Black Duck Coverity Static Analysis
SAST tool for finding code quality & security defects in large-scale software
Application SecurityStatic Application Security TestingHybridSMB · Mid-Market · EnterpriseCommercial
SAST tool for finding code quality & security defects in large-scale software
Checked October 2026.
Black Duck Coverity Static Analysis is a static application security testing tool that scans source code to identify code quality and security defects. The tool performs analysis across files and libraries to detect complex issues in software applications.
The product supports 22 programming languages including C, C++, C#, Java, JavaScript, Python, Go, PHP, Ruby, Kotlin, Swift, Dart, TypeScript, Fortran, Scala, Visual Basic, Salesforce Apex, NVIDIA CUDA, and others. It also provides support for over 200 frameworks and infrastructure-as-code platforms.
Coverity includes built-in compliance reporting capabilities for multiple security and industry standards. These include MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, ISO/IEC TS 17961, OWASP Top 10, OWASP Mobile Top 10, and CWE Top 25. The tool provides reports that categorize issues by type and severity to assist with prioritization and remediation tracking.
The static analysis engine is designed to analyze large-scale applications and provides coverage for Common Weakness Enumeration (CWE) categories. The tool aims to help development teams identify security vulnerabilities and code quality issues during the development process.
Sign in with a free account to see the full list.
Sign in with a free account to see the full list.
Our take
Enterprises with large C/C++ codebases and compliance mandates.
The gotcha with Coverity is operational overhead. This is not a solution you point at a repo and walk away from. Initial tuning to reduce false positives, configuring the analysis scope, and integrating results into developer workflows all require dedicated effort. It is also priced for enterprise budgets. Small teams or startups should look elsewhere. But for a large engineering organization with a compliance team asking hard questions about CWE coverage and DISA STIG adherence, Coverity is the solution that can actually answer those questions with evidence.
Reviewed by Nika (Nikoloz) Kokhreidze.
Common questions about Black Duck Coverity Static Analysis: features, pricing and alternatives.
Black Duck Coverity Static Analysis is a product by Black Duck Software, Inc. in the Static Application Security Testing category. It covers DevSecOps, OWASP and Source Code Analysis.
Black Duck Coverity Static Analysis is a commercial product. For pricing, visit https://blackduck.com/static-analysis-tools-sast/coverity.html or contact Black Duck Software, Inc..
Alternatives to Black Duck Coverity Static Analysis listed on CybersecTools:
Compare all Black Duck Coverity Static Analysis alternatives at https://cybersectools.com/alternatives/black-duck-coverity-static-analysis
Black Duck Coverity Static Analysis is available as hybrid. It is listed for smb, mid-market and enterprise organizations. Pricing is commercial. Ask Black Duck Software, Inc. for pricing and support terms.
Side by side: features, pricing model and the company behind each one.
Bearer CLI is a static application security testing tool that scans source code across multiple programming languages to identify and prioritize OWASP Top 10 and CWE Top 25 security vulnerabilities through data flow analysis.
Betterscan is an orchestration toolchain that coordinates multiple security tools to scan source code and infrastructure as code for security vulnerabilities, compliance risks, secrets, and misconfigurations.
IDE plugin for SAST and SCA scanning with real-time vulnerability detection
cfn-nag is a static analysis tool that scans AWS CloudFormation templates to identify security vulnerabilities and misconfigurations in infrastructure-as-code.
IaC security scanner detecting vulnerabilities and misconfigurations in templates
Checkov is a static analysis tool that scans infrastructure as code and performs software composition analysis to detect security misconfigurations and vulnerabilities in cloud infrastructure and dependencies.
Get a summary of this page from your assistant.
Mandos MCP: ask about all 9,027 products.
Connect your AI
Updated 2026-11-01
