Black Duck vs GitLab comparison

Black Duck and GitLab are both solutions in the Software Composition Analysis (SCA) category. Black Duck is ranked #1 with an average rating of 7.6, while GitLab is ranked #5 with an average rating of 8.4. Black Duck holds a 22.9% mindshare in SCA, compared to GitLab’s 4.6% mindshare. Additionally, 83% of Black Duck users are willing to recommend the solution, compared to 97% of GitLab users who would recommend it.

Black Duck

Read 20 Black Duck reviews

12,558 Views
8,223 Comparison Views

83% willing to recommend

GitLab

Read 80 GitLab reviews

2,179 Views
1,865 Comparison Views

97% willing to recommend

Black Duck

GitLab

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 5, 2024

Black Duck and GitLab are key players in software development security and management. GitLab is favored for its extensive feature set, while Black Duck is notable for its effective support.

Features: Black Duck offers comprehensive open source vulnerability scanning, detailed risk reporting, and license compliance management. GitLab provides a robust CI/CD pipeline, efficient version control, and comprehensive DevOps tools.

Room for Improvement: Black Duck could enhance its user interface and streamline integration with newer platforms. More frequent updates and enhanced automation capabilities are desirable. GitLab may improve its documentation for beginners and could expand its feature set for more advanced uses. There may also be a need to enhance the freemium tier features.

Ease of Deployment and Customer Service: Black Duck offers seamless integration with existing workflows and effective customer support. GitLab's straightforward deployment capitalizes on its unified platform, providing intuitive tools for collaboration and development.

Pricing and ROI: Black Duck's pricing is competitive with effective returns in security management. GitLab, while having a higher initial investment, offers substantial ROI through enhanced development productivity and long-term value.

To learn more, read our detailed Black Duck vs. GitLab Report (Updated: December 2024).

Buyer's Guide

Black Duck vs. GitLab

December 2024

Download the complete report

Helped 824,053 peers since 2012

Categories and Ranking

Black Duck

Ranking in Software Composition Analysis (SCA)

1st

Average Rating

7.6

Reviews Sentiment

7.2

Number of Reviews

Ranking in other categories

No ranking in other categories

GitLab

Ranking in Software Composition Analysis (SCA)

5th

Average Rating

8.6

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Application Security Tools (11th), Build Automation (1st), Release Automation (2nd), Static Application Security Testing (SAST) (10th), Rapid Application Development Software (13th), Enterprise Agile Planning Tools (2nd), Fuzz Testing Tools (2nd), DevSecOps (3rd)

Mindshare comparison

As of December 2024, in the Software Composition Analysis (SCA) category, the mindshare of Black Duck is 22.9%, down from 23.6% compared to the previous year. The mindshare of GitLab is 4.6%, down from 5.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Featured Reviews

Saravanan_Radhakrishnan

Senior Manager at Happiest Minds Technologies

Enables applications to be secure, but it must provide more open APIs

The product enables other applications to be secure. We use it to onboard 400 to 500 applications into the DevOps platform, protect them, and have a secure environment. The tool integrates well with different technologies, application stacks, and databases. The APIs are available. We can read the blogs in the community for open-source compliance and security. The community feeds are important. Black Duck is a leader in Gartner. It is a reliable solution.

Read full review

Corné den Hollander

Product Owner at a financial services firm with 1,001-5,000 employees

Powerful, mature, and easy to set up and manage

It's more related to the supporting layer of features, such as issue management and issue tracking. We tend to always use, for example, Jira next to it. That doesn't mean that GitLab should build something similar to Jira because that will always have its place, but they could grow a bit in those kinds of supporting features. I see some, for example, covering ITSM on a DevOps team level, and that's one of the things that I and my current client would find really helpful. It's understandably not going to be their main focus and their core, and whenever you are with a company that needs a bit more advanced features on that specific topic, you're probably still going to integrate with another tool like Jira Service Management, for example. However, some basic features on things like that could be really helpful. In terms of additional features, nothing comes to mind. One of the potential pitfalls is to keep adding new features and functionalities. They can just improve some of the existing features to make it high-end, top-quality. I don't have any substantial experience with agile planning. I don't know the industries GitLab is in, and I don't know why they make decisions like this, but as a customer, I would rather see them invest in improving the basic agile planning functionalities rather than adding, for example, portfolio planning features. That's because if I'm going to do portfolio planning, I probably will also need a lot of business users. I'm not sure if I want them in GitLab, I'd rather have them in Jira collaborating with me on portfolio planning. That's way better fitted for that type of work.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The solution is stable."

