Vigilance vs Black Duck
Black Duck. Lists the open source parts inside your software and flags the ones with known bugs.
Vigilance. Compares your last version against the new one and says what the new one can suddenly do.
Side by side
| Question | Black Duck | Vigilance |
|---|---|---|
| Finds a part with a known bug | Yes | No |
| Lists every part in a release | Yes | No |
| Spots a brand new file that can run commands | No | Yes |
| Spots a file that can suddenly do more than before | No | Yes |
| Watches a computer that is already running | No | Yes |
| Works with no internet | Needs updates | Yes |
Which one do you need?
Use both. Black Duck finds problems somebody already reported. A brand new attack has no report on the day it ships, and that is the one Vigilance catches.
Try it on your own software.
Show it the version you run today and the one you are about to install.