Black Duck vs Sonatype Lifecycle comparison

Cancel
You must select at least 2 products to compare!
Synopsys Logo
15,246 views|10,629 comparisons
Sonatype Logo
6,705 views|3,741 comparisons
Comparison Buyer's Guide
Executive Summary
Updated on Mar 20, 2023

We performed a comparison between Black Duck and Sonatype Nexus Lifecycle based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.

  • Ease of Deployment: Black Duck is easy to install. Sonatype Nexus Lifecycle requires repeated training for effective use despite having an easy initial technical deployment.
  • Features: Black Duck's features include extensive vulnerability scanning, easy installation, integration with Docker binary files, and a user-friendly interface. Sonatype Nexus Lifecycle offers open source intelligence, policy enforcement, and blocking of undesirable components, as well as flexible policies and email notifications. Its engine accurately calculates security vulnerabilities and provides plugins for real-time feedback.
  • Pricing: Black Duck's pricing is unclear and appears to be negotiated on a case-by-case basis. Sonatype Nexus Lifecycle is expensive, with additional feature packs offered at an extra cost.
  • Service and Support: Black Duck has mixed reviews on technical support with some positive and negative feedback. Sonatype Nexus Lifecycle has positive reviews for technical support, with a dedicated support person and regular meetings.

Comparison Result: Based on the parameters we compared, Sonatype Nexus Lifecycle comes out ahead of Black Duck. Although both products have valuable features and can be estimated as high-end solutions, our reviewers found that Black Duck has some limitations with its reporting and can be difficult to integrate.

To learn more, read our detailed Black Duck vs. Sonatype Lifecycle Report (Updated: March 2024).
765,386 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"The most valuable feature is the vulnerability scanning, and that it's easy to use.""The solution works well on Mac products.""Policy management is a valuable feature.""The solution is stable.""The knowledge base and the management system are the most valuable features of Black Duck Hub. It has a very helpful management environment. They offer an editor where we can check the discovered license, which is retrieved from their knowledge base. They have a huge knowledge base build over the years. It gives you some possibilities, such as this license with possibility A could cause a vulnerability issue or a potential breach.""The solution is very good at scanning and evaluating open source software.""The UI is the solution's most valuable feature since it allows for easy pipeline integration.""The stability is okay."

More Black Duck Pros →

"You can really see what's happening after you've developed something.""We really like the Nexus Firewall. There are increasing threats from npm, rogue components, and we've been able to leverage protection there. We also really like being able to know which of our apps has known vulnerabilities.""The IQ server and repo are the most valuable.""Fortify integrates with various development environments and tools, such as IDEs (Integrated Development Environments) and CI/CD pipelines.""What's really nice about that is it shows a graph of all the versions for that particular component, and it marks out the ones that have a vulnerability and the ones that don't have a vulnerability.""The integration of Lifecycle is really good with Jenkins and GitHub; those work very well. We've been able to get it to work seamlessly with them so that it runs on every build that we have.""The way we can define policies and apply those policies selectively across the different applications is valuable. We can define a separate policy for public-facing applications and a separate policy for the internal applications. That is cool.""Sonatype support is quite responsive. When we needed something, we could reach out and set up a meeting. They provide the best support possible."

More Sonatype Lifecycle Pros →

Cons
"We have been having some issues with the latest releases where we are not able to scan our applications with the help of Black Duck.""We're not too sure about the extension of the firewall. It never shows up in the Hub.""The solution must provide more open APIs.""The scanner client is limited by the size of software it can handle.""The documentation is quite scattered.""Black Duck can improve the time it takes for a scan. Most of the time it's not ideal when integrated with the live DevSecOps pipeline. We have to create a separate job to scan the library because it takes a couple of hours to scan all those libraries. The scanning could be faster.""It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance.""The product's pricing is higher compared to other competitor products."

