynamic DAST, Black Duck Binary Analysis, and Polaris Software Integrity Platform across an enterprise application portfolio
Engagement model with scope, ROE, and deliverables		Application portfolio model rather than scoped engagement
Client model with onboarding, contacts, and access control		Internal application owner, contributing-developer, and open-source programme office model
Branded white-label client portal on your subdomain
Software composition analysis (SCA)	Dependency analysis through Semgrep on connected repositories	Black Duck KnowledgeBase with one of the largest open-source component databases and license-risk classification
Open-source license risk register and policy-driven build gating
SAST scanning	Semgrep-powered, multi-language	Coverity SAST (Synopsys static analysis engine, acquired 2014)
DAST scanning against running applications	17-module authenticated web scanner behind stored credentials on verified domains	WhiteHat Dynamic DAST (acquired 2022) on the Polaris fabric
Container image and binary analysis		Black Duck Binary Analysis for compiled code, container images, and firmware
Built-in external vulnerability scanning (16 modules)
Subdomain enumeration and external attack surface discovery
Repository OAuth (GitHub, GitLab, Bitbucket)		Black Duck Detect agent integrates with CI/CD pipelines and package managers
Manual finding entry with full editor		Limited (records originate from Black Duck engines or Polaris fabric)
AI-powered narrative report generation (executive, technical, remediation)		Console dashboards, audit-ready attribution reports, and Black Duck Audit Services rather than engagement-shaped narrative deliverables
300+ finding templates with remediation guidance		Black Duck Security Advisories and KnowledgeBase remediation guidance per matched component
CVSS 3.1 vector parsing and auto-scoring		CVSS plus Black Duck severity model layered against the KnowledgeBase
Scanner result import (Nessus, Burp Suite, CSV)		Imports limited to Black Duck Detect output, the KnowledgeBase, and the Polaris fabric engines
Encrypted credential vault for authenticated scans (AES-256-GCM)		Credential management for connected source-code repositories and Polaris fabric integrations
Continuous scheduled scanning cadence (daily, weekly, biweekly, monthly)		CI/CD-driven and scheduled scanning against the application portfolio through the Black Duck Detect agent
Retest workflow paired to original finding		Re-scan validates closure through the next pipeline run
Exception register with eight-field decision chain		Policy waiver workflow against component or license risk; not a per-finding exception decision chain
Compliance framework templates	21 frameworks including OWASP, OWASP ASVS, OWASP MASVS, OWASP API Security Top 10, ISO 27001, SOC 2, PCI DSS, NIST 800-53, NIST 800-171, FedRAMP, MITRE ATT&CK, DORA, NIS2, CIS Controls, and Essential Eight	Compliance reports across OWASP, PCI DSS, NIST, ISO 27001, SOC 2, HIPAA, FedRAMP, EU CRA, and similar through the audit-ready attribution pack
Audit-ready open-source attribution reporting		Black Duck Audit Services for M&A and contractual open-source attribution
Integrated invoicing and Stripe Connect payments for engagements
Activity audit trail with CSV export		Platform audit logs and console history
MFA enforcement on every workspace		SSO and IdP-driven controls
Free plan available
Pricing model	Free, Pro, Team	Sales-led, application-count, codebase-count, contributing-developer-count, and module-based licensing with annual commitment
Setup time	2 minutes	Application portfolio onboarding plus Black Duck Detect agent installation across CI/CD plus KnowledgeBase mapping plus policy engine configuration
Best fit for	AppSec teams, internal security teams, vulnerability management teams, product security teams, pentest firms, MSSPs, and consultancies that scan, report, and deliver findings from one workspace	Enterprise AppSec and product security teams that own an open-source-heavy application portfolio, run open-source license compliance against an enterprise policy, want a managed KnowledgeBase across the dependency picture, and need SAST plus DAST plus SCA on the same Polaris fabric across many development teams

