Klocwork vs Mend.io comparison

Read 29 Mend.io reviews

9,724 Views
5,701 Comparison Views

96% willing to recommend

Klocwork

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Klocwork and Mend.io based on real PeerSpot user reviews.

Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Klocwork vs. Mend.io Report (Updated: May 2024).

Download the complete report

Klocwork vs. Mend.io

May 2024

Helped 787,061 peers since 2012

Categories and Ranking

Klocwork

Ranking in Application Security Tools

15th

Average Rating

8.2

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (12th), Static Code Analysis (4th)

Mend.io

Ranking in Application Security Tools

13th

Average Rating

8.4

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (4th), Software Supply Chain Security (1st)

Market share comparison

As of June 2024, in the Application Security Tools category, the market share of Klocwork is 1.6% and it increased by 1.8% compared to the previous year. The market share of Mend.io is 3.6% and it increased by 0.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Unique Categories:

Static Application Security Testing (SAST)

1.6%

Static Code Analysis

3.4%

Software Composition Analysis (SCA)

7.6%

Software Supply Chain Security

2.5%

Featured Reviews

reviewer2180745

Principle engineer at a manufacturing company with 10,001+ employees

May 10, 2023

Their technical team helps us get the most out of the solution, but we've faced some stability problems in our environment

Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective. Maybe there could be a process by which the clients can update themselves as they reconnect to the new server when there's a new version available and install all of the tools currently within that installation environment.

Read full review

Kieran Whelan

Principal Security Engineer at Texthelp Ltd.

Jan 10, 2023

It improved our mean time to resolution and works seamlessly

Mend lets you create custom policies. They're not too complicated to set up, but it would be helpful if they had some preconfigured policies to match what we have in Azure DevOps. That would save us a lot of time. It's tedious to configure the policies manually, and I lack the capacity to do it right now. Other products have preconfigured packs and templates, and Mend doesn't. Also, the dashboard is busy. It's a little bit over-engineered. There's a lot of information, and the layout could be a bit cleaner. Maybe they could reduce the amount of visibility on the dashboard.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I like not having to dig through false positives. Chasing down a false positive can take anywhere from five minutes for a small easy one, then something that is complicated and goes through a whole bunch of different class cases, and it can take up to 45 minutes to an hour to find out if it is a false positive or not."

"The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies. I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python."

"The reporting helps us understand the trend of our results and whether we improve over time. We can see the history within Klocwork's server architecture and know that we're making things better. It creates a great story for our management. We can demonstrate value and how our software is developing over time."

"Klocwork's most valuable feature is the static code analysis feature. It detects the potential problem earlier to allow the developer to receive feedback quickly and then address it before it becomes a problem."

"We like using the static analysis and code refactoring, which are very valuable because of our requirements to meet safety critical levels and reliability."

"It's integrated into our CI, continuous integration."

"One can increase the number of vendors, so the solution is scalable."

"There is a central Klocwork server at our headquarter in France so we connect the client directly to the server on-premises remotely."

More Klocwork pros

"For us, the most valuable tool was open-source licensing analysis."

"The most valuable features are the reporting, customizing libraries "In-house, White list, license selection", comparing the products/projects, and License & Copyright resolution."

"What is very nice is that the product is very easy to set up. When you want to implement Mend.io, it just takes a few minutes to create your organization, create your products, and scan them. It's really convenient to have Mend scanning your products in less than one hour."

"WhiteSource helped reduce our mean time to resolution since the adoption of the product."

"The results and the dashboard they provide are good."

"The solution boasts a broad range of features and covers much of what an ideal SCA tool should."

"The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulnerability, we usually get a dedicated email from our R&D team saying that this particular vulnerability has been exploited in the world, and we should definitely check our project for this and take corrective actions."

"The most valuable feature is the inventory, where it compiles a list of all of the third-party libraries that we have on our estate."

More Mend.io pros

Cons

"We'd like to see integration with Agile DevOps and Agile methodologies."

"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."

"I hope that in each new release they add new features relating to the addition of checkers, improving their analysis engines etc."

"I would like to see better codes between projects and a more user-friendly desktop in the next release."

"Klocwork does have a problem with true positives. It only found 30% of true positives in the Juliet test case."

"I believe it should support more languages, such as Python and JavaScript."

"The way to define the rules is too complex. The definition/rules for static analysis could be automated according to various SILs, so as to avoid confusion."

"What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."

More Klocwork cons

"WhiteSource needs improvement in the scanning of the containers and images with distinguishing the layers."

