We performed a comparison between Checkmarx One and Klocwork based on real PeerSpot user reviews.
Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The user interface is modern and nice to use."
"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."
"The most valuable features of Checkmarx are the automation and information that it provides in the reports."
"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."
"The solution allows us to create custom rules for code checks."
"The solution communicates where to fix the issue for the purpose of less iterations."
"The reports are very good because they include details on the code level, and make suggestions about how to fix the problems."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"The tool helps the team to think beforehand about corner cases or potential bugs that might arise in real-time."
"One can increase the number of vendors, so the solution is scalable."
"The most valuable feature is the Incremental analysis."
"There is a central Klocwork server at our headquarter in France so we connect the client directly to the server on-premises remotely."
"Klocwork's most valuable feature is the static code analysis feature. It detects the potential problem earlier to allow the developer to receive feedback quickly and then address it before it becomes a problem."
"There's a feature in Klocwork called 'on-the-fly analysis', which helps developers to find and fix the defects at the time of development itself."
"On-the-fly analysis and incremental analysis are the best parts of Klocwork. Currently, we are using both of these features very effectively."
"Technical support is quite good."
"The solution's user interface could be improved because it seems outdated."
"The validation process needs to be sped up."
"Its pricing model can be improved. Sometimes, it is a little complex to understand its pricing model."
"Licensing models and Swift language support are the aspects in which this product needs to improve. Swift is a new language, in which major customers require support for lower prices."
"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."
"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."
"The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
"Every update that we receive requires of us a lengthy and involved process."
"This solution could be improved if they offered support of more languages including Ada and Golang. They currently only support seven languages."
"I would like to see better codes between projects and a more user-friendly desktop in the next release."
"Klocwork does have a problem with true positives. It only found 30% of true positives in the Juliet test case."
"Now the only issue we have is that whenever we need to get the code we have to build it first. Then we can get the report."
"The way to define the rules is too complex. The definition/rules for static analysis could be automated according to various SILs, so as to avoid confusion."
"Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."
Checkmarx One is ranked 3rd in Application Security Tools with 67 reviews while Klocwork is ranked 18th in Application Security Tools with 20 reviews. Checkmarx One is rated 7.6, while Klocwork is rated 8.2. The top reviewer of Checkmarx One writes "The report function is a great, configurable asset but sometimes yields false positives". On the other hand, the top reviewer of Klocwork writes "Their technical team helps us get the most out of the solution, but we've faced some stability problems in our environment". Checkmarx One is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and Coverity, whereas Klocwork is most compared with SonarQube, Coverity, Polyspace Code Prover, CodeSonar and Veracode. See our Checkmarx One vs. Klocwork report.
See our list of best Application Security Tools vendors, best Application Security Testing (AST) vendors, and best Static Code Analysis vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
