Best Static Code Analysis Tools - Page 6

How Many Static Code Analysis Tools Products Does G2 Track?

Total Products under this Category: 136

Category Stats (Oct 2026)

  • Average Rating: 4.38/5 The average rating of products in this category, based on all submitted ratings
  • Top Trending Product: SoftSpell (+0.46%) - Among all products in this category, SoftSpell recorded the largest rating increase compared to last month

Last updated: October 26, 2026

How Does G2 Rank Static Code Analysis Tools Products?

Why You Can Trust G2's Software Rankings:

  • 30 Analysts and Data Experts
  • 2,500+ Authentic Reviews
  • 136+ Products
  • Unbiased Rankings

G2's software rankings are built on verified user reviews, rigorous moderation, and a consistent research methodology maintained by a team of analysts and data experts. Each product is measured using the same transparent criteria, with no paid placement or vendor influence. While reviews reflect real user experiences, which can be subjective, they offer valuable insight into how software performs in the hands of professionals. Together, these inputs power the G2 Score, a standardized way to compare tools within every category.

G2 Grid® for Static Code Analysis Tools

G2 Grid® for Static Code Analysis Tools plotting products by satisfaction and market presence

Highlighted products: SonarQube, Aikido Security, Checkmarx, Gearset DevOps, Semgrep, Black Duck Polaris Platform, SoftSpell, and CAST Imaging.

Underlying data: [Grid® JSON](https://www.g2.com/categories/static-code-analysis/grids.json?focus%5B%5D=sonarqube&focus%5B%5D=aikido-security&focus%5B%5D=checkmarx&focus%5B%5D=gearset-devops&focus%5B%5D=semgrep&focus%5B%5D=black-duck-polaris-platform&focus%5B%5D=softspell&focus%5B%5D=cast-imaging)

Invicti

Invicti (formerly known as Netsparker) is an enterprise application and API security testing platform that helps organizations secure thousands of web applications and APIs at scale while dramatically reducing the risk of attack. Combining advanced DAST and IAST capabilities in a single platform, Invicti enables security teams to continuously identify, prioritize, and remediate vulnerabilities across complex modern environments with confidence and automation. With Invicti, security teams can: - Automate application security testing workflows and save hundreds of hours every month - Discover and secure all web applications and APIs, including forgotten, unmanaged, and shadow assets - Deliver actionable, developer-friendly feedback that helps teams remediate vulnerabilities faster and build more secure code over time - Reduce false positives with proof-based scanning technology that validates exploitable vulnerabilities - Scale application security programs across large enterprises without slowing development teams - Integrate security seamlessly into existing DevSecOps and CI/CD workflows Built for organizations with the most demanding security requirements, Invicti empowers teams to confidently secure their entire attack surface with accuracy, scalability, and automation.

Average Rating: 4.5/5.0

Total Reviews: 69

How Do G2 Users Rate Invicti?

  • Has the product been a good partner in doing business?: 9.6/10 (Category avg: 8.7/10)
  • Ease of Admin: 9.2/10 (Category avg: 8.5/10)
  • Ease of Use: 9.1/10 (Category avg: 8.8/10)
  • What is your organization's estimated ROI on the product (payback period in months)?: 10/10 (Category avg: 10/10)

Who Is the Company Behind Invicti?

  • Seller: Invicti Security
  • Company Website:
  • Year Founded: 2018
  • HQ Location: Austin, Texas
  • Twitter: @InvictiSecurity
    2,557 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    326 employees on LinkedIn®

Who Uses This Product?

  • Top Industries: Computer Software, Information Technology and Services
  • Company Size: 46% Large, 29% Medium

What Do G2 Reviewers Say About Invicti?

AI-generated summary from verified user reviews

Pros
  • Users appreciate the ease of use of Invicti, facilitating quick setup and effective vulnerability scanning in their workflow.
  • Users value the quick and easy scanning technology of Invicti, enhancing workflow efficiency and accuracy in vulnerability detection.
  • Users value the simplicity and integration of Invicti, enhancing security measures through user-friendly report generation and detailed views.
  • Users value the easy-to-read and well-formatted reports from Invicti, enhancing efficiency and supporting ISO certification needs.
  • Users value the high accuracy and ease of use in Invicti's vulnerability detection, effectively identifying true issues.
Cons
  • Users find the customer support lacking, often experiencing slow responses and inadequate technical assistance.
  • Users experience slow performance during scans and setups, impacting overall efficiency and satisfaction.
  • Users experience slow scanning issues with Invicti, often leading to frustrating delays during the scanning process.
  • Users face API scanning issues with Invicti, limiting its effectiveness for their specific needs despite decent support.
  • Users find the complex setup of Invicti challenging initially, hindering their ability to quickly navigate configurations.

