G2

Chris W.

Software Assurance Tools Program Manager/Static Analysis Domain Expert

Mid-Market (51-1000 emp.)

12/9/2021

"Klocwork is a very mature, robust and helpful static code analysis tool"

5/5

What do you like best about Klocwork?

Klocwork does a really good job of finding the most critical defects. The incremental build capabilities to compare results between different versions of the software is very helpful. The web review interface is intuitive and supports effective review of any analysis results. Review collected by and hosted on G2.com.

What do you dislike about Klocwork?

It would be great to have continued improvements in creating possible custom checkers tailored to your specific software under analysis. It would also be helpful to provide even more robust export and reporting capabilities for the results so that we can more readily incorporate analysis results into other business processes where appropriate in the organization. Review collected by and hosted on G2.com.

Recommendations to others considering Klocwork:

The most important thing is always to focus on making the tool work for your specific business needs, so don't get hung up on every particular feature of the tool itself. Make the tool work for what is essential to your business.

It would be wise to consider integrating it into an automated development operations pipeline if possible. We use Docker to containerize specific software builds. We use Jenkins as our build automation server to provide a complete end-to-end pipeline for supporting the automated use of Klocwork and other tools for analysis against our target software.

We have found it helpful to review the default checker configuration with our software team before analyzing the target software. This approach helps us to understand better what results are of most interest to us before starting the process of generating multiple analysis builds for review. It is also helpful to review the initial set of generated results to determine if any particular checkers may be causing some "noise" in terms of a significant number of results or possible false positives. We may decide to disable a select number of checkers for the following analysis build.

Finally, it is crucial to maintain awareness of new features and any patches that the vendor may release to best support the tool for any users. Review collected by and hosted on G2.com.

What problems is Klocwork solving and how is that benefiting you?

We perform independent verification and validation of mission-critical software. Klocwork helps us to prioritize our analysis efforts in the areas of most concern to start, including any possible security aspects, which have been a significant focus recently. Review collected by and hosted on G2.com.