TechValidate Research on Klocwork

Agreed that for static code analysis tools, key features include:

• The ease of setting up and running static code analysis
• Integration into CI/CD systems
• Differential analysis for speed and efficiency
• The ability to support huge codebases
• Support for all coding languages that we use
• No need to pre-process code prior to scanning

Importance of the following:

• Have a consistent pricing model from your Static Application Security Testing (SAST) tool vendor: very Important
• Have a SAST tool that can be executed via flexible deployment options (Desktop/IDE/CI/Cloud/Containers): important
• Have customizable quality reports and analysis: important
• Get accurate and clean of noise reports: important

Said that audit and/or stakeholder-ready scan results help to speed up release cycles and time to market faster.

They are not comfortable with sharing and uploading their source code to an SAST tool vendor cloud.

Security and safety coding standards coverage most important for them:

• CERT
• JSF AV C++

Enterprise console and reporting framework capabilities they value the most:

• Control access permissions and approval workflows
• Prioritize defects based on severity, location, and lifecycle

For static code analysis tools, key features include:

• The ease of setting up and running static code analysis: strongly agree
• Integration into CI/CD systems: agree
• Differential analysis for speed and efficiency: disagree
• The ability to support huge codebases: disagree
• Support for all coding languages that we use: neither agree nor disagree
• No need to pre-process code prior to scanning: strongly agree

Importance of the following:

• Have a consistent pricing model from your Static Application Security Testing (SAST) tool vendor: important
• Have a SAST tool that can be executed via flexible deployment options (Desktop/IDE/CI/Cloud/Containers): critical
• Have customizable quality reports and analysis: very Important
• Get accurate and clean of noise reports: critical

Said that audit and/or stakeholder-ready scan results help to speed up release cycles and time to market significantly faster.

They are comfortable with sharing and uploading their source code to a SAST tool vendor cloud.

Security and safety coding standards coverage most important for them:

• OWASP
• CERT
• CWE Top25
• MISRA,
• JSF AV C++

Enterprise console and reporting framework capabilities they value the most:

• Defining global or project-specific QA and security objectives and rule configurations
• View trending and metrics data for project quality and compliance
• Compliance and security reports
• Prioritize defects based on severity, location, and lifecycle
• Distinguish new issues from legacy code issues