The DerScanner system helps our customers ensure that the security of the apps they create are exhaustively checked end-to-end for security vulnerabilities both obvious, and non obvious in a thorough and comprehensive way. DerScanner discovered potential weaknesses that would have been difficult or even impossible to find, even in long-standing, mature code.
Ian BarkerDeveloper Advocate, Embarcadero TechnologiesSAST, DAST, SCA, MAST
SAST, SCA, DAST, IAST
DerScanner runs static analysis on .exe, .dll, .apk and .ipa files to find vulnerabilities in the code itself. Black Duck Binary Analysis identifies open source components and their known CVEs.
These languages, together with PL/SQL and T-SQL, do not appear in Black Duck static analysis language lists.
DerScanner vs Black Duck
DerCodeFix decompiles the archive, pinpoints the vulnerable call and proposes safer code, with alternative versions on request.
43 supported languages let one tool cover mainframe, SAP, desktop and cloud-native code.
Old .exe and .dll builds, and applications from vendors that no longer exist, are scanned as compiled files.
DerScanner treats obfuscated fragments as analyzable code and reports undocumented features found inside them.
Scores for credibility, authorship, popularity and community response speed accompany each open source component.
DerTriage explains why each finding is real or false, and the explanation is stored with the result. The agent runs offline on DerScanner servers.
SQL injection in LEDGER.cbl:210
TRUE POSITIVEAn input field is concatenated into a dynamic EXEC SQL statement.
Sources: Black Duck static analysis languages and frameworks page, September 2026.
| Capability | DerScanner | Black Duck |
|---|---|---|
| AI verification of findings | Yes | Yes |
| AI-generated code fixes | Yes | Yes |
| Capability | DerScanner | Black Duck |
|---|---|---|
| Vulnerability search in source code | Yes | Yes |
| Taint, semantic and control flow analysis | Yes | Yes |
| Undocumented feature search | Yes | No |
| Obfuscated code check | Yes | No |
| ABAP, COBOL, Delphi, PL/SQL, T-SQL, Solidity | Yes | No |
| Fortran, CUDA | No | Yes |
| Capability | DerScanner | Black Duck |
|---|---|---|
| Code-level analysis of JAR, WAR, EAR (Java) | Yes | No |
| Code-level analysis of EXE, DLL (C/C++) | Yes | No |
| Code-level analysis of APK (Android) | Yes | No |
| Code-level analysis of IPA (iOS) | Yes | No |
| Third-party software without source code | Yes | Partialopen source components and known CVEs via Black Duck Binary Analysis |
| Capability | DerScanner | Black Duck |
|---|---|---|
| Transitive dependency analysis | Yes | Yes |
| SBOM file analysis | Yes | Yes |
| License risk coverage | Yes | Yes |
| Reachability analysis | Yes | Yes |
| Dependency tree visualization | Yes | Yes |
| Capability | DerScanner | Black Duck |
|---|---|---|
| Web application DAST | Yes | Yes |
| SAST and DAST correlation | Yes | Yes |
| OpenAPI specification import | Yes | Yes |
| Capability | DerScanner | Black Duck |
|---|---|---|
| Repository, CI/CD and issue tracker integrations | Yes | Yes |
| IDE plugins with inline findings | PartialEclipse, IntelliJ IDEA, Visual Studio plugins, findings outside the editor | Yes |
| Compliance reports (OWASP Top 10, PCI DSS, CWE/SANS) | Yes | Yes |
| Capability | DerScanner | Black Duck |
|---|---|---|
| SaaS | Yes | Yes |
| On-premises | Yes | Yes |
| Installation wizard | No | Yes |
Black Duck and Coverity entries rely on Black Duck public pages and documentation as of September 2026.
Both existing tools continue scanning while projects are set up in DerScanner, so no build ships unchecked.
Plan a migrationThe demo can start from a legacy project and move on to the modern stack.
Prefer email? company@derscanner.com