SecPortal vs Black Duck: enterprise SCA console vs security testing workspace

Black Duck (the platform Synopsys acquired in 2017 and spun back out as Black Duck Software in 2024) is one of the dominant enterprise open-source software composition analysis platforms. The product covers SCA through the Black Duck KnowledgeBase (one of the largest open-source component databases on the market) with license-risk classification and policy-driven build gating, SAST through Coverity (the static analysis engine Synopsys acquired in 2014), DAST through WhiteHat Dynamic (acquired in 2022), container and image scanning through Black Duck Binary Analysis, and audit-ready open-source attribution reporting through Black Duck Audit Services. The Polaris Software Integrity Platform is the fabric layer that bundles SAST, DAST, and SCA on one console for enterprise AppSec programmes. The buyer is an enterprise AppSec leader, a product security leader, or an open-source programme office owner whose primary job is to drive the open-source component inventory across the application portfolio, prevent non-compliant license terms from shipping, and run SAST plus DAST as part of the same enterprise application security testing fabric.

SecPortal is a different shape. SecPortal is the security testing and delivery workspace for AppSec teams, internal security teams, vulnerability management teams, product security teams, pentest firms, MSSPs, and consultancies that run scoped engagements and ship findings to application owners, business stakeholders, or external clients. The engagement, the scoping, the SAST and dependency analysis output from connected repositories, the authenticated DAST and external perimeter scans, the manual findings, the AI-generated report, the branded client portal, the retest, and the invoice all sit inside one workspace. If the question is whether to scan an open-source application portfolio continuously across an enterprise estate or to deliver assessments and findings as a recurring deliverable on a scoped engagement record, this page is the side-by-side. The adjacent comparisons buyers in the source-side AppSec category often evaluate alongside are SecPortal vs Snyk, SecPortal vs Mend.io, SecPortal vs Veracode, SecPortal vs Checkmarx, and SecPortal vs Semgrep.

Where the enterprise SCA console model stops for delivery work

These are not Black Duck-specific criticisms; they are properties of an enterprise open-source SCA console when the buyer compares it to running scoped engagements on a delivery workspace.

Built as an open-source-license-compliance and SCA platform, not a security testing workspace

Black Duck Software Composition Analysis (the platform Synopsys acquired in 2017 and spun back out in 2024) is organised around the Black Duck KnowledgeBase, the open-source component inventory across the application portfolio, and the policy-driven gating that prevents non-compliant components from shipping. The Polaris fabric layers SAST through Coverity and DAST through WhiteHat Dynamic onto the same console for enterprise application security testing programmes. The buyer is an enterprise AppSec or product security leader who owns hundreds or thousands of applications across many development teams and needs an SCA-first console that prevents license risk, tracks the open-source dependency picture across the estate, and runs SAST or DAST as part of the same fabric. SecPortal is a different shape: scoped engagements, manual finding entry, AI report generation, branded client portal, native external and authenticated web scanning, code scanning on connected repositories, retesting, findings management with CVSS 3.1 vector parsing, and the exception register all live inside one workspace.

No engagement, scope, or scoped deliverable model

Black Duck is organised around the application, the component inventory, the policy violation, the open-source license review, and the SAST or DAST scan inside the Polaris fabric. There is no concept of a scoped engagement that opens with a kickoff, runs against a defined target list, ships a final report under a client or stakeholder name, schedules a retest, and closes on a delivery date. If the work being shipped is a penetration test, a vulnerability assessment, an external attack surface programme, an AppSec code review, a third-party security review, or a client-billable security assessment with a defined scope and a deliverable, Black Duck does not carry that record. SecPortal does, on the same workspace as the scanner stack, the AI report generator, and the branded client portal.

No branded client portal for technical findings delivery

Black Duck output (the component inventory, the policy violations, the SAST and DAST findings, the Black Duck Security Advisories citation chain, and the audit-ready report pack) is reviewed inside the Black Duck console or routed to developer tools through native CI/CD integrations and the Black Duck Detect scanner. Sharing the results with an application owner, a business stakeholder, or an external client typically means a Black Duck report PDF, a CSV export from the console, or a ticket in a downstream system. SecPortal ships a white-label client portal on your tenant subdomain so every finding, retest, remediation thread, and report download lives under your team or consultancy brand rather than a vendor console.