More Black Duck Cons →

"Not all languages are supported in Fortify.""If there is something which is not in Maven Central, sometimes it is difficult to get the right information because it's not found.""If they had a more comprehensive online tutorial base, both for admin and developers, that would help. It would be good if they actually ran through some scenarios, regarding what happens if I do pick up a vulnerability. How do I fork out into the various decisions? If the vulnerability is not of a severe nature, can I just go ahead with it until it becomes severe? This is important because, obviously, business demands certain deliverables to be ready at a certain time.""The generation of false positives should be reduced.""If you look at NPM-based applications, JavaScript, for example, these are only checkable via the build pipeline. You cannot upload the application itself and scan it, as is possible with Java, because a file could change significantly.""They're working on the high-quality data with Conan. For Conan applications, when it was first deployed to Nexus IQ, it would scan one file type for dependencies. We don't use that method in Conan, we use another file type, which is an acceptable method in Conan, and they didn't have support for that other file type. I think they didn't even know about it because they aren't super familiar with Conan yet. I informed them that there's this other file type that they could scan for dependencies, and that's what they added functionality for.""Sonatype Nexus Lifecycle can improve by having a feature to automatically detect vulnerabilities. Additionally, if it could automatically push the dependencies or create notifications it would be beneficial.""We created the Wiki page for each team showing an overview of their outstanding security issues because the Lifecycle reporting interface isn't as intuitive. It is good for people on my team who use it quite often. But for a tech engineer who doesn't interact with it regularly, it's quite confusing."

More Sonatype Lifecycle Cons →

Pricing and Cost Advice
  • "Depending on the use case, the cost could range from $10,000 USD to $70,000 USD."
  • "The price is quite high because the behavior of the software during the scan is similar to competing products."
  • "The price is low. It's not an expensive solution."
  • "Black Duck is more suitable if you require a lot of licensing compliance. For smaller organizations, WhiteSource is better because its pricing policies are not really suitable for huge organizations."
  • "It is expensive."
  • "I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price."
  • "The pricing is a little high."
  • More Black Duck Pricing and Cost Advice →

  • "Its pricing is competitive within the market. It's not very cheap, it's not very expensive."
  • "We're pretty happy with the price, for what it is delivering for us and the value we're getting from it."
  • "Pricing is comparable with some of the other products. We are happy with the pricing."
  • "The price is good. We certainly get a lot more in return. However, it's also hard to get the funds to roll out such a product for the entire firm. Therefore, pricing has been a limiting factor for us. However, it's a fair price."
  • "The license fee may be a bit harder for startups to justify. But it will save you a headache later as well as peace of mind. Additionally, it shows your own customers that you value security stuff and will protect yourselves from any licensing issues, which is good marketing too."
  • "In addition to the license fee for IQ Server, you have to factor in some running costs. We use AWS, so we spun up an additional VM to run this. If the database is RDS that adds a little bit extra too. Of course someone could run it on a pre-existing VM or physical server to reduce costs. I should add that compared to the license fee, the running costs are so minimal they had no effect on our decision to use IQ Server."
  • "Pricing is decent. It's not horrible. It's middle-of-the-road, as far as our ranking goes. They're a little bit more but that's also because they provide more."
  • "Lifecycle, to the best of my recollection, had the best pricing compared with other solutions."
  • More Sonatype Lifecycle Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
    765,386 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license… more »
    Top Answer:The UI is the solution's most valuable feature since it allows for easy pipeline integration.
    Top Answer:I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price.
    Top Answer:We like the data that Sonatype Nexus Lifecycle consistently delivers. This solution helps us in fixing and understanding the issues a lot quicker. The policy engine allows you to set up different… more »
    Top Answer:Fortify integrates with various development environments and tools, such as IDEs (Integrated Development Environments) and CI/CD pipelines.
    Top Answer:I would rate the affordability of the solution as an eight out of ten.
    Ranking
    Views
    15,246
    Comparisons
    10,629
    Reviews
    7
    Average Words per Review
    373
    Rating
    8.1
    Views
    6,705
    Comparisons
    3,741
    Reviews
    16
    Average Words per Review
    1,011
    Rating
    8.1
    Comparisons
    Also Known As
    Blackduck Hub, Black Duck Protex, Black Duck Security Checker
    Sonatype Nexus Lifecycle, Nexus Lifecycle
    Learn More
    Overview

    Black Duck is a comprehensive solution for managing security, license compliance, and code quality risks that come from the use of open source in applications and containers. Named a leader in software composition analysis (SCA) by Forrester, Black Duck gives you unmatched visibility into third-party code, enabling you to control it across your software supply chain and throughout the application life cycle.

    Sonatype Lifecycle is an open-source security and dependency management software that uses only one tool to automatically find open-source vulnerabilities at every stage of the System Development Life Cycle (SDLC). Users can now minimize security vulnerabilities, permitting organizations to enhance development workflow. Sonatype Lifecycle gives the user complete control over their software supply chain, allowing them to regain wasted time fighting risks in the SDLC. In addition, this software unifies the ability to define rules, actions, and policies that work best for your organizations and teams.