"The knowledge base and the management system are the most valuable features of Black Duck Hub. It has a very helpful management environment. They offer an editor where we can check the discovered license, which is retrieved from their knowledge base. They have a huge knowledge base build over the years. It gives you some possibilities, such as this license with possibility A could cause a vulnerability issue or a potential breach."

"We didn't have a central inventory to quickly identify issues or determine how many products were affected. Now under Black Duck, it's all consolidated. You search for a component and immediately see which products use it."

"The software composition analysis is most effective for security risk management."

"The cloud option of the product is always available and a positive aspect of the solution."

"Black Duck is pretty extensive in terms of the scan reserves and the vulnerability exposures. From that perspective, I'm happy with it."

"The solution works well on Mac products."

"The solution is very good at scanning and evaluating open source software."

More Black Duck pros

"The most valuable aspects of GitLab are the ability to create branches, merge branches, and compare branches to resolve code conflicts."

"The important feature is the entire process of versioning source code maintenance and easy deployment. It is a necessity for the CI/CD pipeline."

"The solution's most valuable features are pipelines."

"GitLab is very useful for pipelines, continuous integration, and continuous deployment. It is also stable."

"GitLab is kind of an image of GitHub, so it gives us the flexibility to monitor our changes in the repos."

"The merging feature makes it easy later on for the deployment."

"Everything is easy to configure and easy to work with."

"The stability of GitLab is impressive."

More GitLab pros

Cons

"It needs to be more user-friendly for developers and in general, to ensure compliance."

"I would like to see improvements in Black Duck's reporting capabilities."

"The tool needs to improve its pricing. Its configuration is complex and can be improved."

"It is a cloud-only solution. In many cases, companies like to evaluate the software, but they're very reluctant to give you the software. It would be great if they could offer an on-prem component that could be used to scan the code and then upload the discovery results to the cloud and get all the information from there, but there is no such possibility. You have to upload the code to the Black Duck cloud system. Of course, they have a strong legal department, and they offer some configuration, but it is never enough. You have to give the code, which is a drawback. In modern designs like Snyk or FOSSA, you don't need to give the code. It requires more native integration with Coverity because they go together technically. You need both Coverity and Black Duck Hub. It would be really helpful for companies working in this space to get a combined offer from the same company. They should provide an option to buy Coverity for an additional fee. Coverity combined with Black Duck Hub will provide a one-step analysis to get everything you need and a unified report. It would be really great to be able to connect Black Duck Hub with Coverity unified reports."

"It can be cumbersome to use or invalidate open source software because there is a hold time to check requirements or common regulations to ensure compliance."

"Black Duck can improve the time it takes for a scan. Most of the time it's not ideal when integrated with the live DevSecOps pipeline. We have to create a separate job to scan the library because it takes a couple of hours to scan all those libraries. The scanning could be faster."

"The solution must provide more open APIs."

"The documentation is quite scattered."

More Black Duck cons

"The solution should again offer an on-premises deployment option."

"There is room for improvement in GitLab Agents."

"We are having a few problems integrating with Jira at the moment, which is something that our IT department is investigating."

"GitLab doesn't have AWS integration. It would be better to have integration with other container management environments beyond Kubernetes. It has very good integration with Kubernetes, but it doesn't have good integration with, for example, AWS, ETS, etc."

"I would like to see static analysis also embedded in GitLab. That would also help us. If there's something that it does internally by GitLab and then that is already tied up with your pipeline and then it can tell you that you're coding is good or your code is not great. Based on that, it would pass or fail. That should be streamlined. I would think that would help to a greater extent, in terms of having one solution rather than depending on multiple vendors."