No external perimeter or authenticated DAST inside the same workspace

Black Duck covers the source side of the application: SCA through the KnowledgeBase, SAST through Coverity inside Polaris, container and image scanning through Black Duck Binary Analysis, and DAST through WhiteHat Dynamic. It does not run external perimeter scanning across DNS, ports, SSL, headers, subdomains, and technology fingerprinting against the public attack surface, and it does not consolidate authenticated DAST against logged-in workflows alongside the SCA record on the same workspace as engagement-shaped findings. Engagements that combine source-side SCA and SAST with running-application testing and external perimeter coverage need a separate DAST and a separate external scanner. SecPortal runs SAST and dependency analysis through Semgrep, external scanning across 16 modules, and authenticated DAST behind cookie, bearer, basic, or form authentication on the same engagement record.

No manual finding entry for non-scanner output

Black Duck is a scanner-driven console. Findings appear in the workspace because a Black Duck engine detected them (KnowledgeBase match on a dependency, Coverity SAST analyser output, Black Duck Binary Analysis result, WhiteHat Dynamic DAST output). A pentest, a manual code review, a manual SCA review against a private dependency, a threat-modelling output, or a third-party security review also produces findings the scanner cannot reach: business logic flaws, chained exploits, manual SSRF or IDOR proofs, authentication bypasses through application-specific state, design-level weaknesses, and supply-chain-tampering walkthroughs. SecPortal ships a full manual finding editor with the 300+ finding template library, CVSS 3.1 vector parsing and auto-scoring, and structured evidence so non-scanner findings live on the same record as scanner output.

Sales-led procurement and enterprise commercial model

Black Duck pricing is custom and sales-led, typically structured on the application count, the codebase count, the contributing developer count, the modules in scope (KnowledgeBase SCA, Coverity SAST, Binary Analysis, WhiteHat Dynamic DAST, Polaris fabric, Audit Services), and the policy-engine licensing tier. There is no public price page, no monthly self-serve tier, and no free starting point for a small team or a single engagement. SecPortal pricing is transparent on the website with a free plan, monthly Pro and Team tiers, and no minimum commitment.

What SecPortal adds to the picture

Engagement-shaped workflow

Every scan, manual finding, retest, AI report, and invoice sits inside an engagement that has a client, business unit, or stakeholder, a scope, a status, and a delivery date. The model matches the way internal AppSec teams run scoped application reviews for an application owner, the way internal security teams run scoped assessments for business units, the way consultancies deliver scoped engagements to clients, and the way pentest firms ship findings under a deliverable contract.

AI report generation from the live findings record

Generate executive summaries, full technical reports, remediation roadmaps, and compliance summaries from the engagement findings with a single click. The AI uses the workspace context: engagement scope, findings, severities, CVSS vectors, evidence, and exception decisions. The report becomes a draft the team edits rather than a console export augmented after the scan.

White-label client portal on a tenant subdomain

Every workspace gets a branded client portal on its own tenant subdomain. Application owners, business stakeholders, or external clients log in to review findings, track remediation, download reports, and communicate with the team under your brand rather than under a vendor console. Sharing findings does not mean exporting and emailing a CSV from Black Duck.

Source-side scanning paired with running-app and perimeter scanning on one workspace

SAST and dependency analysis through Semgrep run against repositories connected via GitHub, GitLab, or Bitbucket OAuth. External perimeter scanning runs across 16 modules covering SSL, headers, DNS, ports, subdomains, technology fingerprinting, and CVE correlation. Authenticated DAST runs behind stored credentials through cookie, bearer, basic, or form-based authentication. One workspace covers the source, the running application, and the perimeter rather than three consoles, three credential vaults, and three buyer relationships.

300+ finding templates with calibrated severity

A finding template library covers the recurring vulnerability classes a SAST, DAST, SCA, or manual reviewer produces: injection, access control, cryptography, configuration, authentication, and business logic. Templates carry CVSS 3.1 vectors and remediation guidance so the analyst edits the proof rather than rewriting the description. Severity comes from CVSS vector parsing, not from a fixed vendor severity table.

Continuous monitoring inside the engagement record

Continuous monitoring schedules (daily, weekly, biweekly, monthly) run scans against verified domains and authenticated targets on the same record as the manual findings, the AI report, and the retest. Continuous coverage sits inside the engagement workflow rather than on a separate console.

