Nexus Intelligence vs Black Duck - Open Source Security Intelligence Side-by-Side Comparison - December 2018

Aug 23, 2026

Large-utility security and application architecture teams evaluated open source risk management tooling by running side-by-side scans on a production application using Sonatype Nexus Intelligence and Black Duck. The comparison quantified component identification and vulnerability accuracy, highlighting tradeoffs between true positives and false positives/false negatives. Results show both tools found nearly all true positives, while Black Duck produced false positives and duplicate vulnerability noise and missed more version-precise detections, reducing actionable remediation focus across the SDLC.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

The Challenge

Proof of Concept Setup

Summary Report Card

Results at a Glance

The Result

Component and Vulnerability Accuracy

False Positives and Version Precision

Broad Scope and False Recognition

Breakdown of Black Duck False Positives

Open Source Security Intelligence is NOT Created Equal A SIDE-BY-SIDE COMPARISON OF COMPETITORS VS. NEXUS The Challenge The application architecture team within a large publicly traded utility company was investigating tools to help them automatically manage security risk associated with open source software components and third-party libraries. Specifically, the company wanted a solution that could help them rapidly identify and remediate application security risks across their entire SDLC whenever new open source vulnerabilities are publicly disclosed. To evaluate potential partners, the company invited Sonatype and Black Duck to participate in a technical proof of concept by scanning one of their production applications. The company then compared the results of the scans side-by-side in order to determine which technology provided the most accurate results. This document provides a detailed summary of what the company found when comparing the accuracy of Nexus Intelligence versus Black Duck. Summary Report Card: Nexus Intelligence vs Black Duck – December 2018 | | Nexus Intelligence | Black Duck | | --- | --- | --- | | Total Components Identified | 154 | 159 | | Correctly Identified (True Positives) | 148 | 148 | | Vulnerabilities Falsely Identified (False Positives) | 0 | 7 | | Vulnerabilities Not Recognized (False Negatives) | 0 | 20 | | Final Grade | A+ | D | The Result In an initial comparison of Sonatype’s scan to the Black Duck scan, the number of components identified were nearly equal. However, upon a closer look, the utility company discovered material differences in the vulnerabilities reported and, most importantly, the overall quality of data. The category of the differences fell into two categories: A competitor scan versus Nexus Lifecycle 2 1. False Positives – most related to the same vulnerability. False positives are common in many security tools, and the bane of software engineers and security. False positives are reports of vulnerabilities where none exist. In open source security, this occurs most often when the vendor poorly matches components and misidentifies a secure component as a similar (vulnerable) component or incorrectly identifies which versions of a component were subject to a vulnerability. The Black Duck scan did find seven vulnerabilities that were not highlighted in the Sonatype scan. Initially, the utility company felt that by not identifying the same list of potential vulnerabilities Black Duck did, Sonatype had somehow failed to report something meaningful. However, digging past the surface, the case wasn’t that Sonatype failed to identify those potential vulnerabilities, they came up in the scan. However, they were noise at the version level the utility company was using and therefore, were left out of the software Bill of Materials. Further to the point, Sonatype noted that five of the seven vulnerabilities reported on the Black Duck scan were duplicate copies of vulnerability CVE-2017-7525 and were listed in an attempt to cover all use cases. While this is useful for research, it is important to note that with more precise data, it’s possible to report only the correct version range and classes, creating more actionable and focused scan results. The bottom line? Sonatype found the same potential vulnerabilities, but precise data applied to the utility company’s specific code base eliminated noise from the Nexus scan. Unfortunately, with duplicate false positives that are presented as entirely new vulnerabilities, the utility company’s developers would likely spend their valuable time researching and attempting to upgrade components that did not actually pose a threat, in this case, five times over. More inconceivably, the development team may be asked to chase down duplicate false positives when real threats (false negatives) exist in the code base but were not detected by the Black Duck scan. In contrast, as a result of Sonatype’s curated, a

FAQs

What was the utility company trying to achieve with the tool evaluation?

The team needed a solution to automatically manage security risk for open source software components across the SDLC. It aimed to rapidly identify and remediate application security risks when new public vulnerabilities were disclosed.

How did Nexus Intelligence and Black Duck compare on true positives and total components?

The scan identified 154 components with Nexus Intelligence and 159 with Black Duck. Both tools correctly identified 148 true positives, indicating similar effectiveness at recognizing real vulnerable conditions.

Why did the company consider Black Duck’s results less actionable?

Black Duck reported vulnerabilities falsely, including duplicates presented as entirely new issues and version mismatches. These false positives and duplicates would drive developers to spend time investigating and upgrading components that were not actually a threat.

Aug 23, 2026

Uploaded by Felix Montgomery