A session from Kiuwan was made available to help me perform the steps required to take care of the setup phase and how to do the scanning with it. The setup phase was not much of a task to handle, considering how I have experience with Fortify and Checkmarx. In general, Kiuwan was not a tool that was very much known to me, but it was a bit different from the tools that I had experienced in the past.

The solution is deployed on an on-premises model.

The initial setup depends on one's familiarity, and for newcomers, it may initially appear complex. However, with persistent efforts to understand and use the tool, the process becomes more manageable. Continuous experimentation and exploration lead to a better grasp of configuring the tool for optimal results.

Kiuwan was pretty easy to set up. We simply installed the local analyzer and configured the dashboard with some rules to apply to our code. It wasn't that hard. 

I am not the primary person responsible for that as it is handled by the application team. Our role is to perform the scans, identify any vulnerabilities, and provide guidance on how to mitigate them. Once the vulnerabilities have been resolved, a rescan is conducted until there are no longer any critical or high vulnerabilities present. At that point, the Kiuwan scan is completed for that particular application.

In my experience, companies prefer minimal installations of Kiuwan; they opt for the basic installation and don't want to invest in or pay for all the available models.The deployment takes longer than usual. 

The initial setup was easy.

We faced a lot of problems with the initial setup and support gave us difficulties around the installation. That made us a little bit confused. When you lose your servers for the week, it's not a good thing.

With support, we had to troubleshoot the issues and that took about eight working days. It took us around 11 days to overcome the issues and to upgrade. 

As an information security team, we were providing some services and were trying to make a vulnerability assessment. The security testing let us note a lot of vulnerabilities. We contacted support and it took us three months to overcome those particular issues.  

In terms of maintenance, we have system admins that just look to see if the servers are running or not, however, for managing the servers, the servers implementation security team will handle that.

The initial setup was very straightforward. It's a cloud solution so after you sign the contract you have the solution. You just need to create the users, do the tutorials, it's simple. There's no deployment because it's a cloud service, you might just need to download a local analyzer.  We have an external consultant who performed the dynamic analysis of our code. 

The installation of this solution is easy.

Initial setup is very straightforward; plug and play.

In terms of setting up the solution, you only have to download a client to make the analysis. In the local environment, you also only need Java 1.8 and an internet connection to make an analysis. You have to worry about working in the configuration and administration of the users of the quality models. It's pretty easy.

I would rate the complexity of setup as a medium. It's not the easiest, but it's not the most complex. Deployment takes about six months. We have four staff members for deployment and maintenance.

Initial setup is straightforward, no doubt.

The initial setup of this solution is very simple.

Not complex. I am a salesperson without tech training and I was able to use it

It is extremely simple to setup, either to run on-site or in the cloud; and plenty of hooks to integrate with any automation engine.

It is very easy to deploy.

No, it was automatic.

The initial setup could not be simpler. It is a SaaS solution. Integration with Jenkins and the local analyzer is a great solution.

The initial setup was easy.