As of July 2024, in the Static Application Security Testing (SAST) category, the mindshare of Coverity is 8.2%, up from 6.5% compared to the previous year. The mindshare of Seeker is 0.6%, down from 0.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Unique Categories:

No other categories found

Featured Reviews

Archana Verma

Security Analyst at Dover Corporation

May 12, 2023

Provides software security and helps find potential security bugs or defects

We use this tool for call scans in order to improve call quality. We implement testing and this tool cleans up our potential feedback. We are a semiconductor company and provide software solutions to our clients. I'm a senior manager. Coverity has improved our functionality and efficiency. This…

Read full review

San K

Senior Group Leader at Infosys

Nov 7, 2022

More effective than dynamic scanners, but is missing useful learning capabilities

One area that Seeker can improve is to make it more customizable. All security scanning tools have a defined set of rules that are based on certain criteria which they will use to detect issues. However, the criteria that you set initially is not something that all applications are going to need. The purposes for which applications are designed may differ in practice in the industry, and because of this, there will always be tools that sometimes report false positives. Thus, there should be some means with which I can customize the way that Seeker learns about our applications, possibly by using some kind of AI / ML capability within the tool that will automatically reduce the number of false positives that we get as we use the tool over time. Obviously, when we first start using the scanning tool there will be false positives, but as it keeps going and as I keep using the tool, there should be a period of time where either the application can learn how to ignore false positives, or I can customize it do so. Adding this type of functionality would definitely prevent future issues when it comes to reporting false positives, and this is a key area that we have already asked the vendor to improve on, in general. On a different note, there is one feature that isn't completely available right now where you can integrate Seeker with an open-source vulnerability scanner or composition analysis tool such as Black Duck. I would very much like this capability to be available to us out-of-the-box, so that we can easily integrate with tools like Black Duck in such a way that any open source components that are used in the front-end are easily identified. I think this would be a huge plus for Seeker. Another feature within Seeker which could benefit from improvement is active verification, which lets you actively verify a vulnerability. This feature currently doesn't work in certain applications, particularly in scenarios where you have requested tokens. When we bought the tool, we didn't realize this and we were not told about it by the vendor, so initially it was a big challenge for us to overcome it and properly begin our deployment.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It's very stable."

"Coverity gives advisory and deviation features, which are some of the parts I liked."

"Coverity is scalable."

"I encountered a bug with Coverity, and I opened a ticket. Support provided me with a workaround. So it's working at the moment, or at least it seems to be."

"The most valuable feature of Coverity is its software security feature called the Checker. If you share some vulnerability or weakness then the software can find any potential security bug or defect. The code integration tool enables some secure coding standards and implements some Checkers for Live Duo. So we can enable secure coding and Azure in this tool. So in our software, we can make sure our software combines some industry supervised data."

"The tool as it is can be used for code quality improvement."

"The ability to scan code gives us details of existing and potential vulnerabilities. What really matters for us is to ensure that we are able to catch vulnerabilities ahead of time."

"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."

More Coverity pros

"A significant advantage of Seeker is that it is an interactive scanner, and we have found it to be much more effective in reducing the amount of false positives than dynamic scanners such as AppScan, Micro Focus Fortify, etc. Furthermore, with Seeker, we are finding more and more valid (i.e. "true") positives over time compared with the dynamic scanners."

Cons

"Coverity takes a lot of time to dereference null pointers."

"I had tried integrating the tool with Azure DevOps, but the report I got stated that my team faced many challenges."

"It should be easier to specify your own validation routines and sanitation routines."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"The solution's user interface and quality gate could be improved."

"Its price can be improved. Price is always an issue with Synopsys."

"We use GitHub and Gitflow, and Coverity does not fit with Gitflow. I have to create a screen for our branches, and it's a pain for developers. It has been difficult to integrate Coverity with our system."

"Coverity is not stable."

More Coverity cons

"One area that Seeker can improve is to make it more customizable. All security scanning tools have a defined set of rules that are based on certain criteria which they will use to detect issues. However, the criteria that you set initially is not something that all applications are going to need."

Pricing and Cost Advice

"Coverity is very expensive."

"The tool was fairly priced."

"I would rate the tool's pricing a one out of ten."

"I would rate Coverity's pricing as a nine out of ten. It's already very expensive, and it's a problem for us to get more licenses due to the price. The pricing model has some good aspects - for example, a personal license gives access to all languages without code limitations, which is better than some competitors. However, it's still a lot of money for us to spend."

"I would rate the pricing a six out of ten, where one is low, and ten is high price."

"The price is competitive with other solutions."

"The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten."

"The pricing is on the expensive side, and we are paying for a couple of items."

More Coverity pricing and cost advice

"The licensing for Seeker is user-based and for 50 users I believe it costs about $70,000 per year."

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

793,295 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

31%

Computer Software Company

16%

Financial Services Firm

Government

Financial Services Firm

25%

Computer Software Company

16%

Manufacturing Company

11%

Retailer

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

What do you like most about Coverity?

The solution has improved our code quality and security very well.

See all answers

What is your experience regarding pricing and costs for Coverity?

I don't deal with the pricing.

See all answers

What do you like most about Seeker?

A significant advantage of Seeker is that it is an interactive scanner, and we have found it to be much more effective in reducing the amount of false positives than dynamic scanners such as AppSca...

See all answers

What is your experience regarding pricing and costs for Seeker?

The licensing for Seeker is user-based and for 50 users I believe it costs about $70,000 per year.

See all answers

What needs improvement with Seeker?

See all answers

Comparisons

SonarQube vs Coverity

Compared 51% of the time

Klocwork vs Coverity

Compared 8% of the time

Fortify on Demand vs Coverity

Compared 7% of the time

Checkmarx One vs Coverity

Compared 6% of the time

GitLab vs Coverity

Compared 1% of the time

More Coverity Competitors

Synopsys API Security Testing vs Seeker

Compared 22% of the time

Contrast Security Assess vs Seeker

Compared 18% of the time

SonarQube vs Seeker

Compared 11% of the time

Polaris Software Integrity Platform vs Seeker

Compared 8% of the time

Checkmarx One vs Seeker

Compared 7% of the time

More Seeker Competitors

Product Reports

Buyer's Guide

Coverity

July 2024

Download Coverity product report

Buyer's Guide

Internet Security

July 2024

Download Seeker product report

Also Known As

Synopsys Static Analysis

No data available

Learn More

Synopsys

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Seeker®, interactive application security testing (IAST) solution, gives you unparalleled visibility into your modern web, cloud based and microservices based app security posture. It automatically verifies, prioritizes and reports on critical vulnerabilities in real time. It identifies vulnerability trends against compliance standards (e.g., OWASP Top 10, PCI DSS, GDPR, CAPEC, and CWE/SANS Top 25). Seeker enables security teams to identify and track sensitive data to ensure that it is handled securely and not stored in log files or databases with weak or no encryption. Seeker’s seamless integration into CI/CD workflows enables fast interactive application security testing at DevOps speed.

Sample Customers

SAP, Mega International, Thales Alenia Space

El Al Airlines and Société Française du Radiotelephone

Buyer's Guide

Static Application Security Testing (SAST)

July 2024

Download Free Report

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Static Application Security Testing (SAST). Updated: July 2024.

DOWNLOAD NOW

793,295 professionals have used our research since 2012.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.