We compared SonarQube and Klocwork based on our user's reviews in several parameters.
SonarQube is lauded for its versatility, simplicity, and integration capabilities, offering comprehensive features and usability enhancements. Users praise its customer service and support, reasonable pricing, and positive ROI. Klocwork is valued for its code analysis, real-time notifications, integration options, and reporting functionality. Both tools have areas for improvement such as analysis speed and user interface refinement.
Features: SonarQube offers valuable features such as support for multiple languages, integration with DevOps pipelines, and comprehensive code quality parameters. On the other hand, Klocwork focuses on code analysis capabilities, real-time notifications, and comprehensive reporting functionality.
Pricing and ROI: SonarQube's setup cost is considered straightforward and easy, with users appreciating the simplicity of the process. In contrast, user thoughts on Klocwork's setup cost remain unspecified, leaving uncertainty about its ease and simplicity., SonarQube's ROI lies in its ability to improve code quality, efficiency, and project success, while Klocwork's ROI is indicated by positive user reviews.
Room for Improvement: Areas for improvement in SonarQube include enhancing analysis speed, refining user interface for better navigation, clearer instructions for setup and configuration, improving documentation for advanced functionalities, addressing occasional performance issues, and enhancing integration options. Users have provided suggestions for improvement and identified aspects that require attention in Klocwork.
Deployment and customer support: Based on user feedback, SonarQube takes an average of three months for deployment and one week for setup, while Klocwork varies with some users taking three months for deployment and one week for setup, and others taking one week for both deployment and setup., SonarQube's customer service stands out with exceptional support, prompt and knowledgeable assistance, responsiveness, and willingness to go above and beyond. Users have expressed confidence in its reliability and added value. On the other hand, Klocwork's customer service has been highly praised for excellent assistance, prompt and attentive response, knowledge and expertise, reliable support, effective solutions, and commitment to customer satisfaction.
The summary above is based on 40 interviews we conducted recently with SonarQube and Klocwork users. To access the review's full transcripts, download our report.
"There is a central Klocwork server at our headquarter in France so we connect the client directly to the server on-premises remotely."
"The ability to create custom checkers is a plus."
"I like not having to dig through false positives. Chasing down a false positive can take anywhere from five minutes for a small easy one, then something that is complicated and goes through a whole bunch of different class cases, and it can take up to 45 minutes to an hour to find out if it is a false positive or not."
"The tool helps the team to think beforehand about corner cases or potential bugs that might arise in real-time."
"We like using the static analysis and code refactoring, which are very valuable because of our requirements to meet safety critical levels and reliability."
"The reporting helps us understand the trend of our results and whether we improve over time. We can see the history within Klocwork's server architecture and know that we're making things better. It creates a great story for our management. We can demonstrate value and how our software is developing over time."
"Klocwork's most valuable feature is the static code analysis feature. It detects the potential problem earlier to allow the developer to receive feedback quickly and then address it before it becomes a problem."
"It's integrated into our CI, continuous integration."
"Improve the code coverage and evaluates the technical steps and percentage of code being resolved."
"We advise all of our developers to have this solution in place."
"The tool helps us to monitor and manage violations. It manages the bugs and security violations."
"The integrations SonarQube provides with our software delivery pipeline are very seamless."
"This has improved our organization because it has helped to find Security Vulnerabilities."
"The good thing with SonarQube is it covers a lot of issues, it's a very robust framework."
"If code coverage is a low number then that's of great value to me."
"Some of the most valuable features have been the latest up-to-date of the OWASP, the monitoring, the reporting, and the ease of use with the IDE plugins, in terms of integration."
"We bought Klocwork, but it was limited to one little program, but the program is now sort of failing. So, we have a license for usage on a program that is sort of failing, and we really can't use the license on anything else."
"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
"I would like to see better codes between projects and a more user-friendly desktop in the next release."
"Now the only issue we have is that whenever we need to get the code we have to build it first. Then we can get the report."
"What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."
"I believe it should support more languages, such as Python and JavaScript."
"Klocwork does have a problem with true positives. It only found 30% of true positives in the Juliet test case."
"This solution could be improved if they offered support of more languages including Ada and Golang. They currently only support seven languages."
"Although it has Sonar built into it, it is still lacking. Customization features of identifying a particular attack still need to be worked on. To give you an example: if we want to scan and do a false positive analysis, those types of features are missing. If we want to rescan something from a particular point that is a feature that is also missing. It’s in our queue. That will hopefully save a lot of time."
"Currently requires multiple tools, lacking one overall tool."
"I would also like SonarQube to be able to write custom scanning rules. More documentation would be helpful as well because some of our guys were struggling with the customization script."
"New plug-ins should be integrated into SonarCloud to give more flexibility to the product."
"A better design of the interface and add some new rules."
"Ease of use/interface."
"The product's pricing could be lower."
"It does not provide deeper scanning of vulnerabilities in an application, on a live session. This is something we are not happy about. Maybe the reason for that is we are running the community edition currently, but other editions may improve on that aspect."
Klocwork is ranked 16th in Application Security Tools with 20 reviews while SonarQube is ranked 1st in Application Security Tools with 110 reviews. Klocwork is rated 8.2, while SonarQube is rated 8.0. The top reviewer of Klocwork writes "Their technical team helps us get the most out of the solution, but we've faced some stability problems in our environment". On the other hand, the top reviewer of SonarQube writes "Easy to integrate and has a plug-in that supports both C and C++ languages". Klocwork is most compared with Coverity, Polyspace Code Prover, CodeSonar, Checkmarx One and Veracode, whereas SonarQube is most compared with Checkmarx One, SonarCloud, Coverity, Veracode and CAST Highlight. See our Klocwork vs. SonarQube report.
See our list of best Application Security Tools vendors and best Static Application Security Testing (SAST) vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.