Who each platform is the right fit for

Black Duck and SecPortal solve adjacent problems for different buyer shapes. The honest framing is that the right tool depends on whether the primary motion is portfolio-wide open-source license compliance and dependency coverage across an enterprise application estate or shipping engagement deliverables that combine source, authenticated, and external coverage on a scoped engagement record.

Black Duck fits enterprise AppSec programmes anchored on open-source license and dependency compliance

If you are an enterprise AppSec or product security team that owns hundreds or thousands of applications heavy on open-source dependencies, runs Black Duck SCA against the application portfolio as the system of record for open-source component inventory and license compliance, gates non-compliant components at build time through the policy engine, layers Coverity SAST and WhiteHat Dynamic DAST on the same Polaris fabric, and operates with an enterprise procurement and security architecture model, Black Duck is built for that shape of work. The buyer assumption is one source-side AppSec console that drives the open-source dependency picture, the license risk register, the SAST baseline, and the DAST coverage across the portfolio.

SecPortal fits AppSec, internal security, vulnerability management, and consultancy teams that ship findings as a deliverable

If you are an AppSec team running scoped reviews against named applications, an internal security team running scoped assessment cycles for business units, a vulnerability management team that consolidates external and authenticated scan output alongside SAST and SCA findings, a product security team running engagement reviews, a penetration testing firm, an MSSP, or a security consultancy delivering AppSec or pentest engagements to clients, SecPortal is the delivery workspace. Engagement, findings, source-side scanning, perimeter scanning, authenticated DAST, AI reports, branded portal, and invoicing all live on one tenant.

When the answer is both

A team that runs Black Duck as the enterprise SCA and open-source license compliance platform across the application portfolio and also delivers scoped assessments to application owners, business stakeholders, or external customers can use Black Duck for the portfolio-wide open-source coverage and license-risk register and SecPortal for the scoped delivery, the external attack surface work, the authenticated DAST against logged-in workflows, the manual pentest findings, and the AI-generated narrative report. The two are adjacent. The question is whether the primary motion this year is portfolio-wide open-source compliance and license risk across the enterprise application estate or shipping engagement deliverables that combine source, authenticated, and external coverage on one workspace.

How the Black Duck KnowledgeBase compares to the SecPortal engagement record

Black Duck and SecPortal both produce evidence an auditor, a buyer, or an application owner reads, but the asset of record is different. The Black Duck KnowledgeBase is the canonical view of the open-source dependency picture across the enterprise application portfolio. The SecPortal engagement record is the canonical view of the scoped security work that produced a deliverable. The contrast matters when the audit-side reader asks for the underlying technical security testing evidence behind a control or a deliverable, not just the open-source component inventory state.

Black Duck KnowledgeBase is the asset of record for the open-source dependency picture

The Black Duck value proposition is that the KnowledgeBase is the canonical record of every open-source component in the enterprise application portfolio: component identity, version, license terms, declared vulnerabilities, exploit availability where mapped, contributing developer attribution, and policy-violation status. The platform reads code via Black Duck Detect or the Polaris fabric, matches identified components against the KnowledgeBase, and produces an inventory the AppSec leader and the legal team read against open-source licensing policy. The asset is the component inventory and the license risk register; the audience is the AppSec leader, the open-source programme office, and the legal counsel reviewing acceptable use.

SecPortal finding-level record holds the engagement evidence from kickoff to closure

SecPortal does not maintain a managed open-source component inventory the size of the Black Duck KnowledgeBase and does not produce a license-risk register against an open-source licensing policy. SecPortal does run Semgrep-powered dependency analysis against repositories connected via GitHub, GitLab, or Bitbucket OAuth so dependency-vulnerability findings land on the engagement record alongside SAST, external, authenticated, and manual findings. The asset is the engagement, scan, finding, exception decision, retest, and closure record; the audience is the application owner, the engineering team, the security operator, the external client, the business unit stakeholder, and the auditor reading remediation history.