"We have been looking at how we could improve the automation to human involvement ratio from 60:40 to 70:30, or even potentially 80:20, as there is room for improvement here. We are discussing this internally and with Mend; they are very accommodating to us. We think they openly receive our feedback and do their best to implement our thoughts into the roadmap."

"It would be good if it can do dynamic code analysis. It is not necessarily in that space, but it can do more because we have too many tools. Their partner relationship support is a little bit confusing. They haven't really streamlined the support process when we buy through a reseller. They should improve their process."

"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."

"WhiteSource only produces a report, which is nice to look at. However, you have to check that report every week, to see if something was found that you don't want. It would be great if the build that's generating a report would fail if it finds a very important vulnerability, for instance."

"The solution lacks the code snippet part."

"We have ended our relationship with WhiteSource. We were using an agent that we built in the pipeline so that you can scan the projects during build time. But unfortunately, that agent didn't work at all. We have more than 500 projects, and it doubled or tripled the build time. For other projects, we had the failure of the builds without any known reason. It was not usable at all. We spent maybe one year working on the issues to try to make it work, but it didn't in the end. We should be able to integrate it with ID and Shift Left so that the developers are able to see the scan results without waiting for the build to fail."

"The initial setup could be simplified."

More Mend.io cons

Pricing and Cost Advice

"This solution offers competitive pricing."

"There are other solutions on the market such as Microsoft Visual Studio. They have been adding more static code analysis features that come for free. It is getting better all the time. That is one of the possibilities is that we've been considering that we may stop using the Klocwork because it doesn't give us any added value."

"Licensing fees are paid annually, but they also have a perpetual license."

"The limitation that we have is that Klocwork is licensed to certain programs, and if you want to license them to other programs, you have to pay more money."

"Klocwork should not to be quite so heavy handed on the licensing for very specific programs."

"The pricing for Klocwork is very competitive if you compare it from apple to apple. It has competitive pricing regarding the licensing model and the per-license cost. Klocwork isn't a high-end investment for anyone deploying it; even SMBs can afford it. The Klocwork cost per user would depend on the license type, so I'm unable to mention a ballpark figure because it would depend on the type of installation and how the deployment will be, and the nodes to give an accurate calculation or figure. The total price depends on the package, so my company could never publish pricing for Klocwork on the website. My team first collects information from potential clients on the deployment scenario, project environment, etc., before suggesting a package for Klocwork. My rating for Klocwork in terms of pricing is a five because of its flexible license models. There's a license model for every type of organization, whether small, midsize, or enterprise, so it's a five out of five for me."

"When it comes to licensing, the solution has two packages, one for a fixed and the other for a floating server, with the former being more cost effective than the latter."

"Klocwork is still tight on their licensing. If Klocwork would loosen up on the licensing, and where the license could be used, and how many different programs could be run on it, then we have several development programs that I would love to be able to use it for going forward."

"It is fairly priced."

"The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps."

"This is an expensive solution."

"Its pricing model is per developer. It depends on the number of developers in the company. The license is for a minimum of 20 developers. So, even if you are a small startup with less than 10 developers, you have to buy a license for 20 developers on a yearly subscription, which makes it quite expensive for startup customers. I provide consultation to startup accelerators. They're small at the beginning, and only once they grow to 20 developers, they can afford this tool. As a result, WhiteSource is missing this target audience. Their licensing is not flexible."

"When comparing the price of WhiteSource to the competition it is priced well. The cost for 50 users is approximately $18,000 annually."

"Over the last two years, they have tried to add more and more features to their license packages, but the price is a little bit high, comparatively."

"Pricing is competitive."

"The solution involves a yearly licensing fee."

More Mend.io pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

787,061 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Educational Organization

39%

Manufacturing Company

19%

Computer Software Company

10%

Financial Services Firm

17%

Computer Software Company

16%

Manufacturing Company

11%

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Klocwork?

It's integrated into our CI, continuous integration.

What is your experience regarding pricing and costs for Klocwork?

Our purchasing department is responsible for tracking costs. It's one of the most widely used tools in our organization. It likely does not have a high price point. I don't have insights into licen...

What needs improvement with Klocwork?

The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze. It will show all poss...

How does WhiteSource compare with SonarQube?

Red Hat Ceph does well in simplifying storage integration by replacing the need for numerous storage solutions. This solution allows for multiple copies of replicated and coded pools to be kept, ea...

How does WhiteSource compare with Black Duck?

We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license compl...

What do you like most about Mend.io?

