Coverity vs SonarQube comparison

Coverity

Read 36 Coverity reviews

16,689 Views
10,948 Comparison Views

87% willing to recommend

SonarQube

Read 112 SonarQube reviews

50,217 Views
39,852 Comparison Views

81% willing to recommend

Coverity

SonarQube

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Mar 20, 2023

We performed a comparison between Coverity and SonarQube based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.

Ease of Deployment: Coverity has a simple deployment process with on-screen instructions, but the total deployment time varies based on the project and integrations. Maintenance is vendor-handled. SonarQube has a straightforward initial setup and automatic deployment, but some database and Java knowledge is needed.

Features: Coverity helps identify defect root causes with contributing events. SonarQube detects code quality during development with defined rules.

Pricing: Coverity is an expensive solution with an unfriendly licensing mechanism and a difficult exit process. SonarQube has an open source option and their pricing for the paid version is reasonable.

Service and support: Coverity offers a decent support package with email, call, and on-demand sessions available, while SonarQube offers extensive documentation and online resources for support, which is sufficient for their users.

Comparison Result: Based on the parameters we compared, SonarQube comes out ahead of Coverity. Although both products have valuable features and can be estimated as high-end solutions, our reviewers found that Coverity is an expensive solution with an unfriendly licensing mechanism and a difficult exit process, which may make it less accessible for smaller teams or companies with budgetary constraints.

To learn more, read our detailed Coverity vs. SonarQube Report (Updated: July 2024).

Buyer's Guide

Coverity vs. SonarQube

July 2024

Download the complete report

Helped 793,295 peers since 2012

Categories and Ranking

Coverity

Ranking in Static Application Security Testing (SAST)

4th

Average Rating

7.8

Number of Reviews

Ranking in other categories

No ranking in other categories

SonarQube

Ranking in Static Application Security Testing (SAST)

1st

Average Rating

8.0

Number of Reviews

112

Ranking in other categories

Application Security Tools (1st), Software Development Analytics (1st)

Mindshare comparison

As of July 2024, in the Static Application Security Testing (SAST) category, the mindshare of Coverity is 8.2%, up from 6.5% compared to the previous year. The mindshare of SonarQube is 31.4%, up from 28.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Unique Categories:

No other categories found

Application Security Tools

28.0%

Software Development Analytics

50.0%

Featured Reviews

Akshay Pawar

Software Developer at KPIT Technologies

Nov 9, 2023

A tool to fix bug issues and detect errors with code analysis

I rate the initial setup of Coverity an eight on a scale of one to ten, where one is difficult, and ten is easy. The setup phase of Coverity can sometimes be straightforward, and if there are some issues, it can be a little bit complex. When involved in some tracking activity, sometimes, Coverity uses looping logic, making it quite difficult to handle bugs. Sometimes, the tracking activity in Coverity will be straightforward with a very good interface. Marking the positive rates and giving some green and red bars can be helpful in Coverity. The solution is deployed on an on-premises model. The solution can be deployed in a day. My company uses the git repository for the implementation of Coverity. Five people are required to deploy the solution. Around thirty people might be required to take care of the maintenance process of the product since there will be an increase in the team members in our company.

Read full review

Jaile Sebes

Senior Software Architect at Siemens Industry

Mar 1, 2024

Excels in dashboard usability and cost-effectiveness

I integrate SonarQube into my CI/CD pipeline by running it during the build process for static code analysis. Once the analysis is complete, the results are sent to the dashboard for easy monitoring and tracking of code quality. Using SonarQube for security vulnerability detection offers several benefits such as comprehensive security rule coverage and integration with the dashboard for easy monitoring. Additionally, SonarQube provides features like password handling, eliminating the need for separate tools and enhancing overall code security. SonarQube handles false positives during code analysis by allowing teams to review and exclude them, especially in long-term projects where patterns are familiar. While false positives may occur, experienced teams can easily identify and manage them, ensuring accurate analysis results. For software development, especially in Java-based environments, I highly recommend using SonarQube due to its effectiveness in ensuring code quality and minimizing potential issues. While there are free tools available, SonarQube's comprehensive support for various languages and its benefits make it a valuable choice for developers. Overall, I would rate SonarQube as an eight out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."

"This solution is easy to use."

"The app analysis is the most valuable feature as I know other solutions don't have that."

"It's pretty stable. I rate the stability of Coverity nine out of ten."

"The product is easy to use."

"The reporting feature is up to the mark."

"I like Coverity's capability to scan codes once we push it. We don't need more time to review our colleagues' codes. Its UI is pretty straightforward."

"The most valuable feature is the integration with Jenkins."

More Coverity pros

"The solution has a plug-in that supports both C and C++ languages."

"One of the most valuable features of SonarQube is its ability to detect code quality during development. There are rules that define various technologies—Java, C#, Python, everything—and these rules declare the coding standards and code quality. With SonarQube, everything is detectable during the time of development and continuous integration, which is an advantage. SonarQube also has a Quality Gate, where the code should reach 85%. Below that, the code cannot be promoted to a further environment, it should be in a development environment only. So the checks are there, and SonarQube will provide that increase. It also provides suggestions on how the code can be fixed and methods of going about this, without allowing hackers to exploit the code. Another valuable feature is that it is tightly integrated with third-party tools. For example, we can see the SonarQube metrics in Bitbucket, the code repository. Once I raise the full request, the developer, team lead, or even the delivery lead can see the code quality metrics of the deliverable so that they can make a decision. SonarQube will also cover all of the top OWASP vulnerabilities, however it doesn't have penetration testing or hacker testing. We use other tools, like Checkmarx, to do penetration testing from the outside."