Where SecPortal sits next to a Black Duck deployment

SecPortal is not a replacement for a Black Duck KnowledgeBase across an enterprise open-source application portfolio. SecPortal sits next to a Black Duck deployment as the security testing and delivery workspace where scoped pentest findings, manual reviewer findings, external perimeter scan output, authenticated DAST output, SAST and dependency analysis output, AI-generated reports, the exception register, and the branded client portal all live on one tenant. If Black Duck is the right answer for the open-source license compliance and portfolio-wide dependency picture, the security testing workspace is still the right answer for the engagement, finding, and delivery work that sits beside it.

Polaris fabric versus engagement record: two operating models

Black Duck markets the Polaris Software Integrity Platform as the fabric that ties Coverity SAST, WhiteHat Dynamic DAST, and Black Duck SCA on the same console across the enterprise application portfolio. SecPortal organises work around scoped engagements and the findings they produce across SAST, dependency analysis, authenticated DAST, and external scanning lanes that converge on a single engagement record. The two models read different surfaces and produce different evidence shapes.

Polaris fabric layers Coverity SAST and WhiteHat Dynamic DAST onto the Black Duck console

The Polaris Software Integrity Platform is the enterprise fabric layer that bundles Coverity (the enterprise SAST analyser acquired by Synopsys in 2014), WhiteHat Dynamic (the enterprise DAST tool acquired in 2022), and Black Duck SCA on the same console for application security testing across the application portfolio. The Polaris value proposition is that the SAST baseline, the DAST coverage, the SCA component inventory, and the policy violation gating all read against the same application identity and the same enterprise AppSec policy engine. The asset is the multi-engine application security testing fabric; the audience is the enterprise AppSec leader and the security architect running an enterprise application security testing programme.

SecPortal runs SAST, DAST, and SCA on one engagement record without an enterprise fabric layer

SecPortal runs Semgrep-powered SAST and dependency analysis against repositories connected by OAuth, 17 authenticated DAST modules against logged-in workflows behind stored credentials, and 16 external scanner modules across the public perimeter. The three lanes converge on the same engagement record with a single severity model (CVSS 3.1 vector parsing), a single finding lifecycle (open, in_progress, resolved, verified, reopened), a single retest workflow paired to the original finding, and a single AI report generator. The asset is the engagement record; the audience is the AppSec analyst, the internal security operator, the consultancy operator, and the application owner reading findings.

Where each model fits the AppSec programme

The Polaris fabric fits enterprise AppSec programmes that own a large application portfolio, run SAST, DAST, and SCA as continuous coverage across the portfolio, and need a fabric layer that holds the multi-engine output and policy engine in one place across many development teams. The SecPortal engagement record fits AppSec, internal security, vulnerability management, product security, pentest firm, MSSP, and consultancy teams that run scoped engagements with a defined scope, a deliverable, and a closure date. Many enterprise AppSec programmes run both: the Polaris fabric carries the portfolio-wide multi-engine baseline and the open-source license register, the SecPortal workspace carries the scoped engagement that ships a deliverable to an application owner, a business unit, or an external client.

How Black Duck sits relative to Snyk, Mend, Veracode, and Checkmarx

Buyers comparing source-side AppSec platforms typically shortlist Black Duck alongside Snyk, Mend.io, Veracode, and Checkmarx in the same enterprise category and weigh SCA depth, SAST engine maturity, DAST coverage, developer ergonomics, and policy-engine fit against the application portfolio shape. The contrast below explains how Black Duck sits relative to those adjacent platforms.

Black Duck versus Snyk and Mend

Black Duck, Snyk, and Mend.io sit in the same source-side AppSec category with overlapping SCA coverage, overlapping SAST coverage on Coverity, Snyk Code, and Mend SAST, overlapping dependency-update automation on PRs, and overlapping container image scanning. The platforms differ on shape. Black Duck is the most license-compliance-centric of the three with the largest open-source KnowledgeBase and the strongest enterprise policy engine for open-source license risk. Snyk is the most developer-tool-shaped with the broadest IDE and CI/CD integration footprint and the strongest reachability prioritisation on Snyk Open Source. Mend (the rebranded WhiteSource, sometimes evaluated alongside Black Duck for the SCA decision) is the most dependency-update-centric with the commercial home of Renovate and the strongest auto-PR motion. Buyers comparing the three usually weigh license compliance maturity, developer ergonomics, and dependency-update automation against employee count, developer count, and module mix.

