Klocwork Reviews

Name: Klocwork
Brand: Perforce
Rating: 4.1 (20 reviews)

4.1 out of 5

20 reviews
91% willing to recommend

464 followers

What is Klocwork?

Klocwork detects security, safety, and reliability issues in real-time by using this static code analysis toolkit that works alongside developers, finding issues as early as possible, and integrates with teams, supporting continuous integration and actionable reporting.

Get the Klocwork Buyer's Guide and find out what your peers are saying about Klocwork, SonarQube Server (formerly SonarQube), Veracode and more!

Klocwork is the #7 ranked solution in top Static Code Analysis solutions, #16 ranked solution in AST tools, and #23 ranked solution in application security solutions. PeerSpot users give Klocwork an average rating of 8.2 out of 10. Based on the analysis of the 20 most recent Klocwork reviews, the overall sentiment is positive, with a sentiment score of 7.3. Klocwork is most commonly compared to SonarQube Server (formerly SonarQube): Klocwork vs SonarQube Server (formerly SonarQube). Klocwork is popular among the midsize enterprise segment, accounting for 46% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a educational organization, accounting for 40% of all views.

Helped 816,406 peers since 2012

Featured reviews

AnirbanSarkar

Head - Solution Management Group at Meteonic Innovation Pvt. Ltd.

What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity. What I'd like added in the next release of Klocwork is the peer code review Cahoots which used to be a part of Klocwork, and the architecture analysis and both have been taken out of Klocwork. I found the two critical for specific deployments, so if those can be brought back to Klocwork, that would be very good.

Read full review

reviewer2180745

Principle engineer at a manufacturing company with 10,001+ employees

Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective. Maybe there could be a process by which the clients can update themselves as they reconnect to the new server when there's a new version available and install all of the tools currently within that installation environment.

Read full review

Riham Elkomy

Principal Software Engineer at Valeo

The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze. It will show all possible problems in the code. However, many are not actual problems. So you need to analyze and check if certain items flagged can lead to an actual problem or not. Since it's only static, it doesn't run the code itself and there's always a huge number of findings. You have to analyze all of them to know which ones can lead to actual problems.

Read full review

Klocwork mindshare

Product category:

As of November 2024, the mindshare of Klocwork in the Application Security Tools category stands at 1.4%, down from 1.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

Key learnings from peers

Last updated Nov 21, 2024

Valuable Features

Klocwork's most notable features include static code analysis, minimal false positives, on-the-fly analysis, and custom checker creation. It integrates with IDEs, supports industry standards, enhances CI processes, and aids in detecting defects during development. Plurals commend its ease of use, efficient incremental analysis, detailed reporting, and effective collaboration capabilities. Plurals appreciate its language support expansion and seamless plugin integration, praising the prompt support from the Klocwork team in optimizing performance.

"It's integrated into our CI, continuous integration."
"The reporting helps us understand the trend of our results and whether we improve over time. We can see the history within Klocwork's server architecture and know that we're making things better. It creates a great story for our management. We can demonstrate value and how our software is developing over time."
"The most valuable feature of Klocwork is finding defects while you're doing the coding. For example, if you have an IDE plug-in of Klocwork on Visual Studio or Eclipse, you can find the faults; similar to using spell check on Word, you can find out defects during the development phase, which means that you don't have to wait till the development is over to find the flaws and address the deficiencies.I also find language support in Klocwork good because it used to support only C, C++, C#, and Java, but now, it also supports Java scripts and Python."

Room for Improvement

Klocwork needs improvement in handling false positives, particularly with global variables. It should enhance language support and improve licensing flexibility. Dashboard reporting is another area for enhancement, as is integration with Agile DevOps tools. Users encounter challenges with code analysis between projects and find the upgrade process cumbersome. The complexity in defining analysis rules needs simplification, and support for more modern languages such as Python and JavaScript is desired. Improved dynamic analysis capabilities would also be beneficial.

"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."
"Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."
"What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity."