What Are Recent G2 Reviews of Invicti?

What Are G2 Users Discussing About Invicti?

JArchitect

JArchitect simplifies managing a complex Java code base. You can analyze code structure, specify design rules, do effective code reviews and master evolution by comparing different versions of the code.

Average Rating: 4.0/5.0

Total Reviews: 1

Who Is the Company Behind JArchitect?

  • Seller: CoderGears
  • Year Founded: 2009
  • HQ Location: Wilmington, US
  • Twitter: @CoderGears
    81 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    2 employees on LinkedIn®

Who Uses This Product?

  • Company Size: 100% Medium

What Are Recent G2 Reviews of JArchitect?

What Are G2 Users Discussing About JArchitect?

OCLint

OCLint is a static code analysis tool for improving quality and reducing defects by inspecting C, C++ and Objective-C code.

Average Rating: 4.0/5.0

Total Reviews: 1

How Do G2 Users Rate OCLint?

  • Ease of Use: 3.3/10 (Category avg: 8.8/10)

Who Is the Company Behind OCLint?

Who Uses This Product?

  • Company Size: 100% Medium

What Are Recent G2 Reviews of OCLint?

What Are G2 Users Discussing About OCLint?

AI can help you find the answers. G2 helps you trust them.

Connect G2 to Claude or ChatGPT for answers grounded in G2's trusted reviews, comparisons, and pricing from real user insights.

How it works

PT Application Inspector

PT Application Inspector™ (PT AI™) is a comprehensive source code analysis tool that offers protection for web applications of any scale. Its holistic approach combines the advantages of static, dynamic, and interactive analysis to maintain application security throughout every stage of development—from the very first line of code to the go-live.

Average Rating: 5.0/5.0

Total Reviews: 2

How Do G2 Users Rate PT Application Inspector?

  • Has the product been a good partner in doing business?: 10.0/10 (Category avg: 8.7/10)
  • Ease of Admin: 10.0/10 (Category avg: 8.5/10)
  • Ease of Use: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind PT Application Inspector?

Who Uses This Product?

  • Company Size: 67% Large, 33% Small

What Are Recent G2 Reviews of PT Application Inspector?

What Are G2 Users Discussing About PT Application Inspector?

PVS-Studio

PVS-Studio is a static application security testing (SAST) solution that helps enhance code quality, security, and safety. It detects bugs and potential vulnerabilities in C, C++, C#, Java, JavaScript, TypeScript and Go code on Windows, Linux, and macOS. Features: - Supports various analysis types: intermodular, incremental, data flow analysis, taint analysis; - Integrates into cloud platforms; - Works offline & on-premise; - Provides cross-platform integration; - Offers ways to handle false positives; - Quick technical support directly from developers; - 1200+ diagnostic rules with detailed descriptions and examples; - Compliance with safety & security standards: OWASP TOP 10, MISRA C/C++, CWE, SEI CERT; - Detailed reports and reminders for developers and managers; - Efficiently handles legacy code (baselining of analyzer results); - Active support of the Open Source Community, analysis of open-source projects; - Integration with popular IDEs, code quality platforms, CI/CD, build systems. Good option for: - game developers (Unity & UE integration included) - embedded developers (embedded platform support); - DevSecOps experts (CLI) - project managers (code quality platform integration included) - FinTech (compliance with OWASP ASVS) - mature projects (seamless legacy handling) More on website: pvs-studio.com Pricing - In the commercial version, prices are set on request and can be changed depending on the required set of features; - Free trial is available; - PVS-Studio may offer a free licensing option to students, MVPs, public experts in security, and contributors to open-source projects.

Average Rating: 5.0/5.0

Total Reviews: 1

How Do G2 Users Rate PVS-Studio?

  • Ease of Use: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind PVS-Studio?

  • Seller: PVS-Studio
  • Year Founded: 2008
  • HQ Location: Astana, KZ
  • Twitter: @Code_Analysis
    5,907 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    29 employees on LinkedIn®

Who Uses This Product?

  • Company Size: 100% Small

What Are Recent G2 Reviews of PVS-Studio?

What Are G2 Users Discussing About PVS-Studio?