Black Duck versus Veracode and Checkmarx

Black Duck, Veracode, and Checkmarx sit in the enterprise application security testing category with overlapping SAST coverage, overlapping SCA coverage, overlapping DAST coverage, and overlapping API security extensions. The platforms differ on which engine they led with and which one they acquired or built later. Black Duck led with SCA (KnowledgeBase) and bought Coverity SAST and WhiteHat DAST through Synopsys consolidation. Veracode led with binary SAST and built SCA, DAST, and IAST around it. Checkmarx led with source-code SAST and built SCA, DAST, IaC, container, and API into Checkmarx One. Buyers comparing the three usually weigh which lane the enterprise leads with, which integration model fits the developer tools, and which policy engine fits the AppSec governance model.

Where SecPortal sits relative to all of them

SecPortal is not an enterprise AppSec console and does not pretend to replace one. SecPortal sits next to enterprise AppSec consoles as the security testing and delivery workspace where scoped pentest findings, manual reviewer findings, external perimeter scan output, authenticated web DAST output, SAST and SCA output from connected repositories, AI-generated reports, the exception register, and the branded client portal all live on one tenant. If Black Duck (or Snyk, Mend, Veracode, Checkmarx) is the right answer for the portfolio-wide source-side AppSec coverage, the security testing workspace is still the right answer for the engagement, finding, and delivery work that sits beside it.

How SecPortal source-side scanning compares to Black Duck source-side scanning

Black Duck covers source-side application security with depth on the open-source dependency surface: the KnowledgeBase as the canonical component inventory, Coverity SAST as the multi-language analyser, Black Duck Binary Analysis for compiled code and container images, WhiteHat Dynamic for DAST, and policy gating at build time through the Black Duck Detect scanner and the Polaris fabric. SecPortal covers the same source-side surface as one of three lanes that converge on a single engagement record, rather than as the centrepiece of an enterprise SCA console.

The code scanning feature runs SAST and dependency analysis through Semgrep against a repository connected via GitHub, GitLab, or Bitbucket OAuth. The external scanning feature runs 16 modules across SSL, headers, DNS, ports, subdomains, technology fingerprinting, and CVE correlation so the perimeter is scanned alongside the source. The authenticated scanning feature adds DAST behind stored credentials through cookie, bearer, basic, or form authentication so issues that only surface inside an authenticated session do not slip past anonymous scanning. The continuous monitoring feature runs daily, weekly, biweekly, or monthly scans on a schedule and writes the results back to the same engagement record.

How credentials, repository access, and import paths are handled

Source-side scanning needs read access to a repository. SecPortal connects to GitHub, GitLab, or Bitbucket through OAuth so scope is bound to the connected organisation and the repositories the team selects, rather than through a shared service account or a long-lived deploy key. Authenticated scanning needs credentials that live somewhere durable. SecPortal stores them in an encrypted credential vault with AES-256-GCM, scoped to a verified domain. Every external scan is gated on domain verification through DNS TXT or meta tag so authorisation is provable before any module fires. Teams that operate Black Duck for the portfolio-wide open-source inventory can still consolidate scanner output onto the engagement record through the importing third-party scanner results guide for the verified Nessus, Burp Suite, and CSV import paths.

From scan to deliverable

The output of an SCA, SAST, or DAST run is the beginning of a deliverable, not the end. SecPortal turns scan results into draft findings, the analyst triages and validates them, the findings management layer holds the consolidated record with CVSS vectors, evidence, and remediation, and the AI reports feature generates the executive and technical narrative the recipient receives. The branded client portal is where the deliverable lands; the scanner result triage workflow covers how raw scanner output becomes a calibrated finding before it is promoted onto the canonical record.

