Coverity vs Invicti comparison

Read 29 Invicti reviews

2,696 Views
1,507 Comparison Views

96% willing to recommend

Coverity

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Invicti and Coverity are leading application security solutions. Coverity seems to have the upper hand due to its robust features, which suggest better value.

Features: Invicti offers comprehensive vulnerability detection in dynamic application security testing, provides effective real-time scanning, and ensures competitive pricing. Coverity offers robust static analysis capabilities, integrates well with continuous integration pipelines, and delivers deeper code analysis.

Room for Improvement: Invicti requires enhanced reporting tools, more intuitive navigation, and better customization options. Coverity needs faster scanning speeds, more streamlined deployment processes, and reduced initial complexity.

Ease of Deployment and Customer Service: Invicti is known for quick setup times and thorough customer support, offering simplicity in installation. Coverity, while more complex to deploy, is preferred for its responsive and knowledgeable service team, valued for technical guidance.

Pricing and ROI: Invicti is praised for its affordable setup and quick return on investment. Coverity, despite higher initial costs, provides substantial long-term value through its advanced toolset. Invicti shines in cost-effectiveness, while Coverity's investment is justified by its comprehensive capabilities.

To learn more, read our detailed Coverity vs. Invicti Report (Updated: March 2025).

Coverity vs. Invicti

Download the complete report

Helped 845,406 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Coverity

Ranking in Static Application Security Testing (SAST)

4th

Average Rating

7.8

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

No ranking in other categories

Invicti

Ranking in Static Application Security Testing (SAST)

15th

Average Rating

8.2

Reviews Sentiment

7.3

Number of Reviews

Ranking in other categories

API Security (5th), Dynamic Application Security Testing (DAST) (3rd)

Mindshare comparison

As of April 2025, in the Static Application Security Testing (SAST) category, the mindshare of Coverity is 8.0%, up from 7.0% compared to the previous year. The mindshare of Invicti is 1.5%, up from 1.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Md. Shahriar Hussain

Information Security Analyst at Banglalink

Offers impressive reporting features with user-friendliness and high scalability

The solution can be easily setup but requires heavy integration due to the multiple types of port and programming languages involved. Comparing the resource requirements of the solution I would say it can be installed effortlessly. I would rate the initial setup an eight out of ten. A professional needs some pre-acquired knowledge to manage Coverity's deployment process, but the local solution partners provide support well enough for trouble-free deployment. The overall deployment process of Coverity took around two and a half hours in our organization. The deployment duration depends upon the operating system and resources including high-end RAM and CPU processors.

Read full review

Kunal M

Capability Center Leader, ETRM Platforms at Shell

Proactive scanning measures and realistic audit recommendations enhance development focus

Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment. This feature helps us focus on priorities and prioritize the development team's effort, integrating seamlessly with DevOps to facilitate proactive scans of environments. Invicti also provides audit recommendations that are quite realistic, making it easy to discuss plans with developers.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The interface of Coverity is quite good, and it is also easy to use."

"I like Coverity's capability to scan codes once we push it. We don't need more time to review our colleagues' codes. Its UI is pretty straightforward."

"What I find most effective about Coverity is its low rate of false positives. I've seen other platforms with many false positives, but with Coverity, most vulnerabilities it identifies are genuine. This allows me to focus on real issues."

"The most valuable feature is the integration with Jenkins."

"It help us identify the latest security vulnerabilities."

"It is a scalable solution."

"The tool as it is can be used for code quality improvement."

"The most valuable feature of Coverity is that it shows examples of what is actually wrong with the code."

More Coverity pros

"The most attractive feature was the reporting review tool. The reporting review was very impressive and produced very fruitful reports."

"The best features of Invicti are its ability to confirm access vulnerabilities, SSL injection vulnerabilities, and its connectors to other security tools."

"This tool is really fast and the information that they provide on vulnerabilities is pretty good."

"I like that it's stable and technical support is great."

"It correctly parses DOM and JS and has really good support for URL Rewrite rules, which is important for today's websites."

"The scanner is light on the network and does not impact the network when scans are running."

"The dashboard is really cool, and the features are really good. It tells you about the software version you're using in your web application. It gives you the entire technology stack, and that really helps. Both web and desktop apps are good in terms of application scanning. It has a lot of security checks that are easily customizable as per your requirements. It also has good customer support."

"Invicti's proactive scanning measures vulnerabilities each time we deploy or push code to a new environment."

More Invicti pros

Cons

"The product should include more customization options. The analytics is not as deep as compared to SonarQube."

"The solution is a bit complex to use in comparison to other products that have many plugins."

"Coverity takes a lot of time to dereference null pointers."

"Ideally, it would have a user-based license that does not have a restriction in the number of lines of code."

"There is an extra step in my organization that involves uploading to servers, which adds overhead."

"It should be easier to specify your own validation routines and sanitation routines."

"Right now, the Coverity executable is around 1.2GB to download. If they can reduce it to approximately 600 or 700MB, that would be great. If they decrease the executable, it will be much easier to work in an environment like Docker."

"Sometimes it's a bit hard to figure out how to use the product’s UI."

More Coverity cons

"Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerability remediation over time."

"They could enhance the support for data swap testing for the platform."

