We compared SonarQube and Klocwork based on our user's reviews in several parameters.
SonarQube is lauded for its versatility, simplicity, and integration capabilities, offering comprehensive features and usability enhancements. Users praise its customer service and support, reasonable pricing, and positive ROI. Klocwork is valued for its code analysis, real-time notifications, integration options, and reporting functionality. Both tools have areas for improvement such as analysis speed and user interface refinement.
Features: SonarQube offers valuable features such as support for multiple languages, integration with DevOps pipelines, and comprehensive code quality parameters. On the other hand, Klocwork focuses on code analysis capabilities, real-time notifications, and comprehensive reporting functionality.
Pricing and ROI: SonarQube's setup cost is considered straightforward and easy, with users appreciating the simplicity of the process. In contrast, user thoughts on Klocwork's setup cost remain unspecified, leaving uncertainty about its ease and simplicity., SonarQube's ROI lies in its ability to improve code quality, efficiency, and project success, while Klocwork's ROI is indicated by positive user reviews.
Room for Improvement: Areas for improvement in SonarQube include enhancing analysis speed, refining user interface for better navigation, clearer instructions for setup and configuration, improving documentation for advanced functionalities, addressing occasional performance issues, and enhancing integration options. Users have provided suggestions for improvement and identified aspects that require attention in Klocwork.
Deployment and customer support: Based on user feedback, SonarQube takes an average of three months for deployment and one week for setup, while Klocwork varies with some users taking three months for deployment and one week for setup, and others taking one week for both deployment and setup., SonarQube's customer service stands out with exceptional support, prompt and knowledgeable assistance, responsiveness, and willingness to go above and beyond. Users have expressed confidence in its reliability and added value. On the other hand, Klocwork's customer service has been highly praised for excellent assistance, prompt and attentive response, knowledge and expertise, reliable support, effective solutions, and commitment to customer satisfaction.
The summary above is based on 40 interviews we conducted recently with SonarQube and Klocwork users. To access the review's full transcripts, download our report.
"The reporting helps us understand the trend of our results and whether we improve over time. We can see the history within Klocwork's server architecture and know that we're making things better. It creates a great story for our management. We can demonstrate value and how our software is developing over time."
"There's a feature in Klocwork called 'on-the-fly analysis', which helps developers to find and fix the defects at the time of development itself."
"The most valuable feature is the Incremental analysis."
"We like using the static analysis and code refactoring, which are very valuable because of our requirements to meet safety critical levels and reliability."
"It's integrated into our CI, continuous integration."
"There is a central Klocwork server at our headquarter in France so we connect the client directly to the server on-premises remotely."
"The tool helps the team to think beforehand about corner cases or potential bugs that might arise in real-time."
"The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies. I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python."
"The most valuable features are that it is user-friendly, easy to access, and they provide good training files."
"SonarQube is admin friendly."
"SonarQube: Recording of issues over a period of time, with an indication of the addition in the new issues or the reduction of existing issues (which were fixed)."
"It's a great product. If you are in a hurry and just want to focus on the functional requirements of any kind of project, SonarQube is highly helpful. It enables the developers to code securely. SonarQube has a Community edition, which is open source and free. There are also three proprietary or paid versions: Enterprise edition, Data Center edition, and Developer edition."
"The most valuable features are the segregation containment and the suspension of product services."
"It is a very good tool for analysis and security vulnerability checking."
"It's enabled us to improve software quality and help us to disseminate best practices."
"SonarQube has a lot of value, it reviews the basic coding standards and security vulnerabilities of code that help to reduce issues."
"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
"Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."
"We'd like to see integration with Agile DevOps and Agile methodologies."
"We bought Klocwork, but it was limited to one little program, but the program is now sort of failing. So, we have a license for usage on a program that is sort of failing, and we really can't use the license on anything else."
"Klocwork does have a problem with true positives. It only found 30% of true positives in the Juliet test case."
"This solution could be improved if they offered support of more languages including Ada and Golang. They currently only support seven languages."
"What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."
"Modern languages, such as Angular and .NET, should be included as a part of Klocwork. They have recently added Kotlin as a part of their project, but we would like to see more languages in Klocwork. That's the reason we are using Coverity as a backup for some of the other languages."
"I would like to see improvements in defining the quality sets of rules and the quality to ensure code with low-performance does not end up in production."
"A better design of the interface and add some new rules."
"The implementation of the solution is straightforward. However, we did have some initial initialization issues at the of the projects. I don't think it was SonarQube's fault. It was the way it was implemented in our organization because it's mainly integrated with many software, such as Jira, Confluence, and Butler."
"We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major."
"I think the code security can be improved."
"Code security scanning could be improved."
"SonarQube could improve its static application security testing as per the industry standard."
"I would like to see more options for security, beyond the basics like SQL injection."
Klocwork is ranked 16th in Application Security Tools with 20 reviews while SonarQube is ranked 1st in Application Security Tools with 110 reviews. Klocwork is rated 8.2, while SonarQube is rated 8.0. The top reviewer of Klocwork writes "Their technical team helps us get the most out of the solution, but we've faced some stability problems in our environment". On the other hand, the top reviewer of SonarQube writes "Easy to integrate and has a plug-in that supports both C and C++ languages". Klocwork is most compared with Coverity, Polyspace Code Prover, CodeSonar, Checkmarx One and Veracode, whereas SonarQube is most compared with Checkmarx One, SonarCloud, Coverity, Veracode and CAST Highlight. See our Klocwork vs. SonarQube report.
See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.