"GitLab should enhance its GitOps capability as they are currently using FluxCD, however, Argo CD is better and offers more features. GitLab should work on improving their user interface for GitOps as it is lagging behind."

"We do face issues in our company when we run out of disk space."

"The solution should be more cloud-native and have more cloud-native capabilities and features."

More GitLab cons

Pricing and Cost Advice

"The pricing is a little high."

"The price is low. It's not an expensive solution."

"The price is quite high because the behavior of the software during the scan is similar to competing products."

"Depending on the use case, the cost could range from $10,000 USD to $70,000 USD."

"The price charged by Black Duck is exorbitant."

"It is expensive."

"Black Duck is more suitable if you require a lot of licensing compliance. For smaller organizations, WhiteSource is better because its pricing policies are not really suitable for huge organizations."

"I rate the product's price one on a scale of one to ten, where one is a high price, and ten is a low price."

"The solution is free."

"It is very expensive. We can't bear it now, and we have to find another solution. We have a yearly subscription in which we can increase the number of licenses, but we have to pay at the end of the year."

"GitLab is cheap."

"The price is okay."

"My company uses the free version of GitLab, which is GitLab Community Edition. There is a licensed version also available for GitLab."

"GitLab is a free solution to use."

"In terms of the pricing for GitLab, on a scale of one to five, with one being expensive and five being cheap, I'm rating pricing for the solution a four. It could still be cheaper because right now, my company has a small team, and sometimes it's difficult to use a paid product for a small team. You'd hope the team will grow and scale, but currently, you're paying a high license fee for a small team. I'm referring to the GitLab license that has premium features and will give you all features. This can be a problem for management to approve the high price of the license for a team this small."

"There are different licensing options available, including a free limited-user license."

More GitLab pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

824,053 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

20%

Manufacturing Company

17%

Computer Software Company

14%

Healthcare Company

Educational Organization

29%

Computer Software Company

11%

Financial Services Firm

11%

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How does WhiteSource compare with Black Duck?

We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license compl...

See all answers

What do you like most about Black Duck?

The cloud option of the product is always available and a positive aspect of the solution.

See all answers

What is your experience regarding pricing and costs for Black Duck?

The price charged by Black Duck is exorbitant. For the features provided by the product, I would not want to pay a high price. There are many other products in the market that offer better features...

See all answers

What do you like most about GitLab?

I find the features and version control history to be most valuable for our development workflow. These aspects provide us with a clear view of changes and help us manage requests efficiently.

See all answers

What is your experience regarding pricing and costs for GitLab?

GitLab is mostly free, with potential costs arising from upgrade versions. There is a trial period of about six months during which it is free. Afterward, fees apply.

See all answers

What needs improvement with GitLab?

There are some challenges with repository file management as GitLab may struggle to manage larger files. Improvements could be made regarding size management and file partitioning. Also, the UI has...

See all answers

Comparisons

Snyk vs Black Duck

Compared 20% of the time

Fortify Static Code Analyzer vs Black Duck

Compared 19% of the time

JFrog Xray vs Black Duck

Compared 14% of the time

Mend.io vs Black Duck

Compared 9% of the time

FlexNet Code Insight vs Black Duck

Compared 2% of the time

More Black Duck Competitors

Microsoft Azure DevOps vs GitLab

Compared 39% of the time

SonarQube Server (formerly SonarQube) vs GitLab

Compared 8% of the time

GitHub CoPilot vs GitLab

Compared 8% of the time

AWS CodePipeline vs GitLab

Compared 5% of the time

Sonatype Lifecycle vs GitLab

Compared 1% of the time

More GitLab Competitors

Product Reports

Buyer's Guide

Black Duck

December 2024

Download Black Duck product report

Buyer's Guide

GitLab

December 2024

Download GitLab product report

Also Known As

Blackduck Hub, Black Duck Protex, Black Duck Security Checker

Fuzzit

Learn More

Black Duck

GitLab

Overview

Organizations use Black Duck for compliance, internal audits, license management, and security, scanning software to identify vulnerabilities, non-compliant code, and dependencies in open-source projects.

