Home / Agents / Black Duck Signal (agentic AI AppSec)

Black Duck Signal (agentic AI AppSec)

Name: Black Duck Signal (agentic AI AppSec)
Availability: OnlineOnly
Author: Black Duck

Vendor: Black Duck · HQ: United States · Category: Code security · Security

Last verified 18 Oct 2026 · Added 18 Oct 2026 · 4 sources · How we verify

Visit official site (opens in new tab) Claim this listing

Vendor? Get your “Listed on Agent Index” badge

What it does

Black Duck (Burlington, Massachusetts) announced general availability of Black Duck Signal on March 23, 2026, describing it as an agentic AI application security solution purpose-built to secure AI-generated code in autonomous development workflows. Signal's product page says role- and task-based agents find and fix security issues and defects in human- and AI-generated code, built-in exploitability analysis removes false positives and low-risk findings, and developers or coding assistants can review and apply verified fixes before check-in. Analysis is LLM-based and language-agnostic (COBOL to Rust) and is checked against Black Duck's ContextAI knowledge base of human-curated security intelligence. Signal connects to AI coding assistants such as Claude Code, Google Gemini and GitHub Copilot through MCP so scans can be triggered by natural-language prompts. Pricing is not published.

Frameworks

No framework tags verified yet.

Government authorizations

Registry records checked 2026-10-18. Scope “listing” means the certified product is this listing or the government boundary it already documents; “platform-only” means another product line is certified and the vendor does not state this agent is inside that boundary.

Program	Product	Status	Scope	Source
TX-RAMP	Black Duck Polaris · Level 2 · TX1910179 · expires 2029-06-23	Level 2	Vendor platform; agent scope not stated	Registry

Pricing (as published)

Not published

Tasks

appsecsastremediationvulnerability-management

Sources

Last verified 18 Oct 2026. Framework tags indicate relevance, not certification; “vendor-claimed” items are as marketed by the vendor. Spotted an error? Submit a correction or email sales@heritageservices.online. See our methodology.

Not legal or audit advice. Confirm current pricing, framework coverage and India-regulatory claims with the vendor before purchasing.

Use-case comparisons

AI code security agents — 20 verified listings (Application security scanning, suggested or automated code fixes, and pull-request security review)

Compare Black Duck Signal (agentic AI AppSec) with

Alternatives

Aikido AI AutoFix — Aikido AutoFix turns SAST, SCA, IaC, container, pentest and AI code-audit findings into reviewable pull requests or IDE patches. Vendor is Belgium-founded with a Ghent European HQ.
Amazon Q Developer security scanning — Amazon Q Developer code reviews that scan for SAST issues, secrets, IaC misconfigurations, quality issues, deployment risks and SCA, with some in-IDE suggested fixes.
Checkmarx One Assist — Family of agentic AppSec agents on Checkmarx One (Developer Assist in the IDE, plus triage/remediation). Checkmarx Ltd’s registered office is Ramat Gan, Israel.
Claude Code security review — Anthropic automated security review in Claude Code: the /security-review command and the anthropics/claude-code-security-review GitHub Action for pull-request comments.
Codacy AI Reviewer — Hybrid AI pull-request reviewer from Codacy (Lisbon). Combines static analysis with LLM context; vendor pages include security-vulnerability feedback and suggested fixes.
Cursor Bugbot — Cursor’s AI pull-request reviewer. Official docs say it identifies bugs, security issues and code-quality problems and comments with explanations and suggested fixes.

See all Black Duck Signal (agentic AI AppSec) alternatives →

Stay updated

We use your email only to send the newsletter. See our privacy policy.