STMicroelectronics Integrates Black Duck SCA and Coverity for Automated SBOM Generation and Enhanced Software Security

Rhea-AI Summary

STMicroelectronics (NYSE:STM) has implemented Black Duck Software Composition Analysis (SCA) and Coverity Static Analysis to enhance software security and automate SBOM generation for its products, particularly the STM32U3 microcontroller.

The integration aims to comply with the European Cyber Resilience Act (CRA) requirements, which mandate organizations to produce SBOMs and disclose vulnerabilities. The implementation enables STMicroelectronics to generate standardized, machine-readable SBOMs while strengthening its software security practices.

Black Duck, a seven-time Leader in Gartner Magic Quadrant for Application Security Testing, will help STMicroelectronics manage open-source risks and detect security vulnerabilities in proprietary code. The collaboration will be showcased at embedded world 2025 from March 11-13.

Positive

• Enhanced software security capabilities for STM products
• Automated SBOM generation system implementation
• Compliance with new European Cyber Resilience Act requirements
• Partnership with industry leader Black Duck strengthens security offerings

Negative

• None.

Insights

Financial Analyst

STMicroelectronics' integration of Black Duck SCA and Coverity represents a strategic investment in cybersecurity infrastructure that positions the company favorably in the evolving regulatory landscape. The implementation addresses compliance requirements under the European Cyber Resilience Act (CRA), which is increasingly critical for semiconductor companies selling into European markets.

This partnership has three key implications for STM investors: First, it reduces regulatory compliance risk as governments worldwide implement stricter cybersecurity requirements for electronic components. Second, it enhances STM's competitive position in the microcontroller market by enabling the company to offer customers verifiable security credentials – particularly important for applications in automotive, industrial automation, and IoT where security breaches carry significant liability. Third, it potentially reduces long-term development costs by automating previously manual security processes.

While the immediate financial impact isn't quantified, this move aligns with broader industry trends toward secure-by-design principles and should strengthen STM's market position in high-value microcontroller segments where security premiums can be charged. The partnership with a recognized security leader (seven-time Gartner Magic Quadrant Leader) also validates STM's approach to software security, which increasingly differentiates semiconductor providers as software becomes more central to their value proposition.

Cybersecurity Expert

STM's implementation of Black Duck SCA and Coverity reflects an advanced security-first approach that stands out in the embedded systems market. The automatic generation of Software Bills of Materials (SBOMs) addresses a critical gap in supply chain transparency that has historically plagued the semiconductor industry.

The technical significance here extends beyond mere compliance. By implementing these tools specifically for their STM32U3 ultra-low power microcontroller platform, STM is addressing the unique security challenges of resource-constrained devices – a notoriously difficult problem in IoT security. The integration enables continuous monitoring of components for newly discovered vulnerabilities, essential for devices that may remain in the field for a decade or more.

What's particularly notable is STM's focus on standardized, machine-readable SBOM formats, which enables scalable security across their product ecosystem and simplifies customers' security assessment processes. This technical foundation positions STM to better support customers in highly regulated industries like medical devices and critical infrastructure, where component-level security verification is increasingly mandated.

This move represents a competitive advantage as embedded security transitions from a "nice-to-have" feature to a core requirement, especially as regulators worldwide follow Europe's lead in implementing similar requirements to the CRA. STM's early adoption puts them ahead of competitors who will inevitably need to implement similar capabilities.

BURLINGTON, Mass., March 6, 2025 /PRNewswire/ -- Black Duck^® Software, Inc. ("Black Duck"), a leading provider of application security solutions, today announced that STMicroelectronics (NYSE:STM), a global semiconductor leader serving customers across the spectrum of electronics applications, has successfully implemented Black Duck Software Composition Analysis (SCA) to streamline software bill of materials (SBOM) generation and strengthen its software security practices. STMicroelectronics has also adopted Coverity Static Analysis to proactively identify and remediate security vulnerabilities in software components, further strengthening the security posture of embedded software in its microcontroller products.

STMicroelectronics has leveraged Black Duck SCA to automate end-to-end SBOM generation, reinforcing software security for its latest ultra-low power product, the STM32U3 microcontroller.

With the enactment of the European Cyber Resilience Act (CRA), organizations are increasingly required to produce SBOMs and disclose vulnerabilities to improve software transparency and security. Black Duck offers a comprehensive portfolio of application security solutions, including Black Duck SCA for open source risk management and Coverity Static Analysis for finding code quality defects, helping companies address evolving regulatory requirements, and integrating security into their DevSecOps workflows.

"Software-secure development lifecycle has always been a top priority for ST. Thanks to collaboration with a market leader such as Black Duck, we are reinforcing and optimizing our capacity to automatically generate SBOMs in a standardized, machine-readable format," said Jacques Fournier, Director, Security Platform at STMicroelectronics. "Integrating new capabilities into our software development toolbox enables us to create seamlessly comprehensive SBOMs, while by supporting monitoring processes, we can streamline our support to our customers for secure-by-design solutions and comply with new regulations like the EU Cyber Resilience Act."

Black Duck is a seven-time Leader in the Gartner® Magic Quadrant™ for Application Security Testing, a four-time Leader in the Forrester Wave™ for Software Composition Analysis, and a three-time Leader in the Forrester Wave™ for Static Application Security Testing. 

"STMicroelectronics sets an excellent example for how to integrate Black Duck SCA and Coverity seamlessly into their process for CRA compliance," said Jason Schmitt, CEO of Black Duck. "This use case not only automates SBOM generation but also significantly enhances their ability to produce secure, compliant, high-quality products. At Black Duck, we are committed to helping organizations like STMicroelectronics build trust in their software by managing application risks at the speed their business demands."

As a trusted leader in application security testing, Black Duck enables companies to manage open-source risks, detect security vulnerabilities in proprietary code, and align with regulatory expectations such as those outlined in the CRA. With this collaboration, STMicroelectronics is further enhancing its cybersecurity strategy in the microcontroller industry. 

Learn more about the Black Duck portfolio.

To learn more about how STMicroelectronics is using Black Duck solutions to secure the new STM32U3 microcontroller and their other products, visit them in Hall 4A, #148 at embedded world 2025 from 11-13 March.

About Black Duck 
Black Duck®, formerly known as the Synopsys Software Integrity Group, offers the most comprehensive, powerful, and trusted portfolio of application security solutions in the industry. We have an unmatched track record of helping organizations around the world secure their software quickly, integrate security efficiently in their development environments, and safely innovate with new technologies. As the recognized leaders, experts, and innovators in software security, Black Duck has everything you need to build trust in your software. Learn more at www.blackduck.com. 

 

View original content to download multimedia:https://www.prnewswire.com/news-releases/stmicroelectronics-integrates-black-duck-sca-and-coverity-for-automated-sbom-generation-and-enhanced-software-security-302392021.html

SOURCE Black Duck Software

FAQ

What security solutions has STMicroelectronics (STM) implemented for SBOM generation?

STM has implemented Black Duck Software Composition Analysis (SCA) and Coverity Static Analysis for automated SBOM generation and enhanced security vulnerability detection.

How does the Black Duck integration benefit STM's STM32U3 microcontroller?

The integration enables automated SBOM generation and enhanced software security for the STM32U3 microcontroller, ensuring compliance with the European Cyber Resilience Act.

When will STM showcase its Black Duck security integration at embedded world 2025?

STM will showcase the integration at embedded world 2025 from March 11-13 in Hall 4A, booth #148.

How does STM's Black Duck implementation address regulatory compliance?

The implementation helps STM comply with the European Cyber Resilience Act by automating SBOM generation and enabling vulnerability disclosure in a standardized format.