We performed a comparison between Checkmarx and Coverity based on real PeerSpot user reviews.
Find out in this report how the two Application Security Testing (AST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The most valuable features of Checkmarx are the automation and information that it provides in the reports."
"The only thing I like is that Checkmarx does not need to compile."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results."
"The UI is user-friendly."
"The solution has good performance, it is able to compute in 10 to 15 minutes."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"Apart from software scanning, software composition scanning is valuable."
"It's pretty stable. I rate the stability of Coverity nine out of ten."
"The interface of Coverity is quite good, and it is also easy to use."
"It's very stable."
"I like Coverity's capability to scan codes once we push it. We don't need more time to review our colleagues' codes. Its UI is pretty straightforward."
"The product is easy to use."
"The most valuable feature of Coverity is that it shows examples of what is actually wrong with the code."
"The solution effectively identifies bugs in code."
"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."
"The plugins for the development environment have room for improvements such as for Android Studio and X code."
"Checkmarx could improve the solution reports and false positives. The false positives could be reduced. For example, we have alerts that are tagged as vulnerabilities but when you drill down they are not."
"The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement."
"Checkmarx has a slightly difficult compilation with the CI/CD pipeline."
"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."
"The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform."
"We would like to be able to run scans from our local system, rather than having to always connect to the product server, which is a longer process."
"Checkmarx needs to be more scalable for large enterprise companies."
"We actually specified several checkers, but we found some checkers had a higher false positive rate. I think this is a problem. Because we have to waste some time is really the issue because the issue is not an issue. I mean, the tool pauses or an issue, but the same issue is the filter now.Some check checkers cannot find some issues, but sometimes they find issues that are not relevant, right, that are not really issues. Some customisation mechanism can be added in the next release so that we can define our Checker. The Modelling feature provided by Coverity helps in finding more information for potential issues but it is not mature enough, it should be mature. The fast testing feature for security testing campaign can be added as well. So if you correctly integrate it with the training team, maybe you can help us to find more potential issues."
"The product lacks sufficient customization options."
"We'd like it to be faster."
"Coverity takes a lot of time to dereference null pointers."
"The level of vulnerability that this solution covers could be improved compared to other open source tools."
"Sometimes, vulnerabilities remain unidentified even after setting up the rules."
"The solution's user interface and quality gate could be improved."
"SCM integration is very poor in Coverity."
Checkmarx is ranked 3rd in Application Security Testing (AST) with 23 reviews while Coverity is ranked 4th in Application Security Testing (AST) with 20 reviews. Checkmarx is rated 7.6, while Coverity is rated 8.0. The top reviewer of Checkmarx writes "Supports different languages, has excellent support, and easily expands". On the other hand, the top reviewer of Coverity writes " A tool to fix bug issues and detect errors with code analysis". Checkmarx is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and Mend.io, whereas Coverity is most compared with SonarQube, Klocwork, Veracode, Fortify on Demand and Polyspace Code Prover. See our Checkmarx vs. Coverity report.
See our list of best Application Security Testing (AST) vendors.
We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
