Black Duck Software
More info
- Released
- 2002
- Owner
- Synopsys (2017–2024), then independent
- Type
- Open source analysis software
The company that turned "what open source is actually in our product, and under which licences?" into a business.
Black Duck was founded in Massachusetts in 2002, around the time corporate lawyers started noticing that developers had pasted GPL code into proprietary products without asking anyone. Its tool compared source code against a large database of open source projects and reported what it found. In acquisitions a Black Duck audit became routine: buyers wanted to know whether licence liabilities came with the deal.
Over the years the emphasis shifted from licences to vulnerabilities — which dependencies carry known security holes — and the field got the name software composition analysis. Synopsys bought the company in 2017, then in 2024 sold off its whole security division, which took the Black Duck name. After Log4Shell and the push for SBOMs, the customers came looking on their own.