Coverity Static vs Fortify Application Defender comparison

The compared Black Duck and OpenText solutions aren't in the same category. Black Duck is ranked #6 in SAST , with an average rating of 8.0, and holds a 4.2% mindshare in the category. OpenText is ranked #24 in AS , with an average rating of 8.0, and holds a 1.2% mindshare. Additionally, 89% of Black Duck users are willing to recommend the solution, compared to 81% of OpenText users who would recommend it.

Coverity Static

Read 43 Coverity Static reviews

10,075 Views
8,362 Comparison Views

89% willing to recommend

Fortify Application Defender

Read 11 Fortify Application Defender reviews

1,527 Views
1,267 Comparison Views

81% willing to recommend

Coverity Static

Fortify Application Defender

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Coverity Static and Fortify Application Defender based on real PeerSpot user reviews.

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Coverity Static vs. Fortify Application Defender Report (Updated: September 2022).

Buyer's Guide

Coverity Static vs. Fortify Application Defender

September 2022

Download the complete report

Helped 881,665 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Coverity Static

Average Rating

7.8

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (6th)

Fortify Application Defender

Average Rating

7.8

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Application Security Tools (24th)

Mindshare comparison

Coverity Static and Fortify Application Defender aren’t in the same category and serve different purposes. Coverity Static is designed for Static Application Security Testing (SAST) and holds a mindshare of 4.2%, down 7.9% compared to last year.
Fortify Application Defender, on the other hand, focuses on Application Security Tools, holds 1.2% mindshare, up 0.6% since last year.

Static Application Security Testing (SAST) Market Share Distribution
Product	Market Share (%)
Coverity Static	4.2%
SonarQube	18.2%
Checkmarx One	10.3%
Other	67.3%

Static Application Security Testing (SAST)

Application Security Tools Market Share Distribution
Product	Market Share (%)
Fortify Application Defender	1.2%
SonarQube	16.9%
Checkmarx One	9.9%
Other	72.0%

Application Security Tools

Featured Reviews

Kasiraja Thangapandian

Software Engineering Manager at Visteon Corporation

Using tools for compliance is beneficial but cost concerns persist

We have been using Coverity for quite a long period. It has been fine for our needs. I would rate Coverity between eight to nine, though the cost is high. I would rate their support from Coverity as six. That is the main complaint, but we still appreciate having it.

Read full review

VinothSivam

CTO at Abcl

Useful for fast code review in devOps pipelines

I rate the tool's scalability a seven out of ten. However, I'm concerned about how it handles an increasing number of lines of code. As the complexity grows, so does the time it takes for the tool to review everything. I want more clarity on how Fortify Application Defender handles multiple threats. We have numerous endpoints, but the tool runs in our pipeline, meaning it operates in the cloud. All our code is configured there, and the tool runs integration testing, unit testing, user testing, and final production code tests. It's a day-to-day experience. It's utilized almost every day as part of our pipeline runs. Each team responsible for integration testing, human testing, user access testing, and preproduction testing runs it whenever they take a build.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"This solution is easy to use."

"It's very stable."

"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."

"The interface of Coverity is quite good, and it is also easy to use."

"One of the most valuable features is Contributing Events. That particular feature helps the developer understand the root cause of a defect. So you can locate the starting point of the defect and figure out exactly how it is being exploited."

"The reporting feature is up to the mark."

"The most valuable feature of Coverity is its software security feature called the Checker. If you share some vulnerability or weakness then the software can find any potential security bug or defect. The code integration tool enables some secure coding standards and implements some Checkers for Live Duo. So we can enable secure coding and Azure in this tool. So in our software, we can make sure our software combines some industry supervised data."

"Coverity gives advisory and deviation features, which are some of the parts I liked."

More Coverity Static pros

"The tool's most valuable feature is software composition analysis. This feature works well with my .NET applications, providing a better understanding of library vulnerabilities."

"The most valuable feature is the ability to automatically feed it rules what it's coupled with the WebInspect dynamic application scanning technology."

"Its ability to find security defects is valuable."

"Fortify Application Defender's most valuable features are machine learning algorithms, real-time remediation, and automatic vulnerability notifications."

"We are able to provide out customers with a secure application after development. They are no longer left wondering if they are vulnerable to different threats within the market following deployment."

"The most valuable feature is that it analyzes data in real-time."

"The solution helped us to improve the code quality of our organization."

"The most valuable features of Fortify Application Defender are the code packages that are default."

More Fortify Application Defender pros

Cons

"There is an extra step in my organization that involves uploading to servers, which adds overhead."

"There should be additional IDE support."