For AppSec teams running dependency-vulnerability triage on the engagement record, the dependency vulnerability triage workflow covers how SCA output becomes a prioritised finding with a named owner, a defensible severity, and a closure record. For internal security teams that already operate Black Duck and want to operationalise the output into engagement records and remediation tracking, the SDLC vulnerability handoff workflow and the remediation tracking workflow cover how source-side findings move from detection to closure with named owners, SLA tiers, and an audit trail. The compliance crosswalk for AppSec evidence is covered in the control mapping workflow so the same engagement evidence answers OWASP ASVS V14, ISO 27001 A.8.28, SOC 2 CC8.1, PCI DSS Requirement 6, NIST SSDF PW.4, and NIST 800-53 SA-11 simultaneously.

Transparent pricing, no procurement cycle

SecPortal pricing is published on the website and self-service from sign-up. There is no annual contract floor on the Pro or Team tiers, no per-application or per-developer licensing scaled to the portfolio footprint, and no sales call required before you can run a real engagement.

SecPortal Free

Free forever

1 user, 3 clients, 2 engagements per client, 3 AI credits, 6 core scan modules.

SecPortal Pro

From $149/month

All scan modules, 100 clients, 25 AI credits/month, branded client portal, invoicing, compliance tracking.

SecPortal Team

From $299/month

Up to 5 users, 75 AI credits/month, team management, activity audit trail with CSV export, MFA enforcement.

Why AppSec, internal security, and consultancy teams pick SecPortal alongside or instead of Black Duck

Run scoped AppSec, pentest, and vulnerability management engagements with a kickoff, deliverables, retests, and a final invoice on one record rather than a portfolio-wide SCA console and a separate engagement tracker
Scan the perimeter with 16 external modules, run authenticated DAST with 17 web modules, and run SAST plus dependency analysis on connected repositories from inside the same workspace
Generate executive, technical, and remediation deliverables with Claude from the live findings record rather than annotating a Black Duck report PDF after the scan
Enter manual findings from a tester, reviewer, or third-party report (business logic flaws, IDOR walkthroughs, chained exploits, design-level weaknesses) into the same record the scanners feed
Deliver findings through a branded client portal on a tenant subdomain instead of console exports or downstream tickets routed out of a vendor console
Pair every retest to the original finding so the closure record holds up under audit rather than relying on the next scan cycle to confirm the fix
Document CVSS 3.1 vector, asset, evidence, owner, severity, and remediation status on the engagement record so prioritisation is defensible to a board, an auditor, or an application owner
Capture the exception register on the same record as the finding with linked finding, severity, compensating controls, residual likelihood, residual impact, business rationale, expiry, and review cadence
Map findings across 21 framework templates including OWASP, OWASP ASVS, OWASP MASVS, OWASP API Security Top 10, ISO 27001, SOC 2, PCI DSS, NIST 800-53, NIST 800-171, FedRAMP, MITRE ATT&CK, DORA, NIS2, CIS Controls, and Essential Eight
Store privileged scan credentials encrypted at rest with AES-256-GCM and rotate them through the in-product credential vault
Invoice clients or business units directly from the engagement record through Stripe Connect
Start on the free plan and upgrade without a sales call, an application-count audit, a developer-count audit, or an annual contract floor for the published tiers

Honest scope: what SecPortal does not aim to be

SecPortal does not ship a managed open-source component inventory the size of the Black Duck KnowledgeBase, does not classify open-source license terms against an enterprise open-source licensing policy, does not run the Coverity SAST analyser as the SAST engine, does not run Black Duck Binary Analysis on compiled code, does not gate non-compliant components at build time through a policy engine, does not ship packaged IDE plug-ins for the Black Duck Detect agent, and does not maintain an enterprise audit-services delivery model for open-source attribution reporting. SecPortal also does not ship packaged Jira, ServiceNow, Slack, SIEM, SOAR, or CMDB connectors. The honest framing is that SecPortal is a security testing and delivery workspace that complements an enterprise SCA console rather than a portfolio-wide open-source license compliance platform that replaces one.

When the work is scoped engagement delivery, not portfolio-wide open-source license compliance

Run scoped AppSec, pentest, and vulnerability management engagements, generate AI reports, and ship findings through a branded portal on one workspace. SAST plus dependency analysis plus DAST plus external scanning live on the same engagement record. Start free.