Black Duck Software Composition Analysis (SCA) vs. TransUnion TruValidate

If you are using a lot of open-source libraries, which is most likely, this is a must-have to ensure no known vulnerabilities slip into production

Incentivized

Neustar IP Intelligence is quick to deploy using their REST API, the data is automatically updated against one of the most robust datasets available on the market. It is well suited for developers trying to integrate with an out-of-the-box solution to lookup geolocation of website visitors in real time, and possibly build alerts or 2F-Authentication mechanisms based on suspicious activity.

Incentivized

• Quick inventory scan: Black Duck helps us scan the code repositories in no time. And quickly list the components and I now really know what is in my code.
• Security and License risk management: Black Duck being rich in its knowledge base about the vulnerabilities and license issues of open source components, quickly compares the identified inventory to the Black Duck knowledge base and lists all the vulnerabilities and license issues in the code.
• Integration for automatic scanning: Black Duck is part of devops which provides us automatic scanning. Black Duck is not just for devops but also SecOps.

Incentivized

• Helps detect fraud if a user has signed in from California only, then attempts to login from another country are made.
• Increase sales conversions by understanding geolocation of website visitors
• If your datacenters are georedundant, allows engineers to see where majority of traffic is generated and load balance accordingly.

Incentivized

• License model based on usage is costly.
• Documentation is extensive, but often confusing.
• Black Duck Hub could use some feature improvements for more robust governance capabilities

Incentivized

• It's a bare box solution. Not feature rich.

Incentivized

If you don’t know how to scan for the language, it isn’t entirely user friendly

Incentivized

Support seems very responsive.

Incentivized

Black Duck is an obvious choice, with its versatility, integration, best enterprise support and on top of the list the knowledge base Black Duck has. Vega or Grabber also scans the application and tells about vulnerabilities. But it can never be compared with the feature set of Black Duck. Black Duck can also generate reports.

Incentivized

Google has an open source version of this, but its updates are based on the user community. Since Neustar's IP Intelligence is a paid solution, the updates are regular, the interface is streamlined with a REST API, and there is a help desk you can consult for onboarding and questions if there are issues.

Incentivized

• It is hard to measure ROI since Black Duck Hub saves us from costly legal battles that have thankfully never had to happen.

Incentivized

• Ability to build fraud detection from suspicious activities.
• Balance traffic across data centers.
• Rapid deployment, regular updates.

Incentivized