    Sonatype Lifecycle allows users to help their teams discover threats before an attack has the chance to take place by examining a database of known vulnerabilities. With continuous monitoring at every stage of the development life cycle, Sonatype Lifecycle enables teams to build secure software. The solution allows users to utilize a complete automated solution within their existing workflows. Once a potential threat is identified, the solution’s policies will automatically rectify it.

    Benefits of Open-source Security Monitoring

    As cybersecurity attacks are on the rise, organizations are at constant risk for data breaches. Managing your software supply chain gets trickier as your organization grows, leaving many vulnerabilities exposed. With easily accessible source code that can be modified and shared freely, open-source monitoring gives users complete transparency. A community of professionals can inspect open-source code to ensure fewer bugs, and any open-source dependency vulnerability will be detected and fixed rapidly. Users can use open-source security monitoring to avoid attacks through automatic detection of potential threats and rectification immediately and automatically.

    Reviews from Real Users

    Sonatype Lifecycle software receives high praise from users for many reasons. Among them are the abilities to identify and rectify vulnerabilities at every stage of the SDLC, help with open-source governance, and minimize risk.

    Michael E., senior enterprise architect at MIB Group, says "Some of the more profound features include the REST APIs. We tend to make use of those a lot. They also have a plugin for our CI/CD.”

    R.S., senior architect at a insurance company, notes “Specifically features that have been good include:

    • the email notifications
    • the API, which has been good to work with for reporting, because we have some downstream reporting requirements
    • that it's been really user-friendly to work with.”

    "Its engine itself is most valuable in terms of the way it calculates and decides whether a security vulnerability exists or not. That's the most important thing. Its security is also pretty good, and its listing about the severities is also good," says Subham S., engineering tools and platform manager at BT - British Telecom.

    Sample Customers
    Samsung, Siemens, ScienceLogic, Noser Engineering AG, ClickFox, Dynatrace, CopperLeaf
    Genome.One, Blackboard, Crediterform, Crosskey, Intuit, Progress Software, Qualys, Liberty Mutual Insurance
    Top Industries
    REVIEWERS
    Manufacturing Company60%
    Computer Software Company20%
    Financial Services Firm20%
    VISITORS READING REVIEWS
    Financial Services Firm21%
    Manufacturing Company15%
    Computer Software Company15%
    Healthcare Company4%
    REVIEWERS
    Financial Services Firm32%
    Computer Software Company11%
    Insurance Company11%
    Manufacturing Company8%
    VISITORS READING REVIEWS
    Financial Services Firm32%
    Computer Software Company11%
    Government9%
    Manufacturing Company6%
    Company Size
    REVIEWERS
    Small Business31%
    Large Enterprise69%
    VISITORS READING REVIEWS
    Small Business15%
    Midsize Enterprise10%
    Large Enterprise75%
    REVIEWERS
    Small Business26%
    Midsize Enterprise15%
    Large Enterprise59%
    VISITORS READING REVIEWS
    Small Business14%
    Midsize Enterprise9%
    Large Enterprise76%
    Buyer's Guide
    Black Duck vs. Sonatype Lifecycle
    March 2024
    Find out what your peers are saying about Black Duck vs. Sonatype Lifecycle and other solutions. Updated: March 2024.
    765,386 professionals have used our research since 2012.

    Black Duck is ranked 1st in Software Composition Analysis (SCA) with 16 reviews while Sonatype Lifecycle is ranked 5th in Software Composition Analysis (SCA) with 42 reviews. Black Duck is rated 7.8, while Sonatype Lifecycle is rated 8.4. The top reviewer of Black Duck writes "Enables applications to be secure, but it must provide more open APIs". On the other hand, the top reviewer of Sonatype Lifecycle writes "Seamless to integrate and identify vulnerabilities and frees up staff time". Black Duck is most compared with Snyk, Fortify Static Code Analyzer, JFrog Xray, Mend.io and Veracode, whereas Sonatype Lifecycle is most compared with SonarQube, Fortify Static Code Analyzer, GitLab, Checkmarx and Mend.io. See our Black Duck vs. Sonatype Lifecycle report.

    See our list of best Software Composition Analysis (SCA) vendors.

    We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.