We performed a comparison between Fortify Static Code Analyzer and Snyk based on real PeerSpot user reviews.
Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Static Code Analysis."We write software, and therefore, the most valuable aspect for us is basically the code analysis part."
"The reference provided for each issue is extremely helpful."
"The integration Subset core integration, using Jenkins is one of the good features."
"We've found the documentation to be very good."
"The most valuable features include its ability to detect vulnerabilities accurately and its integration with our CI/CD pipeline."
"Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like password credentials and access keys embedded in the code."
"Automating the Jenkins plugins and the build title is a big plus."
"The Software Security Center, which is often overlooked, stands out as the most effective feature."
"It has an accurate database of vulnerabilities with a low amount of false positives."
"We have integrated it into our software development environment. We have it in a couple different spots. Developers can use it at the point when they are developing. They can test it on their local machine. If the setup that they have is producing alerts or if they need to upgrade or patch, then at the testing phase when a product is being built for automated testing integrates with Snyk at that point and also produces some checks."
"Static code analysis is one of the best features of the solution."
"The most effective feature in securing project dependencies stems from its ability to highlight security vulnerabilities."
"The most valuable feature is that they add a lot of their own information to the vulnerabilities. They describe vulnerabilities and suggest their own mitigations or version upgrades. The information was the winning factor when we compared Snyk to others. This is what gave it more impact."
"The solution has great features and is quite stable."
"The CLI feature is quite useful because it gives us a lot of flexibility in what we want to do. If you use the UI, all the information is there and you can see what Snyk is showing you, but there is nothing else that you can change. However, when you use the CLI, then you can use commands and can get the output or response back from Snyk. You can also take advantage of that output in a different way. For the same reason, we have been using the CLI for the hard gate in the pipeline: Obtain a particular CDSS score for vulnerability. Based on that information, we can then decide if we want to block or allow the build. We have more flexibility if we use the CLI."
"The solution's Open Source feature gives us notifications and suggestions regarding how to address vulnerabilities."
"The troubleshooting capabilities of this solution could be improved. This would reduce the number of cases that users have to submit."
"Their licensing is expensive."
"Not all languages are supported in Fortify."
"The generation of false positives should be reduced."
"It comes with a hefty licensing fee."
"The product shows false positives for Python applications."
"Fortify Static Code Analyzer is a good solution, but sometimes we receive false positives. If they could reduce the number of false positives it would be good."
"Fortify's software security center needs a design refresh."
"The solution's integration with JFrog Artifactory could be improved."
"There are some new features that we would like to see added, e.g., more visibility into library usage for the code. Something along the lines where it's doing the identification of where vulnerabilities are used, etc. This would cause them to stand out in the market as a much different platform."
"One area where Snyk could improve is in providing developers with the line where the error occurs."
"The solution's reporting and storage could be improved."
"The tool should provide more flexibility and guidance to help us fix the top vulnerabilities before we go into production."
"We have seen cases where tools didn't find or recognize certain dependencies. These are known issues, to some extent, due to the complexity in the language or stack that you using. There are some certain circumstances where the tool isn't actually finding what it's supposed to be finding, then it could be misleading."
"Offering API access in the lower or free open-source tiers would be better. That would help our customers. If you don't have an enterprise plan, it becomes challenging to integrate with the rest of the systems. Our customers would like to have some open-source integrations in the next release."
"The product is very expensive."
Fortify Static Code Analyzer is ranked 3rd in Static Code Analysis with 14 reviews while Snyk is ranked 4th in Application Security Tools with 41 reviews. Fortify Static Code Analyzer is rated 8.4, while Snyk is rated 8.2. The top reviewer of Fortify Static Code Analyzer writes "Seamless to integrate and identify vulnerabilities and frees up staff time". On the other hand, the top reviewer of Snyk writes "Performs software composition analysis (SCA) similar to other expensive tools". Fortify Static Code Analyzer is most compared with Black Duck, Veracode, Sonatype Lifecycle, GitLab and Mend.io, whereas Snyk is most compared with SonarQube, Black Duck, GitHub Advanced Security, Veracode and Checkmarx One.
We monitor all Static Code Analysis reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
