--- title: Black Duck Coverity Static Reviews meta\_title: 'Black Duck Coverity Static Reviews 2026: Details, Pricing, & Features | G2' meta\_description: Filter 65 reviews by the users' company size, role or industry to find out how Black Duck Coverity Static works for a business like yours. aggregate\_rating: rating\_value: 4.3 review\_count: 65 scale: '5' date\_modified: '2026-08-09' parent\_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- # Black Duck Coverity Static Reviews & Product Details Claimed ###### Profile Status This profile is currently managed by Black Duck Coverity Static but has limited features. Are you part of the Black Duck Coverity Static team? [Upgrade your plan](https://sell.g2.com) to enhance your branding and engage with visitors to your profile! Coverity® is a fast, accurate, and highly scalable static analysis (SAST) solution that helps development and security teams address security and quality defects early in the software development life cycle (SDLC), track and manage risks across the application portfolio, and ensure compliance with security and coding standards. * * * Seller [Black Duck](https://www.g2.com/sellers/black-duck) Discussions [Black Duck Coverity Static Community](https://www.g2.com/products/black-duck-coverity-static/discuss) Solution Type Best-of-Breed Overview by Jenny Eng Show More ## Value at a Glance Averages based on real user reviews. ### Time to Implement 4 months ### Return on Investment 16 months [ View More Pricing Information ](https://www.g2.com/products/black-duck-coverity-static/pricing) ## Top-Rated Alternatives [ ![SonarQube](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "SonarQube") SonarQube 4.4/5(155) ](https://www.g2.com/products/sonarqube/reviews) [ ![Checkmarx](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Checkmarx") Checkmarx 4.2/5(48) ](https://www.g2.com/products/checkmarx/reviews) [ ![Veracode Application Security Platform](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Veracode Application Security Platform") Veracode Application Security Platform 3.8/5(26) ](https://www.g2.com/products/veracode-application-security-platform/reviews) [ View All Alternatives ](https://www.g2.com/products/black-duck-coverity-static/competitors/alternatives) ## User Insights Average based on 65 real user reviews. Implementation Time 4 months Perceived Cost $$$$$ [Log in to unlock pricing and user insights](/login) ![Glenn D.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Glenn D.") GD Glenn D. Mid-Market (51-1000 emp.) 6/16/2020 "I worked for Coverity Training." 5/5 What do you like best about Black Duck Coverity Static? I worked for the company so I may be biased. That said, the customers who used it were happy with how well it worked, the depth of the analysis, and how few false positives were given. Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? This is compiler-level analysis so for 50 million lines of code it takes time. The results are worth it. Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: Try it on a sample to understand the accuracy of the analysis. Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? On average, for 1 million lines of code it would identify 200 actual defects. True positives. The Linux kernel was analyzed as proof of dependability. There you can see the defects found and fixed. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Seller invite ![Verified User in Telecommunications](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Telecommunications") UT Verified User in Telecommunications Mid-Market (51-1000 emp.) 6/3/2020 "Find and fix your defects in C or C++ using the Coverity tool for static analysis." 4.5/5 What do you like best about Black Duck Coverity Static? Coverity Scan is used for static code analysis of Open Source projects. It can analyze C, C++, and Java code. Coverity’s static code analysis doesn’t run the code. Instead, it uses abstract interpretation to gain information about the code’s control flow and data flow. It’s able to follow all possible code paths that a program may take. For example, the analyzer understands that malloc() returns memory that must be freed with free() later. It follows all branches and function calls to see if all possible combinations free the memory. The analyzer is able to detect all sorts of issues like resource leaks (memory, file descriptors), NULL dereferencing, use after free, unchecked return values, dead code, buffer overflows, integer overflows, uninitialized variables, and many more. Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? {"translation":"In some cases, it may not be precise. There could be incorrect identifications."} Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Buffer Overflow, unreferenced null, resource leak Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Priyanka S.