Symbiotic Security

Symbiotic Security is an AI-powered cybersecurity company that embeds security directly into developer workflows. Symbiotic offers two complementary solutions: Symbiotic Flow for real-time detection and remediation in the IDE, Symbiotic Code for secure AI code generation with built-in policy enforcement. Our platform detects vulnerabilities as they're introduced whether from developers, AI assistants, or open source and instantly provides context-aware fixes with over 70% fewer false positives. Agentic AI remediation analyzes full context and automatically resolves issues before code reaches production. Customizable guardrails enforce organizational security policies directly into AI code generation, making secure-by-design the default. Each fix includes just-in-time training tailored to the vulnerability, helping developers build real security expertise. Teams see a 68% reduction in recurring vulnerabilities after three months while maintaining development velocity.

Average Rating: 5.0/5.0

Total Reviews: 3

How Do G2 Users Rate Symbiotic Security?

  • Ease of Use: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Symbiotic Security?

Who Uses This Product?

  • Company Size: 67% Small, 33% Large

What Do G2 Reviewers Say About Symbiotic Security?

AI-generated summary from verified user reviews

Pros
  • Users value the efficiency improvement from Symbiotic Security, significantly reducing development time and enhancing security proactively.
  • Users value the speed of development that Symbiotic Security offers by addressing security issues early in the process.
  • Users find Symbiotic Security super easy to use, significantly speeding up internal processes and enhancing code security.
  • Users value the proactive security integration of Symbiotic Security, enhancing efficiency and reducing tech debt in development.
  • Users value the accuracy of Symbiotic Security in identifying potential issues early, enhancing overall product security.

What Are Recent G2 Reviews of Symbiotic Security?

Yasca

Yasca is an open source program which looks for security vulnerabilities, code-quality, performance, and conformance to best practices in program source code, integrating with other open-source tools as needed.

Average Rating: 5.0/5.0

Total Reviews: 1

Who Is the Company Behind Yasca?

Who Uses This Product?

  • Company Size: 100% Large

What Are Recent G2 Reviews of Yasca?

What Are G2 Users Discussing About Yasca?

AI-code Verification Platform

Shipmoor is a local, vendor-neutral verification layer for AI-agent-written code. It composes deterministic scans, test evidence, and advisory review into one binding verdict instead of trusting an agent's word that a task is done. No source upload, no account required to start.

Who Is the Company Behind AI-code Verification Platform?

Axivion

Axivion Static Code Analysis helps developers check standard compliance, security vulnerabilities, and code quality issues for C and C++ code. It performs automated analysis to identify violations of coding guidelines like MISRA C and detect clones, dead code, and security vulnerabilities. Key features include coding standards compliance checking, metric monitoring, defect analysis, and certification for safety-critical software development.

Who Is the Company Behind Axivion?

  • Seller: Qt Group
  • Year Founded: 1995
  • HQ Location: Espoo, Finland
  • Twitter: @qtproject
    21,456 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    18 employees on LinkedIn®

Bearer

Bearer helps modern teams ship trustworthy products with the help of our code security SAST solution built for security, privacy and engineering teams. We combine sensitive data context with static code analysis to make security and privacy engineering simpler and smarter to maximize the ROI for your DevSecOps and central security team driven programs.

Average Rating: 5.0/5.0

Total Reviews: 1

How Do G2 Users Rate Bearer?

  • Ease of Use: 10.0/10 (Category avg: 8.8/10)

Who Is the Company Behind Bearer?

  • Seller: Bearer
  • Year Founded: 2019
  • HQ Location: Cambridge, US
  • Twitter: @BearerSH
    16 Twitter followers
  • LinkedIn® Page: www.linkedin.com
    25 employees on LinkedIn®

Who Uses This Product?

  • Company Size: 100% Medium

What Are Recent G2 Reviews of Bearer?

Better Code Hub

Write better code. With a Definition of Done. Better Code Hub checks your code base for compliance against 10 software engineering guidelines - and gives you immediate feedback on where to focus for quality improvements. https://github.com/marketplace/better-code-hub

Who Is the Company Behind Better Code Hub?

Bugsmirror MASST (Mobile Application Security Suite & Tools)

Bugsmirror Mobile Application Security Suite & Tools (MASST) is designed specifically for your business, providing scalable, end-to-end security for your mobile app. From detection to protection, MASST ensures your app is safeguarded against evolving security threats. With MASST, you can focus on growing your business, knowing your app is fully protected at every stage.

Who Is the Company Behind Bugsmirror MASST (Mobile Application Security Suite & Tools)?

Adam Crivello
AC
Researched and written by Adam Crivello
Updated October 3, 2024