We performed a comparison between Coverity and Mend based on real PeerSpot user reviews.
Find out in this report how the two Application Security Testing (AST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."Coverity is scalable."
"This solution is easy to use."
"The app analysis is the most valuable feature as I know other solutions don't have that."
"I encountered a bug with Coverity, and I opened a ticket. Support provided me with a workaround. So it's working at the moment, or at least it seems to be."
"We were very comfortable with the initial setup."
"One of the most valuable features is Contributing Events. That particular feature helps the developer understand the root cause of a defect. So you can locate the starting point of the defect and figure out exactly how it is being exploited."
"The solution effectively identifies bugs in code."
"The ability to scan code gives us details of existing and potential vulnerabilities. What really matters for us is to ensure that we are able to catch vulnerabilities ahead of time."
"The inventory management as well as the ability to identify security vulnerabilities has been the most valuable for our business."
"There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it."
"The solution is scalable."
"WhiteSource helped reduce our mean time to resolution since the adoption of the product."
"WhiteSource is unique in the scanning of open-source licenses. Additionally, the vulnerabilities aspect of the solution is a benefit. We don't use WhiteSource in the whole organization, but we use it for some projects. There we receive a sense of the vulnerabilities of the open-source components, which improves our security work. The reports are automated which is useful."
"The solution boasts a broad range of features and covers much of what an ideal SCA tool should."
"I am the organizational deployment administrator for this tool, and I, along with other users in our company, especially the security team, appreciate the solution for several reasons. The UI is excellent, and scanning for security threats fits well into our workflow."
"The results and the dashboard they provide are good."
"Coverity is far from perfection, and I'm not 100 percent sure it's helping me find what I need to find in my role. We need exactly what we are looking for, i.e. security errors and vulnerabilities. It doesn't seem to be reporting while we are changing our code."
"Coverity is not stable."
"The level of vulnerability that this solution covers could be improved compared to other open source tools."
"We'd like it to be faster."
"The solution is a bit complex to use in comparison to other products that have many plugins."
"When I put my code into Coverity for scanning, the code information of the product is in the system. The solution could be improved by providing a SBOM, a software bill of material."
"Coverity could improve the ease of use. Sometimes things become difficult and you need to follow the guides from the website but the guides could be better."
"The solution could use more rules."
"WhiteSource only produces a report, which is nice to look at. However, you have to check that report every week, to see if something was found that you don't want. It would be great if the build that's generating a report would fail if it finds a very important vulnerability, for instance."
"I rated the solution an eight out of ten because WhiteSource hasn't built in a couple of features that we would have loved to use and they say they're on their roadmap. I'm hoping that they'll be able to build and deliver in 2022."
"I would like to see the static analysis included with the open-source version."
"Mend lets you create custom policies. They're not too complicated to set up, but it would be helpful if they had some preconfigured policies to match what we have in Azure DevOps. That would save us a lot of time. It's tedious to configure the policies manually, and I lack the capacity to do it right now. Other products have preconfigured packs and templates, and Mend doesn't."
"Mend supports most of the common package managers, but it doesn't support some that we use. I would appreciate it if they can quickly make these changes to add new package managers when necessary."
"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."
"It should support multiple SBOM formats to be able to integrate with old industry standards."
"The turnaround time for upgrading databases for this tool as well as the accuracy could be improved."
Coverity is ranked 8th in Application Security Testing (AST) with 9 reviews while Mend is ranked 4th in Software Composition Analysis (SCA) with 13 reviews. Coverity is rated 7.8, while Mend is rated 8.2. The top reviewer of Coverity writes "Broad integration capacity and works with more languages than some competitors". On the other hand, the top reviewer of Mend writes "Easy to use, great for finding vulnerabilities, and simple to set up". Coverity is most compared with SonarQube, Veracode, Klocwork, Checkmarx and HCL AppScan, whereas Mend is most compared with SonarQube, Black Duck, Snyk, Veracode and Micro Focus Fortify on Demand. See our Coverity vs. Mend report.
We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
