Klocwork Reviews

I work on tools such as Klocwork, LDRA, as well as Jira and Confluence, focusing more on the software quality assurance aspect.

We use Klocwork for coding and aggregate checks. We use it for static analysis, MISRA compliance, and for HIS metrics as well. We also now use it for the software SBOM.

Klocwork is user-friendly, with a client-server architecture that provides all needed compliance. It also offers CLI options for integration with Jenkins and automation.

Its integration with the CI/CD pipeline has helped streamline the software development process. We have included Klocwork as part of our Bitbucket pull request, which gives us insights into overnight issues or changes when pulling in or pushing new code. Klocwork positively impacts our organization as it's now part of our development flow, ensuring that all software we develop works as expected.

I utilize Klocwork for identifying defects and early vulnerabilities in the code, conducting code checks, and categorizing and fixing failures.

The most valuable feature of Klocwork is its reduced setup time. It takes around half a day to set up, making it easier to debug and categorize failures. It provides priority and criticality information in the user interface and is faster to set up compared to Coverity.

I primarily use Klocwork to detect and find early vulnerabilities in the code. It performs code checks and allows me to fix issues. It provides priority and criticality ratings and displays these in the user interface. I moved from Coverity to Klocwork since it is faster and has a shorter setup time.

The best advantage of Klocwork is the reduced setup time. It takes just half a day to set up. It is quite easy for me to debug the failures and categorize them compared to Coverity. Integration enablement is easier and really good. Installation is straightforward, and the setup time is very short.

I'm using the product for traffic analysis tool to check or parse our code. The tool works as a code parser to detect possible problems that can happen due to patterns in the code. 

The project is very easy to integrate into our development environment that we use to develop the code. It's very easy to integrate and run on your code. It doesn't take much time to set up. It finds all possible problems that can happen within your code. It helps develop better-quality software. 

It's also integrated into our CI, continuous integration. It can be automated as part of pushing the code onto the branch.

Our primary use case for Klocwork is static analysis. It highlights potential warnings and errors, assisting us in confirming there isn't anything obviously wrong with our code.

The most valuable feature of Klocwork is the static analysis tools, which help identify potential security threats and errors. It highlights areas that require attention, ensuring safe and error-free code development. We have integrated Klocwork into our CI pipeline and development environment, although we haven't fully utilized all its capabilities.

Our use case for Klocwork is somewhat unusual. We're an embedded component provider for the military and aerospace market that produces single-board computers and various platforms for that. We also develop operating systems, device drivers, and low-level interfacing APIs for our hardware. Klocwork helps us achieve compliance with certification because our products must conform to DO-178 standards for aerospace and defense software. 

We primarily use Klocwork internally to measure code quality. We get code from third parties and analyze it with Klocwork to get a baseline of its quality to know if we need to improve it or leave it alone. 

Klocwork created an environment where the engineers have checks and balances as they develop and progress through our release process. The solution is not critical to our organized stations because we don't produce the end solutions. However, it allows us to reassure our customers that we're providing them with a solid basis they can build upon within their processes and procedures. 

Our customers have their own standards to follow. We don't use it to enforce coding standards because we take things from various places, and the standards change depending on the type of tech.

Our upgrade procedure is coarse, and it requires the client sites to be updated at the same time. We must upgrade in one step, and we're dealing with UK and NIS cybersecurity requirements. We must go through the certification each time, and it's becoming more difficult. 

The solution drives developers not to introduce any more errors. We use third-party software to decide whether to fix or analyze what Klocwork provides us. Engineers sometimes question what Klocwork flags, and they must go through that exercise. I like that because it prompts the engineers to think about development, and finding something to spark a discussion is often hard. The tool provides an interesting perspective.

It provides insights that can help new people who join the team. If they try to push code to the system with errors, Klocwork makes them pause and question what they're doing. Klocwork shortens the development cycle and process of third-party reviews by about five percent because the code is a little cleaner. Usually, it will go to review with more people involved. It eliminates some review work because Klocwork provides the individual engineer with insight.

The money saved would be difficult to quantify based on our current utilization of Klocwork. It helps at a fundamental level, reducing the time needed to get to the implementation phase.

We serve as consultants to several clients across different domains, specifically automotive, aviation, electronics, and semiconductors. Our clients require a static analysis solution to find security vulnerabilities specific to certain standards based on their industries. Hence, we support them through Klocwork to find particular vulnerabilities and adhere to industry standards.

Klocwork is more than a static analysis security testing tool because it also provides maintainability and other types of information apart from security.

The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies.

I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python.

We are involved in implementing the applying and supporting Klocwork for various customers as we are a Klokwork partner. Klocwork is an advanced static code analysis tool also used to detect all possible vulnerabilities that are present in the source code.

There's a feature in Klocwork called 'on-the-fly analysis', which helps developers to find and fix the defects at the time of development itself. This means that you don't have to wait for the development to finish and waste that time. This provides efficiency. 

Klocwork also has various plugins available for development tools and they work seamlessly. Our clients often opt for Klocwork due to its accuracy of results and the continuous addition of new features.