Black Duck integrates into CI/CD pipelines and DevSecOps processes, helping multiple industries detect and handle risks associated with open-source usage. Users leverage it for source and binary analysis to ensure security and compliance before software release. Automatic component analysis, effective vulnerability scanning, and a comprehensive knowledge base are some of its valuable features. Despite needing improvements in scanning speed, UI, and documentation, Black Duck remains crucial for ensuring open-source security and compliance.

What are Black Duck's most important features?

Automatic Component Analysis: Provides automatic identification and analysis of open-source components.
Effective Vulnerability Scanning: Scans for vulnerabilities in both source code and binary files.
Comprehensive Knowledge Base: Offers expansive information on open-source components.
Policy Management: Enables the creation and enforcement of security and compliance policies.
Binary File Scanning: Capable of scanning binary files for in-depth security checks.
Ease of Use: Demonstrates ease of use, particularly on Mac products.
Stability: Known for its stable performance.
Docker Integration: Smooth integration with Docker for enhanced deployment.
Open-source Evaluation: Excellent evaluation capabilities for open-source software.
License Management: Manages open-source licenses effectively.
Easy Installation: Simple installation process.
Secure Onboarding: Ensures secure application onboarding.
API Availability: Provides APIs for custom integrations.
Community Support: Backed by an active community.
Dependency Tree Visualization: Visualizes dependencies for better management.

What benefits or ROI should users look for in reviews?

Improved Compliance: Helps maintain compliance with legal and regulatory requirements.
Risk Mitigation: Reduces risks associated with open-source vulnerabilities.
Enhanced Security: Strengthens software security by identifying and addressing potential issues early.
Time-saving: Automates many aspects of vulnerability scanning and analysis, saving valuable time.
Cost Efficiency: Detects issues early, potentially saving costs related to compliance breaches and security incidents.
Integration Ease: Seamlessly integrates with existing CI/CD pipelines and DevSecOps practices.
Knowledge Resource: Access to comprehensive information aiding better decision-making.

Black Duck is implemented by industries ranging from finance to healthcare, addressing security and compliance in open-source usage. Financial institutions employ it to manage license risks and ensure audit readiness. Healthcare organizations use it to comply with stringent data protection regulations, ensuring patient data security and privacy. Tech companies integrate Black Duck within CI/CD pipelines to maintain the security and compliance of software products before release. Its deployment varies, tailored to meet the specific risk management and compliance needs dictated by each sector's regulatory environment.

GitLab is a complete DevOps platform that enables teams to collaborate and deliver software faster.

It provides a single application for the entire DevOps lifecycle, from planning and development to testing, deployment, and monitoring.

With GitLab, teams can streamline their workflows, automate processes, and improve productivity.

Sample Customers

Samsung, Siemens, ScienceLogic, BryterCX, Dynatrace

1. NASA 2. IBM 3. Sony 4. Alibaba 5. CERN 6. Siemens 7. Volkswagen 8. ING 9. Ticketmaster 10. SpaceX 11. Adobe 12. Intuit 13. Autodesk 14. Rakuten 15. Unity Technologies 16. Pandora 17. Electronic Arts 18. Nordstrom 19. Verizon 20. Comcast 21. Philips 22. Deutsche Telekom 23. Orange 24. Fujitsu 25. Ericsson 26. Nokia 27. General Electric 28. Cisco 29. Accenture 30. Deloitte 31. PwC 32. KPMG

Buyer's Guide

Black Duck vs. GitLab

December 2024

Free Report: Black Duck vs. GitLab

Find out what your peers are saying about Black Duck vs. GitLab and other solutions. Updated: December 2024.

DOWNLOAD NOW

824,053 professionals have used our research since 2012.

See our Black Duck vs. GitLab report.

See our list of best Software Composition Analysis (SCA) vendors.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.