Anyone switched from Black Duck to Semgrep for SCA?

Having recently completed a technical evaluation and subsequent migration for our organization, I can provide a detailed breakdown of our rationale, process, and key observations. Our primary drivers were cost, performance in CI/CD, and a desire for a more unified view of security findings (shifting from a purely license-compliance-focused SCA to one that incorporates security vulnerabilities more holistically).

Our stack is Kubernetes-native, with pipelines built on GitLab CI and a strong emphasis on infrastructure-as-code using Terraform. Our initial setup utilized Black Duck (via Synopsys Detect) integrated into our CI pipelines and a separate instance for periodic scans.

### Primary Motivations for the Switch

* **Cost Structure:** Black Duck's licensing model, based on a "number of applications" and user seats, became prohibitive as we embraced microservices. Each service, while small, counted as an application. Semgrep's pricing, based primarily on scan volume or committers, aligned better with our high-volume, ephemeral workload model.
* **CI/CD Performance:** Black Duck scans, particularly the full "signature scan" mode, were a significant bottleneck. Scan times for moderately complex projects could extend to 25-30 minutes. Semgrep's SCA engine, which leverages a curated database and focused matching, typically completes in 2-4 minutes for the same project.
* **Tool Consolidation:** We were already evaluating Semgrep SAST for first-party code analysis. Adopting Semgrep SCA allowed us to receive a unified findings list (SAST and SCA) in a single output format (SARIF, JSON) and manage everything through a single `.semgrep.yml` policy file. This reduced pipeline complexity and alert fatigue for developers.
* **Actionability:** Black Duck's output, rich for legal teams, often overwhelmed developers with license details. Semgrep's default rulesets are more security-focused, prioritizing known exploitable vulnerabilities (e.g., using the Reachability and Known Exploit rules). This led to a higher signal-to-noise ratio for our AppSec and SRE teams.

### Technical Implementation Notes

The migration involved several phases:

1. **Policy Translation:** We mapped our Black Duck policies (blocking on critical CVEs, certain prohibited licenses like AGPL) to Semgrep rules. Semgrep's rule syntax is YAML-based and quite transparent. For example, a simple license rule:

```yaml
rules:
- id: block-agpl-license
patterns:
- pattern: |
$PKG
- metavariable-regex:
metavariable: $PKG
regex: "(agpl|affero)"
message: "Package uses AGPL or Affero license which is prohibited by policy."
languages: [yaml]
severity: ERROR
paths:
include:
- "**/package.json"
- "**/pyproject.toml"
- "**/go.mod"
```

2. **Pipeline Integration:** We replaced the Black Duck scan step with a Semgrep step. The GitLab CI `.gitlab-ci.yml` change was significant in its simplicity:
```yaml
# Before (Black Duck)
blackduck_scan:
image: docker.io/blackducksoftware/synopsys-detect:latest
script:
- bash <(curl -s https://detect.synopsys.com/detect.sh) --blackduck.url= --blackduck.api.token= --detect.project.name="$CI_PROJECT_NAME" --detect.project.version="$CI_COMMIT_SHA" --detect.policy.check.fail.on.severities=BLOCKER

# After (Semgrep)
semgrep_scan:
image: semgrep/semgrep:latest
script:
- semgrep scan --config p/security-audit --config p/secrets --config p/dependency-audit --sarif > semgrep-report.sarif
artifacts:
reports:
sarif: semgrep-report.sarif
```

3. **Deduplication and Triage:** We used the Semgrep App (cloud) to centrally manage findings, suppress known false positives, and track metrics. This replaced Black Duck's Hub.

### Key Trade-offs and Considerations

* **License Database Breadth:** Black Duck's proprietary database is arguably more comprehensive for license discovery, especially for obscure or custom licenses. Semgrep relies on the OSV database and curated sources, which has been sufficient for our needs but is a point to validate.
* **Binary and Container Scanning:** Black Duck's ability to scan binaries and container images for embedded dependencies is more mature. While Semgrep can scan containers via `semgrep scan --config p/dependency-audit docker://image:tag`, our evaluation found it less exhaustive for deeply nested, unpackaged dependencies.
* **Remediation Guidance:** Semgrep often provides more immediate, actionable upgrade paths within its CLI output. Black Duck's remediation advice is sometimes more general.

### Outcome and Metrics

Post-migration, we observed:
* A 75-85% reduction in SCA scan time within pipelines.
* A 40% reduction in total tooling costs for SAST+SCA.
* Increased developer engagement with security findings due to the consolidated, less noisy report format.
* A slight increase in initial false positives for license detection, which was manageable via rule tuning in the Semgrep App.

For organizations whose SCA needs are strongly driven by software bill of materials (SBOM) generation for strict legal compliance, Black Duck may still hold an edge. However, for cloud-native teams prioritizing CI/CD speed, cost efficiency, and a developer-centric security posture that unifies SAST and SCA, Semgrep presents a compelling alternative.