We performed a comparison between Coverity and Mend.io based on real PeerSpot user reviews.
Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."This solution is easy to use."
"The solution effectively identifies bugs in code."
"Coverity is easy to set up and has a less lengthy process to find vulnerabilities."
"The product has deeper scanning capabilities."
"It's pretty stable. I rate the stability of Coverity nine out of ten."
"The product has been beneficial in logging functionality, allowing me to categorize vulnerabilities based on severity. This aids in providing updated reports on subsequent scans."
"The reporting feature is up to the mark."
"The most valuable feature of Coverity is its software security feature called the Checker. If you share some vulnerability or weakness then the software can find any potential security bug or defect. The code integration tool enables some secure coding standards and implements some Checkers for Live Duo. So we can enable secure coding and Azure in this tool. So in our software, we can make sure our software combines some industry supervised data."
"The vulnerability analysis is the best aspect of the solution."
"The most valuable features are the reporting, customizing libraries "In-house, White list, license selection", comparing the products/projects, and License & Copyright resolution."
"Enables scanning/collecting third-party libraries and classifying license types. In this way we ensure our third-party software policy is followed."
"For us, the most valuable tool was open-source licensing analysis."
"The overall support that we receive is pretty good. "
"The solution is scalable."
"WhiteSource helped reduce our mean time to resolution since the adoption of the product."
"The most valuable feature is the inventory, where it compiles a list of all of the third-party libraries that we have on our estate."
"It should be easier to specify your own validation routines and sanitation routines."
"There should be additional IDE support."
"The quality of the code needs improvement."
"Some features are not performing well, like duplicate detection and switch case situations."
"The product lacks sufficient customization options."
"Ideally, it would have a user-based license that does not have a restriction in the number of lines of code."
"Its price can be improved. Price is always an issue with Synopsys."
"We'd like it to be faster."
"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."
"I would like to see the static analysis included with the open-source version."
"Needs better ACL and more role definitions. This product could be used by large organisations and it definitely needs a better role/action model."
"Mend supports most of the common package managers, but it doesn't support some that we use. I would appreciate it if they can quickly make these changes to add new package managers when necessary."
"The UI can be slow once in a while, and we're not sure if it's because of the amount of data we have, or it is just a slow product, but it would be nice if it could be improved."
"Some detected libraries do not specify a location of where in the source they were matched from, which is something that should be enhanced to enable quicker troubleshooting."
"I rated the solution an eight out of ten because WhiteSource hasn't built in a couple of features that we would have loved to use and they say they're on their roadmap. I'm hoping that they'll be able to build and deliver in 2022."
"We have ended our relationship with WhiteSource. We were using an agent that we built in the pipeline so that you can scan the projects during build time. But unfortunately, that agent didn't work at all. We have more than 500 projects, and it doubled or tripled the build time. For other projects, we had the failure of the builds without any known reason. It was not usable at all. We spent maybe one year working on the issues to try to make it work, but it didn't in the end. We should be able to integrate it with ID and Shift Left so that the developers are able to see the scan results without waiting for the build to fail."
Coverity is ranked 4th in Static Application Security Testing (SAST) with 34 reviews while Mend.io is ranked 4th in Software Composition Analysis (SCA) with 29 reviews. Coverity is rated 7.8, while Mend.io is rated 8.4. The top reviewer of Coverity writes "Best SAST tool to check software quality issues". On the other hand, the top reviewer of Mend.io writes "Easy to use, great for finding vulnerabilities, and simple to set up". Coverity is most compared with SonarQube, Klocwork, Fortify on Demand and Checkmarx One, whereas Mend.io is most compared with SonarQube, Black Duck, Veracode, Snyk and GitLab. See our Coverity vs. Mend.io report.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