Pricing

Enterprise users of Klocwork find the pricing and licensing to be competitive and flexible, with options including fixed and floating server licenses. Licensing fees are typically annual, though perpetual licenses are available. The solution may be seen as expensive, particularly if not core to operations, but offers value with its comprehensive capabilities. The cost per user and total pricing depend on the license type and deployment specifics, with budget considerations varying by organization size and needs.

"The pricing for Klocwork is very competitive if you compare it from apple to apple. It has competitive pricing regarding the licensing model and the per-license cost. Klocwork isn't a high-end investment for anyone deploying it; even SMBs can afford it.The Klocwork cost per user would depend on the license type, so I'm unable to mention a ballpark figure because it would depend on the type of installation and how the deployment will be, and the nodes to give an accurate calculation or figure. The total price depends on the package, so my company could never publish pricing for Klocwork on the website.My team first collects information from potential clients on the deployment scenario, project environment, etc., before suggesting a package for Klocwork.My rating for Klocwork in terms of pricing is a five because of its flexible license models. There's a license model for every type of organization, whether small, midsize, or enterprise, so it's a five out of five for me."
"This solution offers competitive pricing."
"There are other solutions on the market such as Microsoft Visual Studio. They have been adding more static code analysis features that come for free. It is getting better all the time. That is one of the possibilities is that we've been considering that we may stop using the Klocwork because it doesn't give us any added value."

Popular Use Cases

Klocwork is used for static code analysis to identify and address static vulnerabilities, such as buffer overflows, null pointer checks, and concurrency violations. Users incorporate it for internal standards compliance, to enhance application security by detecting vulnerabilities and coding errors, and for memory and null pointer issue checks. It's employed in embedded projects, integrated into DevOps, adheres to industry standards, and aids in meeting certifications in sectors like military and aerospace.

Service and Support

Customer service for Klocwork is praised for responsive, timely assistance, often within a day. Technical support is considered very good with efficient issue resolution, although some report reliance on existing resources like documentation. Many appreciate the presence of support in multiple countries, offering accessible help. Users experience proactive, knowledgeable service with regular check-ins. While initial transition issues were noted, ongoing support is highly rated, often achieving closures promptly and effectively.

Deployment

Klocwork's initial setup is described as straightforward and simple, requiring minimal effort. Users report easy installations using .exe and .sh files for Windows and Linux, respectively. Some faced issues with automatic service installation despite opting out. Defining rule sets was mentioned as challenging, requiring external tools. Installation time varies; some completed it in half a day, others in less than 30 minutes. Maintenance demands are low, typically handled by a single person.

Scalability

Klocwork is known for its scalability, accommodating small teams to large organizations with thousands of users. Many users report successfully integrating it across diverse teams and multiple locations. Some compare its performance positively against other tools, noting its efficient resource use. While some rely on additional tools for comprehensive analysis, many appreciate its flexibility, configurability, and its role in frequent security assessments across a broad range of coding environments.

Stability

Klocwork demonstrates strong stability for many users, running smoothly on significant codebases without issues. Some face minor problems related to GUI or external applications, often due to infrastructure or resource constraints. Users highlight its reliable performance, with recognition of its long-standing presence and continuous development since 2003. While some experience isolated difficulties, possibly related to network changes, many continue using Klocwork for extended periods, appreciating its dependability despite minor performance-improvement needs.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Klocwork Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Educational Organization

40%

Manufacturing Company

19%

Computer Software Company

10%

Financial Services Firm

Aerospace/Defense Firm

Energy/Utilities Company

Transportation Company

Comms Service Provider

Government

Healthcare Company

University

Retailer

Construction Company

Engineering Company

Real Estate/Law Firm

Recreational Facilities/Services Company

Wholesaler/Distributor

Insurance Company

Non Profit

Hospitality Company

Outsourcing Company

Media Company

Compare Klocwork with alternative products

Learn more about Klocwork

Product Video

Klocwork customers

ACCESS Co Ltd, Risk-AI, Winbond Electronics, Bristol-Myers Squibb Pharmaceutical Research Institute, University of Southern California, Alebra Technologies, SIMULIA, Risk Management Solutions, Brigham Young University, SRD, HRL