"I like that it has a better dashboard compared to Clockwork. It's also stable."

"The solution offers a very good community edition."

"The most valuable features are the segregation containment and the suspension of product services."

"Using SonarQube benefits us because we are able to avoid the inclusion of malware in our applications."

"Improve the code coverage and evaluates the technical steps and percentage of code being resolved."

"My focus is mainly on the DevOps pipeline side of things, and from my perspective, the ease of use and configuration is valuable. It is pretty straightforward to take a deployment pipeline or CI/CD pipeline and integrate SonarQube into it."

More SonarQube pros

Cons

"We actually specified several checkers, but we found some checkers had a higher false positive rate. I think this is a problem. Because we have to waste some time is really the issue because the issue is not an issue. I mean, the tool pauses or an issue, but the same issue is the filter now.Some check checkers cannot find some issues, but sometimes they find issues that are not relevant, right, that are not really issues. Some customisation mechanism can be added in the next release so that we can define our Checker. The Modelling feature provided by Coverity helps in finding more information for potential issues but it is not mature enough, it should be mature. The fast testing feature for security testing campaign can be added as well. So if you correctly integrate it with the training team, maybe you can help us to find more potential issues."

"The product should include more customization options. The analytics is not as deep as compared to SonarQube."

"I would like to see integration with popular IDEs, such as Eclipse."

"When I put my code into Coverity for scanning, the code information of the product is in the system. The solution could be improved by providing a SBOM, a software bill of material."

"The setup takes very long."

"Coverity takes a lot of time to dereference null pointers."

"The solution's user interface and quality gate could be improved."

"They could improve the usability. For example, how you set things up, even though it's straightforward, it could be still be easier."

More Coverity cons

"The product's pricing could be lower."

"Dynamic scanning is missing and there are some issues with security scanning."

"We could use some team support, but since we are using the community version, it's not available."

"When we have a thousand products published over it, we expect it to be more efficient in terms of serving requests from the browser."

"I have found this solution creates more noise than competitors."

"The software testing tool capability could improve. It does not always integrate well. You have to use a specific plugin and the plugin does not always go in Apple's applications."

"It does not provide deeper scanning of vulnerabilities in an application, on a live session. This is something we are not happy about. Maybe the reason for that is we are running the community edition currently, but other editions may improve on that aspect."

"I would like to see dynamic code analysis in the next version of the software."

More SonarQube cons

Pricing and Cost Advice

"Coverity’s price is on the higher side. It should be lower."

"Offers varying prices for different companies"

"The solution is affordable."

"The price is competitive with other solutions."

"This is a pretty expensive solution. The overall value of the solution could be improved if the price was reduced. Licensing is done on an annual basis."

"Coverity is quite expensive."

"The tool was fairly priced."

"Coverity is very expensive."

More Coverity pricing and cost advice

"We are using the open-source version, which is available free of cost."

"The beauty of this solution is the free open-source version is capable enough in doing pretty much what an enterprise-level version can do."

"The solution has a free version and a license version. The license is priced reasonably, the cost of hiring one programmer is more expensive than the solution."

"For the Community edition, there is no extra cost. It's totally free. The Enterprise edition, Data Center edition, and Developer edition are the paid versions."

"We are using the open-source community version, but there are enterprise licenses available."

"The price of the solution could be reduced."

"The development license cost is reasonable, and we've had no concerns about SonarQube when it comes to cost."

"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."

More SonarQube pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

793,295 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

31%

Computer Software Company

16%

Financial Services Firm

Government

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

12%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

What do you like most about Coverity?

The solution has improved our code quality and security very well.

See all answers

What is your experience regarding pricing and costs for Coverity?

I don't deal with the pricing.

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

How does Snyk compare with SonarQube?

Snyk does a great job identifying and reducing vulnerabilities. This solution is fully automated and monitors 24/7 to find any issues reported on the internet. It will store dependencies that you a...

See all answers

Comparisons

Klocwork vs Coverity

Compared 8% of the time

Fortify on Demand vs Coverity

Compared 7% of the time

Checkmarx One vs Coverity

Compared 6% of the time

Veracode vs Coverity

Compared 5% of the time

Polyspace Code Prover vs Coverity

Compared 4% of the time

More Coverity Competitors

Checkmarx One vs SonarQube

Compared 20% of the time

SonarCloud vs SonarQube

Compared 13% of the time

Veracode vs SonarQube

Compared 9% of the time

GitHub Advanced Security vs SonarQube

Compared 7% of the time

Snyk vs SonarQube

Compared 5% of the time

More SonarQube Competitors

Product Reports

Buyer's Guide

Coverity

July 2024

Download Coverity product report

Buyer's Guide

SonarQube

June 2024

Download SonarQube product report

Also Known As

Synopsys Static Analysis

Sonar

Learn More

Synopsys

Sonar

Interactive Demo

Demo not available

Synopsys

Sonar

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

Sample Customers

SAP, Mega International, Thales Alenia Space

Buyer's Guide

Coverity vs. SonarQube

July 2024

Free Report: Coverity vs. SonarQube

Find out what your peers are saying about Coverity vs. SonarQube and other solutions. Updated: July 2024.

DOWNLOAD NOW

793,295 professionals have used our research since 2012.

See our Coverity vs. SonarQube report.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.