---
title: Vulnerability Response Integration with Black Duck
description: The Vulnerability Response integration with Vulnerability Response Integration with Black Duck uses the data that is imported from the Black Duck Software Composition Analysis \(SCA\) tool to help you determine the impact and priority of the flaws in your code.
locale: en-US
canonical_url: https://www.servicenow.com/docs/r/australia/security-management/application-vulnerability-response/blackduck-integration.html
release: australia
product: Application Vulnerability Response
classification: application-vulnerability-response
topic_type: concept
last_updated: "2026-03-12"
reading_time_minutes: 2
breadcrumb: [Integrate with other applications, Application Vulnerability Response, Unified Security Exposure Management, Security Operations]
---

# Vulnerability Response Integration with Black Duck

The Vulnerability Response integration with Vulnerability Response Integration with Black Duck uses the data that is imported from the Black Duck Software Composition Analysis \(SCA\) tool to help you determine the impact and priority of the flaws in your code.

## Integration overview

With the Vulnerability Response Integration with Black Duck, you can collect SCA and make that data available to the ServiceNow AI Platform. Starting with v22.0.5 of Vulnerability Response, you can import the SCA vulnerabilities data to your instance so that you can identify the vulnerabilities in your software applications. For more information, see [Exploring Software Bill of Materials](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/sbom-core/vr-sbom-exploring.md).

A shared API ingests the Software Composition Analysis \(SCA\) data.

**Note:** Each integration record has a configured run-as user. The default value for this user is VR System. Don’t change this value.

Every day, scheduled jobs invoke the integrations automatically in the order that they’re listed. You can also execute individual scheduled jobs manually. Scheduled jobs simplify the vulnerability remediation life cycle by keeping the instance synchronized with other vulnerability management systems.

## Available versions

|Release version|Release notes|
|---------------|-------------|
|If you intend to upgrade to a version that is compatible with Unified Security Exposure Management \(USEM\), please select a version starting with 30.x when installing or upgrading.|[https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/release-notes/secops-app-vuln-resp-rn.md](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/release-notes/secops-app-vuln-resp-rn.md)|
|If you do not intend to upgrade to a version that is compatible with Unified Security Exposure Management \(USEM\), please select a version below 30.x when installing or upgrading.| |

## User group and roles

The Vulnerability Response Integration with Black Duck is installed by a user with the admin role and is configured by a member of the App-Sec Manager group. For more information, see the [Application Vulnerability Response user groups and roles](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-manage-roles.md).

For integration run statuses, see [View the Vulnerability Response Integration with Black Duck import run status](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown)

To view data in the third-party vulnerabilities, see [View vulnerability libraries](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/application-vulnerability-response/avm-view-vuln-libraries.md).