No more typing reviews! Try our Samantha, our new voice AI agent.

Coverity Static vs Software Risk Manager ASPM comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 22, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Coverity Static
Ranking in Static Application Security Testing (SAST)
16th
Average Rating
7.8
Reviews Sentiment
6.5
Number of Reviews
43
Ranking in other categories
No ranking in other categories
Software Risk Manager ASPM
Ranking in Static Application Security Testing (SAST)
30th
Average Rating
0.0
Reviews Sentiment
7.0
Number of Reviews
1
Ranking in other categories
Software Composition Analysis (SCA) (23rd), Application Security Posture Management (ASPM) (17th)
 

Mindshare comparison

As of September 2026, in the Static Application Security Testing (SAST) category, the mindshare of Coverity Static is 2.5%, down from 6.6% compared to the previous year. The mindshare of Software Risk Manager ASPM is 1.3%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST) Mindshare Distribution
ProductMindshare (%)
Coverity Static2.5%
Software Risk Manager ASPM1.3%
Other96.2%
Static Application Security Testing (SAST)
 

Featured Reviews

SP
Lead Information Security at GEP Worldwide at ReBIT
Helps us identify security vulnerabilities in the development phase and provides a plugin for the developer IDE
The initial setup is good. When I use the product to scan the code in the DevOps pipeline, the issue coverage can be greater, which can help speed up risk identification in the CI/CD pipeline. That is one area where improvement can be made. Corresponding steps can be taken for that. It integrates with most of the tools, like ticketing tools, configuration tools, Jenkins, and the pipeline. That is fantastic.
Saravanan_Radhakrishnan - PeerSpot reviewer
Senior Manager at Happiest Minds Technologies
Facilitates continuous assessment of applications, covering both static and dynamic security aspects
Code Dx lacks one aspect, the dynamic security part, known as DAST. It's not an on-premise solution; it's in the cloud now. There are compliance standards and data standards where the customer might need to have the data on-premises for dynamic security testing. So that is one shortfall. An area of improvement could be developing an on-premise DAST solution. The current one is a complete cloud-based solution, and that can be one of the areas of improvement.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The app analysis is the most valuable feature as I know other solutions don't have that."
"It has the lowest false positives."
"The most valuable feature is that there were not a whole lot of false positives, at least on the codebases that I looked at."
"We were very comfortable with the initial setup."
"The ability to scan code gives us details of existing and potential vulnerabilities. What really matters for us is to ensure that we are able to catch vulnerabilities ahead of time."
"The most valuable feature of Coverity is its interprocedural analysis, which is advantageous because it compares favorably with other tools in terms of security and code analysis."
"It is a scalable solution."
"The features I find most valuable is that our entire company can publish the analysis results into our central space."
"The customers were looking for something around static security and dynamic security, and in all those areas, they were looking for an industry leader with a proven solution. Synopsys is a Gartner leader, so I position this particular technology for the technical pre-sales part of it."
 

Cons

"Coverity is far from perfection, and I'm not 100 percent sure it's helping me find what I need to find in my role. We need exactly what we are looking for, i.e. security errors and vulnerabilities. It doesn't seem to be reporting while we are changing our code."
"Its price can be improved. Price is always an issue with Synopsys."
"The solution needs to improve its false positives."
"They could improve the usability. For example, how you set things up, even though it's straightforward, it could be still be easier."
"My personal opinion is that the webpage of the last version of Coverity is not very easy to use."
"We're currently facing a primary challenge with automation using Coverity. Each developer has a license and can perform manual checks, and we also have a nightly build that analyzes the entire software. The main issue is that the tool can't look behind submodules in our code base, so it doesn't see changes stored there."
"The setup takes very long."
"Zero-day vulnerability identification can be an add-on feature that Coverity can provide."
"The initial setup is a bit challenging because things are not easy. It needs a lot of technology adaptability plus the customer's environment-specific use cases."
 

Pricing and Cost Advice

"The pricing is on the expensive side, and we are paying for a couple of items."
"The licensing fees are based on the number of lines of code."
"Coverity is very expensive."
"The solution's pricing is comparable to other products."
"The pricing is very reasonable compared to other platforms. It is based on a three year license."
"I would rate the tool's pricing a one out of ten."
"Coverity is quite expensive."
"The tool was fairly priced."
"It is more of an enterprise solution for budget-conscious customers. So, it's moderately priced. It's not for everybody."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
913,349 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
27%
Computer Software Company
9%
Financial Services Firm
7%
Comms Service Provider
5%
Manufacturing Company
14%
Financial Services Firm
13%
Comms Service Provider
11%
Construction Company
10%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business8
Midsize Enterprise6
Large Enterprise31
No data available
 

Questions from the Community

How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
What needs improvement with Coverity?
The price is a concern, and there are a lot of false positives coming through. Support with Coverity is adequate, but they take a longer time to respond. The core support is not straightforward, an...
Ask a question
Earn 20 points
 

Also Known As

Synopsys Static Analysis
Code Dx
 

Overview

 

Sample Customers

SAP, Mega International, Thales Alenia Space
Discover why companies like: CGI said, "Synopsys and Software Risk Manager have provided the results we’re looking for".
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Static Application Security Testing (SAST). Updated: September 2026.
913,349 professionals have used our research since 2012.