"We actually specified several checkers, but we found some checkers had a higher false positive rate. I think this is a problem. Because we have to waste some time is really the issue because the issue is not an issue. I mean, the tool pauses or an issue, but the same issue is the filter now.Some check checkers cannot find some issues, but sometimes they find issues that are not relevant, right, that are not really issues. Some customisation mechanism can be added in the next release so that we can define our Checker. The Modelling feature provided by Coverity helps in finding more information for potential issues but it is not mature enough, it should be mature. The fast testing feature for security testing campaign can be added as well. So if you correctly integrate it with the training team, maybe you can help us to find more potential issues."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"Coverity is not a user-friendly product."

"Coverity is not stable."

"Some features are not performing well, like duplicate detection and switch case situations."

"The tool needs to improve its reporting."

More Coverity Static cons

"The false positive rate should be lower."

"The product should integrate industry-standard code review tools internally with its system. This would streamline the coding process, as developers wouldn't need multiple tools for code review and security checks. Many independent and open-source tools are available, from Apache to various libraries. Using multiple DevOps pipeline tools can slow the turnaround time."

"Fortify Application Defender could improve by supporting more code languages, such as GRAAS and Groovy."

"The workbench is a little bit complex when you first start using it."

"The solution is quite expensive."

"Fortify Application Defender gives a lot of false positives."

"The solution could improve the time it takes to scan. When comparing it to SonarQube it does it in minutes while in Fortify Application Defender it can take hours."

"The licensing can be a little complex."

More Fortify Application Defender cons

Pricing and Cost Advice

"The tool was fairly priced."

"This is a pretty expensive solution. The overall value of the solution could be improved if the price was reduced. Licensing is done on an annual basis."

"The price is competitive with other solutions."

"The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten."

"The licensing fees are based on the number of lines of code."

"The pricing is on the expensive side, and we are paying for a couple of items."

"Coverity is very expensive."

"Coverity’s price is on the higher side. It should be lower."

More Coverity Static pricing and cost advice

"The price of this solution could be less expensive."

"Fortify Application Defender is very expensive."

"The product’s price is much higher than other tools."

"The base licensing costs for the SaaS platform is about $900 USD per application, per year."

"I rate the solution's pricing a five out of ten. It comes as an annual cloud subscription. The tool's pricing is around 50 lakhs."

"The licensing is very complex, it's project based and can range from $10,000 to $200,000+ depending on the project type and size."

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

881,665 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

32%

Computer Software Company

11%

Financial Services Firm

Healthcare Company

Financial Services Firm

15%

Manufacturing Company

12%

Government

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	1
Large Enterprise	8

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

What do you like most about Coverity?

The solution has improved our code quality and security very well.

See all answers

What is your experience regarding pricing and costs for Coverity?

I do not know about the pricing.

See all answers

What do you like most about Fortify Application Defender?

I find the configuration of rules in Fortify Application Defender useful. Its integration is also easy.

See all answers

What needs improvement with Fortify Application Defender?

The product should integrate industry-standard code review tools internally with its system. This would streamline the coding process, as developers wouldn't need multiple tools for code review and...

See all answers

What is your primary use case for Fortify Application Defender?

We use the solution for fast code review. It is integrated into our DevOps pipeline.

See all answers

Comparisons

SonarQube vs Coverity Static

Compared 29% of the time

Klocwork vs Coverity Static

Compared 8% of the time

CodeSonar vs Coverity Static

Compared 6% of the time

Veracode vs Coverity Static

Compared 6% of the time

Polyspace Code Prover vs Coverity Static

Compared 6% of the time

More Coverity Static Competitors

Checkmarx One vs Fortify Application Defender

Compared 14% of the time

SonarQube vs Fortify Application Defender

Compared 9% of the time

Klocwork vs Fortify Application Defender

Compared 5% of the time

Qualys Web Application Scanning vs Fortify Application Defender

Compared 5% of the time

Veracode vs Fortify Application Defender

Compared 5% of the time

More Fortify Application Defender Competitors

Product Reports

Buyer's Guide

Coverity Static

January 2026

Download Coverity Static product report

Buyer's Guide

Application Security Tools

January 2026

Download Fortify Application Defender product report

Also Known As

Synopsys Static Analysis

HPE Fortify Application Defender, Micro Focus Fortify Application Defender

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Black Duck

Micro Focus Security Fortify Application Defender is a runtime application self-protection (RASP) solution that helps you manage and mitigate risk from homegrown or third-party applications. It provides centralized visibility into application use and abuse while protecting from software vulnerability exploits and other violations in real time.

OpenText

Sample Customers

SAP, Mega International, Thales Alenia Space

ServiceMaster, Saltworks, SAP

Buyer's Guide

Coverity Static vs. Fortify Application Defender

September 2022

Free Report: Coverity Static vs. Fortify Application Defender

Find out what your peers are saying about Coverity Static vs. Fortify Application Defender and other solutions. Updated: September 2022.

DOWNLOAD NOW

881,665 professionals have used our research since 2012.

See our Coverity Static vs. Fortify Application Defender report.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.