The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulner...

Polyspace Code Prover vs Klocwork

Comparisons

SonarQube vs Klocwork

Compared 36% of the time

Coverity vs Klocwork

Compared 35% of the time

Compared 10% of the time

Checkmarx One vs Klocwork

Compared 5% of the time

CodeSonar vs Klocwork

Compared 5% of the time

More Klocwork Competitors

SonarQube vs Mend.io

Compared 26% of the time

Black Duck vs Mend.io

Compared 16% of the time

Veracode vs Mend.io

Compared 9% of the time

Snyk vs Mend.io

Compared 8% of the time

Checkmarx One vs Mend.io

Compared 8% of the time

More Mend.io Competitors

Product Reports

Download Klocwork product report

Klocwork

June 2024

Download Mend.io product report

May 2024

Also Known As

No data available

WhiteSource, Mend SCA, Mend.io Supply Chain Defender

Learn More

Perforce

Overview

Klocwork detects security, safety, and reliability issues in real-time by using this static code analysis toolkit that works alongside developers, finding issues as early as possible, and integrates with teams, supporting continuous integration and actionable reporting.

Mend.io is a software composition analysis tool that secures what developers create. The solution provides an automated reduction of the software attack surface, reduces developer burdens, and accelerates app delivery. Mend.io provides open-source analysis with its in-house and other multiple sources of software vulnerabilities. In addition, the solution offers license and policy violation alerts, has great pipeline integration, and, since it is a SaaS (software as a service), it doesn’t require you to physically maintain servers or data centers for any implementation. Not only does Mend.io reduce enterprise application security risk, it also helps developers meet deadlines faster.

Mend.io Features

Mend.io has many valuable key features. Some of the most useful ones include:

Vulnerability analysis
Automated remediation
Seamless integration
Business prioritization
Limitless scalability
Intuitive interface
Language support
Integration
Continuous monitoring
Remediation suggestions
Customization

Mend.io Benefits

There are many benefits to implementing Mend.io. Some of the biggest advantages the solution offers include:

Easy to use: The Mend.io platform is very user-friendly and easy to set up.

Third-party libraries: The solution eases the process of keeping track of all the used third-party dependencies within a product. It not only scans for the pure occurrence (also transitively) but also takes care of licenses and vulnerabilities.

Static code analysis: With Mend.io’s static code analysis, you can quickly identify security weaknesses in custom code across desktop, web, and mobile applications.

Broad support: Mend.io provides 27 different programming languages and various programming frameworks.

Easy integration: Mend.io makes integration very easy with existing DevOps environments and CI/CD pipelines so developers don’t need to manually configure or trigger the scan.

Ultra-fast scanning engine: The solution’s scanning engine generates results up to ten times faster than legacy SAST solutions.

Unified developer experience: Mend.io has a unified developer experience inside the code repository that shows side-by-side security alerts and remediation suggestions for custom code and open-source code.

Reviews from Real Users

Below are some reviews and helpful feedback written by PeerSpot users currently using the Mend.io solution.

Jeffrey H., System Manager of Cloud Engineering at Common Spirit, says, “Finding vulnerabilities is pretty easy. Mend.io (formerly WhiteSource) does a great job of that and we had quite a few when we first put this in place. Mend.io does a very good job of finding the open-source, checking the versions, and making sure they're secure. They notify us of critical high, medium, and low impacts, and if anything is wrong. We find the product very easy to use and we use it as a core part of our strategy for scanning product code moving toward release.”

PeerSpot reviewer Ben D., Head of Software Engineering at a legal firm, mentions, “The way WhiteSource scans the code is great. It’s easy to identify and remediate open source vulnerabilities using this solution. WhiteSource helped reduce our mean time to resolution since we adopted the product. In terms of integration, it's pretty easy.”

An IT Service Manager at a wholesaler/distributor comments, “Mend.io provides threat detection and an excellent UI in a highly stable solution, with outstanding technical support.”

Another reviewer, Kevin D., Intramural OfficialIntramural at Northeastern University, states, "The vulnerability analysis is the best aspect of the solution."

Sample Customers

ACCESS Co Ltd, Risk-AI, Winbond Electronics, Bristol-Myers Squibb Pharmaceutical Research Institute, University of Southern California, Alebra Technologies, SIMULIA, Risk Management Solutions, Brigham Young University, SRD, HRL

Microsoft, Autodesk, NCR, Target, IBM, vodafone, Siemens, GE digital, KPMG, LivePerson, Jack Henry and Associates