The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →UltraViolet Cyber announced on September 4, 2025, that it acquired Black Duck’s Application Security Testing (AST) services business—not Black Duck itself or its software portfolio. The deal brings penetration testing, red teaming, threat modeling, cloud and container risk assessments, architecture risk analysis, and secure software development consulting into UltraViolet’s security operations portfolio.
What UltraViolet acquired
The transaction covers Black Duck’s AST services business. UltraViolet said the services were integrated into its unified security operations portfolio, expanding its work around multi-cloud workloads, DevSecOps pipelines, and containerized deployments. The company said the services are intended to help public- and private-sector clients identify software risks before production issues; the announcement did not provide independent measurements of customer outcomes. UltraViolet’s September 4, 2025 announcement lists these capabilities:
- Penetration testing and red teaming
- Threat modeling
- Cloud and container risk assessments
- Architecture risk analysis
- Secure software development consulting
UltraViolet CEO Ira Goldstein said, “Building security in early, not bolting it on later, is essential to combating sophisticated threats.” This describes the company’s rationale for the expansion, not an independently measured result of the acquisition.
What remains with Black Duck
The transfer was limited to services. UltraViolet’s announcement said Black Duck would continue offering its software and SaaS products, while continuing professional and managed services through its partnership with UltraViolet. Black Duck said it would focus on its core software and SaaS business.
#1 Best Overall
Black Duck’s October 2024 portfolio list included the Polaris SaaS Platform, Coverity Static Analysis, Black Duck Software Composition Analysis (SCA), WhiteHat Continuous Dynamic Analysis, Seeker Interactive Analysis, and Defensics Protocol Fuzzing, alongside security testing, consulting, and audit services. The September 2025 announcement distinguishes the transferred AST services business from this continuing software and SaaS portfolio. Black Duck’s October 2024 announcement described the company’s launch as an independent application security business.
Black Duck CEO Jason Schmitt said the move would let customers continue receiving security testing services and provide greater scale, scope, and specialization through UltraViolet. That is the company’s stated expectation, rather than a published comparison of service quality or performance before and after the transaction.
Why Black Duck had become independent
Black Duck became an independent application security company in October 2024, when Clearlake Capital and Francisco Partners completed their acquisition of Synopsys’ Software Integrity Group. The buyers announced a value of up to $2.1 billion, including up to $475 million in contingent consideration tied to specified investor returns in connection with one or more liquidity transactions. Those figures describe the 2024 Synopsys transaction, not UltraViolet’s 2025 acquisition. The buyers’ completion announcement gives the terms they disclosed.
Was a purchase price disclosed?
No purchase price or other financial terms for UltraViolet’s 2025 acquisition were disclosed in the announcement reviewed. The up-to-$2.1 billion value and up-to-$475 million contingent amount belong to the separate 2024 acquisition of Synopsys’ Software Integrity Group; they should not be treated as the price UltraViolet paid for Black Duck’s AST services business.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #3
What the announcement does—and does not—establish
The announcement establishes the scope of the acquired services and how the companies described the portfolio arrangement. It does not establish how many customers or employees transferred, quantify financial terms, or report independent results from the acquisition. Black Duck’s October 2024 announcement also cited “seven consecutive years” in Gartner’s Magic Quadrant for Application Security Testing, referring to Black Duck’s stated recognition history—not the performance of this deal.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
