We compared SonarQube and Klocwork based on our user's reviews in several parameters.
SonarQube is lauded for its versatility, simplicity, and integration capabilities, offering comprehensive features and usability enhancements. Users praise its customer service and support, reasonable pricing, and positive ROI. Klocwork is valued for its code analysis, real-time notifications, integration options, and reporting functionality. Both tools have areas for improvement such as analysis speed and user interface refinement.
Features: SonarQube offers valuable features such as support for multiple languages, integration with DevOps pipelines, and comprehensive code quality parameters. On the other hand, Klocwork focuses on code analysis capabilities, real-time notifications, and comprehensive reporting functionality.
Pricing and ROI: SonarQube's setup cost is considered straightforward and easy, with users appreciating the simplicity of the process. In contrast, user thoughts on Klocwork's setup cost remain unspecified, leaving uncertainty about its ease and simplicity., SonarQube's ROI lies in its ability to improve code quality, efficiency, and project success, while Klocwork's ROI is indicated by positive user reviews.
Room for Improvement: Areas for improvement in SonarQube include enhancing analysis speed, refining user interface for better navigation, clearer instructions for setup and configuration, improving documentation for advanced functionalities, addressing occasional performance issues, and enhancing integration options. Users have provided suggestions for improvement and identified aspects that require attention in Klocwork.
Deployment and customer support: Based on user feedback, SonarQube takes an average of three months for deployment and one week for setup, while Klocwork varies with some users taking three months for deployment and one week for setup, and others taking one week for both deployment and setup., SonarQube's customer service stands out with exceptional support, prompt and knowledgeable assistance, responsiveness, and willingness to go above and beyond. Users have expressed confidence in its reliability and added value. On the other hand, Klocwork's customer service has been highly praised for excellent assistance, prompt and attentive response, knowledge and expertise, reliable support, effective solutions, and commitment to customer satisfaction.
The summary above is based on 40 interviews we conducted recently with SonarQube and Klocwork users. To access the review's full transcripts, download our report.
"The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies. I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python."
"There is a central Klocwork server at our headquarter in France so we connect the client directly to the server on-premises remotely."
"Klocwork's most valuable feature is the static code analysis feature. It detects the potential problem earlier to allow the developer to receive feedback quickly and then address it before it becomes a problem."
"It's integrated into our CI, continuous integration."
"The tool helps the team to think beforehand about corner cases or potential bugs that might arise in real-time."
"There's a feature in Klocwork called 'on-the-fly analysis', which helps developers to find and fix the defects at the time of development itself."
"On-the-fly analysis and incremental analysis are the best parts of Klocwork. Currently, we are using both of these features very effectively."
"One can increase the number of vendors, so the solution is scalable."
"I like that it covers most programming languages for source code review."
"We've configured it to run on each commit, providing feedback on our software quality. ]"
"The most valuable feature is the security hotspot feature that identifies where your code is prone to have security issues."
"My focus is mainly on the DevOps pipeline side of things, and from my perspective, the ease of use and configuration is valuable. It is pretty straightforward to take a deployment pipeline or CI/CD pipeline and integrate SonarQube into it."
"The solution has a plug-in that supports both C and C++ languages."
"I am only interested in the security features in SonarQube. There are plenty of features other features, such as test coverage, code anomalies, and pointer access are handled by the business logic teams. They get the reports and they have to fix them in JIRA or Bugzilla."
"SonarQube is a fantastic tool which saves us precious time."
"The static code analysis is very good."
"Now the only issue we have is that whenever we need to get the code we have to build it first. Then we can get the report."
"I hope that in each new release they add new features relating to the addition of checkers, improving their analysis engines etc."
"I believe it should support more languages, such as Python and JavaScript."
"We'd like to see integration with Agile DevOps and Agile methodologies."
"Klocwork has to improve its features to stay ahead of other free solutions."
"Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."
"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
"What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."
"A robust credential scanner would be a huge bonus as it would remove the need for yet another niche product."
"The product's pricing could be lower."
"Their dashboarding is very limited. They can improve their dashboards for multiple areas, such as security review, maintainability, etc. They have all this information, so they should publish all this information on the dashboard so that the users can view the summary and then analyze it further. This is something that I would like to see in the next version."
"The solution could improve by providing more advanced technologies."
"We have tens of millions of code to be analyzed and processed. There can be some performance degradation if we are applying Sonar Link to large code or code that is complex. When the code had to be analyzed is when we ran into the main issues. There were several routines involved to solve those performance issues but this process should be improved."
"I would like to see SonarQube implement a good amount of improvements to the product's security features. Another aspect of SonarQube that could be improved is the search functionality."
"The solution could improve the management reports by making them easier to understand for the technical team that needs to review them."
"There is no automation. You need to put the code there and test. You then pull the results and put them back in the development environment. There is no integration with the development environment. We would like it to be integrated with our development environment, which is basically the CI/CD pipeline or the IDE that we have."
Klocwork is ranked 18th in Application Security Tools with 20 reviews while SonarQube is ranked 1st in Application Security Tools with 108 reviews. Klocwork is rated 8.0, while SonarQube is rated 8.0. The top reviewer of Klocwork writes "Their technical team helps us get the most out of the solution, but we've faced some stability problems in our environment". On the other hand, the top reviewer of SonarQube writes "Easy to integrate and has a plug-in that supports both C and C++ languages". Klocwork is most compared with Coverity, Polyspace Code Prover, CodeSonar, Checkmarx One and Veracode, whereas SonarQube is most compared with Checkmarx One, SonarCloud, Coverity, Veracode and CAST Highlight. See our Klocwork vs. SonarQube report.
See our list of best Application Security Tools vendors and best Application Security Testing (AST) vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