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Priyanka S.") PS Priyanka S. Software Engineer Enterprise (\> 1000 emp.) 6/1/2020 "Quite useful for project code run analysis and keep a record" 5/5 What do you like best about Black Duck Coverity Static? Organised way of keeping Defect records and quite through coverage of Code defects like memory leakage, unused variable, etc... Good for CI/CD implementation. Best for very large amount of Code and recudes manual power consumption majorly Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? Not much coverage for Typescript and JavaScript. It's Manual can be enhanced by adding more practical commands and real-time images Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: Try it out, if you find any obstruction Coverity Support system is very active and thrill to help always Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Not much informative manual. Difficult to find commands for Typescript and how to confirm if it is working fine or how to check its relaibility Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") IC Verified User in Computer Software Small-Business (50 or fewer emp.) 6/10/2020 "My Experience at Coverity" 4/5 What do you like best about Black Duck Coverity Static? I was there pretty early and the people were great - made some of my best friendships - Also, it was a new a tech and way of helping coders Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? As the company grew, new management came in and the culture changed from what we new. It wasn' "bad", but it was different. Most people complain about changing culture so nothing shocking to report :) Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: Just run your code through and see the high-level results. Pretty amazing what you will find Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Solving efficiencies in coding and hidden vulnerabilities in millions of lines of code. Great part about it is Coverity could be run and show the customer in 24 hours where there were red-flags to review Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Verified User in Telecommunications](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Telecommunications") UT Verified User in Telecommunications Mid-Market (51-1000 emp.) 6/12/2020 "Static Code Analyzer" 4/5 What do you like best about Black Duck Coverity Static? the way the coverity generates the report for various issue like "possible leak", "variable going outof scope", this helps in fixing the issues which developers would have introduced due to quick fixes in the code. Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? Some of issues which are reported by coverity will be false positive, the tool can be improved in those areas and i also would like coverity to add support for run time code analysis. Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: i would recommend considering it results Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? possible memory leak, variable going out of scope. These errors reported by coverity helps in re-looking the code and helps us to rethink and re-design the code in a better way so that production issues will be minimized. Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Amit G.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Amit G.") AG Amit G. Principal Software Engineer Enterprise (\> 1000 emp.) 6/20/2020 "Amit Gadekar's review" 4/5 What do you like best about Black Duck Coverity Static? Coverity comes packed with loads of features for static code analysis. Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? Not compatible with all of the programming languages. Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Mainly Coverity has helped us a lot in finding the loop holes which could have lead any attacker to breach into the web application. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Seller invite ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") AC Verified User in Computer Software Mid-Market (51-1000 emp.) 6/15/2020 "Effective tool for C/C++ static code analysis" 4/5 What do you like best about Black Duck Coverity Static? That it supports languages like C/C++ which most of the commercial tool don't support Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? What I didn't like was tracing down the issues in source code file. Also, the user interface can be better. Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? I used Coverity to scan source code written in C language which either many other tools don't support or not that effective. Coverity dows a good job there. Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Verified User in Computer & Network Security](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer & Network Security") UC Verified User in Computer & Network Security Enterprise (\> 1000 emp.) 7/27/2020 "Accuracy with speeds in SW Development" 4.5/5 What do you like best about Black Duck Coverity Static? Passive code scanning Quick turnaround Cost-effective bug fixes Helps to implement security as a process in day-to-day activities Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? Speed in bug scanning False alarms Custom rules implementation Cloud integration Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: Cost and quality delta improvements Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Critical security flaws Implement company-wide security controls Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 invite ![Verified User in Oil & Energy](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Oil & Energy") UO Verified User in Oil & Energy Small-Business (50 or fewer emp.) 6/27/2020 "Excellent tool for static analysis and memory debugging" 5/5 What do you like best about Black Duck Coverity Static? Identifying memory leaks, null dereference Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? Coverity setup takes very long. Usability needs to be improved. Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? Defects and vulnerabilities like memory leaks, dereference of null pointers, use of uninitialised data can be found out using coverity tool. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Seller invite ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") AC Verified User in Computer Software Mid-Market (51-1000 emp.) 9/26/2019 "Nice overall security scanner" 3.5/5 What do you like best about Black Duck Coverity Static? It's detection, it's UI and its ability to kick out nice reports Review collected by and hosted on G2.com. What do you dislike about Black Duck Coverity Static? It did miss a few minor things when we compared against other scanners Review collected by and hosted on G2.com. Recommendations to others considering Black Duck Coverity Static: Use Jenkins to scan the code both the raw code and also at compile time when it's pulling in all the libraries and dependencies. Whenever a MR is submitted to Gitlab, it triggers a Jenkins job which will scan the raw code. Whenever a Jenkins build is tagged as release candidate, Coverity gets pulled in after everything is downloaded and built/compiled/etc. Review collected by and hosted on G2.com. What problems is Black Duck Coverity Static solving and how is that benefiting you? It picked up all the big ones and it picked up a lot more stuff overall than the other scanners. The stuff it picked up was legitimate also, not a lot of false positives/alerts, useless noise that didn't warrant attention. We did a comprehensive analysis against multiple security scanners and spent 2 days comparing the scanning results of 4 different scanners against 4 different git repositories, aligning all the detections next to each other to see how they matched up, and in the end, Coverity won. Review collected by and hosted on G2.com. Show More Validated ReviewerIncentivizedSource: G2 Gives Campaign ## Questions about Black Duck Coverity Static? Ask real users or explore answers from the community Get practical answers, real workflows, and honest pros and cons from the G2 community or share your insights. [ Ask about Black Duck Coverity Static ](https://www.g2.com/products/black-duck-coverity-static/discussions/new) GU Guest User What is Coverity used for? 0 Upvotes 0 [ Join the conversation ](https://www.g2.com/discussions/what-is-coverity-used-for) [ View all Discussions ](https://www.g2.com/products/black-duck-coverity-static/discuss) ## Pricing Insights Averages based on real user reviews. ### Time to Implement 4 months ### Return on Investment 16 months ### Perceived Cost $$$$$ [ View More Pricing Information ](https://www.g2.com/products/black-duck-coverity-static/pricing) Black Duck Coverity Static Comparisons ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_a4dc620644f85fd7e4f00b0a2267d09c/sonarqube.png "Product Avatar Image") SonarQube 4.4/5(155) [ Compare Now ](https://www.g2.com/compare/black-duck-coverity-static-vs-sonarqube) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_9c1730ad68b323f13e6809169d249245/checkmarx%282%29.png "Product Avatar Image") Checkmarx 4.2/5(48) [ Compare Now ](https://www.g2.com/compare/black-duck-coverity-static-vs-checkmarx) ![Product Avatar Image](https://images.g2crowd.com/uploads/product/image/small_square/small_square_3d509cff58c24e8af4ca3ad0ef140936/klocwork.png "Product Avatar Image") Klocwork 4.4/5(23) [ Compare Now ](https://www.g2.com/compare/black-duck-coverity-static-vs-klocwork) ##### ##### Black Duck Coverity Static Features Administration API / Integrations Extensibility Analysis Real-Time Analytics Issue Tracking Static Code Analysis Testing Command-Line Tools Manual Testing Test Automation [ View More Features ](https://www.g2.com/products/black-duck-coverity-static/features) ##### Categories on G2 [Static Application Security Testing (SAST)](https://www.g2.com/categories/static-application-security-testing-sast)[Secure Code Review](https://www.g2.com/categories/secure-code-review)[Static Code Analysis](https://www.g2.com/categories/static-code-analysis) ##### Explore More [What's the best affiliate marketing software for beginners](https://www.g2.com/discussions/what-s-the-best-affiliate-marketing-software-for-beginners)[Which auditing services platforms integrate seamlessly with existing enterprise systems and workflow tools?](https://www.g2.com/discussions/which-auditing-services-platforms-integrate-seamlessly-with-existing-enterprise-systems-and-workflow-tools)[Which content analytics software is easiest to use?](https://www.g2.com/discussions/which-content-analytics-software-is-the-easiest-to-use) [Best cloud management software for large scale apps](https://www.g2.com/discussions/best-cloud-management-software-for-large-scale-applications)[best customer success software](https://www.g2.com/discussions/i-need-help-finding-the-best-customer-success-software-advice-needed)[Which cloud kitchen management vendors don't charge per-order fees and offer clear implementation expectations for growing restaurant brands?](https://www.g2.com/discussions/which-cloud-kitchen-management-vendors-don-t-charge-per-order-fees-and-offer-clear-implementation-expectations-for-growing-restaurant-brands) [Show MoreShow Less](javascript:void(0);)