I evaluated Coverity. When comparing Coverity with Klocwork, Coverity has a significant advantage in filtering. Still, Klocwork is not exactly a tool to be compared with other SAST tools in the market. After all, it's not only a security analysis tool because it also provides you with reliability, maintainability, and other benefits apart from security.

Klocwork, which is part of Perforce that has around twenty product lines, is also systematic in terms of providing support and its offerings when compared to Coverity because Coverity, which is part of Synopsys, clumps certain products together to make it a bigger bundle, making it a bit complex for some people to understand.

This is also the case with Checkmarx. Klocwork is more straightforward with its offerings compared to other products.

Another pro of Klocwork is you can buy one license for all features and languages, which makes deployment and support simpler, so it's not complicated, unlike with Checkmarx, where you have to buy separate licenses.

Fortify is not trying very hard anymore. Fortify is lagging behind. Fortify used to be the leader. Klocwork has caught up to them and surpassed them. They have a higher detection and false positive rate than Fortify does.

Fortify's detection rate is about 15%, and that's not too bad. Defining the results that I get between Klocwork and Fortify, there is probably only a one percent overlay of findings of the things that they detect and things that are used. By combining the two tools, while Klocwork finds 30% and Fortify finds 15%, I am getting about 44% coverage by using the two tools together, which is not bad. However, I am having to use a supplemental tool to increase my results and increase my coverage.

Coverity is having good test results with from Juliet test cases and lower pricing, but they still high false positive rates. When we originally looked at vendors, they did not want to release their source code to the government.

We also looked at CodeSonar and Polyspace, who was bought out by MATLAB.

I evaluated QAC/QAC++, LDRA Testbed.

Klocwork does data flow analysis and is proven to be more accurate. It also supports many industry standards like MISRA, OWASP, CERT and AUTOSAR which many other tools do not. It can also be used to deliver internal coding guidelines. 

I was not involved in the tool evaluation process.

we have evaluated multiple open source tools and few commercial tools.

I evaluated some other tools, but I don't want to reveal the names of these tools. I didn't find them as good tools when compared with Klocwork.

I evaluated two other tools, which were not matched with Klocwork at any point. I don't want to reveal the names of the tools.

No.