"Reporting should be improved. The reporting options should be made better for end-users. Currently, it is possible, but it's not the best. Being able to choose what I want to see in my reports rather than being given prefixed information would make my life easier. I had to depend on the API for getting the content that I wanted. If they could fix the reporting feature to make it more comprehensive and user-friendly, it would help a lot of end-users. Everything else was good about this product."

"The solution needs to make a more specific report."

"It would be better for listing and attacking Java-based web applications to exploit vulnerabilities."

"They don't really provide the proof of concept up to the level that we need in our organization. We are a consultancy firm, and we provide consultancy for the implementation and deployment solutions to our customers. When you run the scans and the scan is completed, it only shows the proof of exploit, which really doesn't work because the tool is running the scan and exploiting on the read-only form. You don't really know whether it is actually giving the proof of exploit. We cannot prove it manually to a customer that the exploit is genuine. It is really hard to perform it manually and prove it to the concerned development, remediation, and security teams. It is currently missing the static application security part of the application security, especially web application security. It would be really cool if they can integrate a SAS tool with their dynamic one."

"Asset scanning could be better. Once, it couldn't scan assets, and the issue was strange. The price doesn't fit the budget of small and medium-sized businesses."

"The solution's false positive analysis and vulnerability analysis libraries could be improved."

More Invicti cons

Pricing and Cost Advice

"I would rate Coverity's pricing as a nine out of ten. It's already very expensive, and it's a problem for us to get more licenses due to the price. The pricing model has some good aspects - for example, a personal license gives access to all languages without code limitations, which is better than some competitors. However, it's still a lot of money for us to spend."

"The solution's pricing is comparable to other products."

"The pricing is on the expensive side, and we are paying for a couple of items."

"I would rate the tool's pricing a one out of ten."

"Coverity’s price is on the higher side. It should be lower."

"The licensing fees are based on the number of lines of code."

"It is expensive."

"Coverity is very expensive."

More Coverity pricing and cost advice

"We never had any issues with the licensing; the price was within our assigned limits."

"We are using an NFR license and I do not know the exact price of the NFR license. I think 20 FQDN for three years would cost around 35,000 US Dollars."

"The solution is very expensive. It comes with a yearly subscription. We were paying 6000 dollars yearly for unlimited scans. We have three licenses; basic, business, and ultimate. We need ultimate because it has unlimited scan numbers."

"OWASP Zap is free and it has live updates, so that's a big plus."

"It is competitive in the security market."

"Netsparker is one of the costliest products in the market. It would help if they could allow us to scan multiple URLs on the same license."

"I think that price it too high, like other Security applications such as Acunetix, WebInspect, and so on."

"Invicti is best suited for large enterprises. I don't think small and medium-sized businesses can afford it. Maintenance costs aren't that great."

More Invicti pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

845,406 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

33%

Computer Software Company

14%

Financial Services Firm

Government

Educational Organization

52%

Financial Services Firm

Computer Software Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

What do you like most about Coverity?

The solution has improved our code quality and security very well.

What is your experience regarding pricing and costs for Coverity?

I do not know about the pricing.

What is your experience regarding pricing and costs for Netsparker Web Application Security Scanner?

As a technical user, I do not handle pricing or licensing, but I am aware that Invicti offers flexible licensing models based on organizational needs.

What do you like most about Invicti?

The most valuable feature of Invicti is getting baseline scanning and incremental scan.

What needs improvement with Invicti?

Invicti's reporting capabilities need enhancement. We need enterprise-level information instead of repo-level details. Unlike Appiro, Invicti does not provide portfolio-level insights into vulnerab...

SonarQube Server (formerly SonarQube) vs Coverity

Comparisons

Compared 50% of the time

Fortify on Demand vs Coverity

Compared 6% of the time

Klocwork vs Coverity

Compared 6% of the time

Polyspace Code Prover vs Coverity

Compared 5% of the time

Veracode vs Coverity

Compared 5% of the time

More Coverity Competitors

Acunetix vs Invicti

Compared 19% of the time

OWASP Zap vs Invicti

Compared 13% of the time

Qualys Web Application Scanning vs Invicti

Compared 6% of the time

Snyk vs Invicti

Compared 6% of the time

SonarQube Server (formerly SonarQube) vs Invicti

Compared 6% of the time

More Invicti Competitors

Product Reports

Coverity

Download Coverity product report

Download Invicti product report

Also Known As

Synopsys Static Analysis

Netsparker

Overview

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Black Duck

Invicti helps DevSecOps teams automate security tasks and save hundreds of hours each month by identifying web vulnerabilities that matter. Combining dynamic with interactive testing (DAST + IAST) and software composition analysis (SCA), Invicti scans every corner of an app to find what other tools miss with 99.98% accuracy, delivering on the promise of Zero Noise AppSec. Invicti helps discover all web assets — even ones that are lost, forgotten, or created by rogue departments. With an array of out-of-the-box integrations, DevSecOps teams can get ahead of their workloads to hit critical deadlines, improve processes, and communicate more effectively while reducing risk and hitting the ROI goals.

Sample Customers

SAP, Mega International, Thales Alenia Space

Samsung, The Walt Disney Company, T-Systems, ING Bank

Coverity vs. Invicti