Try our new research platform with insights from 80,000+ expert users

Coverity vs Mend.io comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Customer Service

Sentiment score
7.0
Coverity's customer service is generally responsive and professional, but some users encounter communication delays and inconsistent expertise.
No sentiment score available
 

Room For Improvement

Sentiment score
3.7
Coverity users seek improved UI, better IDE integrations, reduced false positives, expanded language support, and enhanced reporting features.
No sentiment score available
The Coverity license fee is very high, making it tricky for individual developers.
 

Scalability Issues

Sentiment score
7.1
Coverity is praised for scalability, although some face cost issues; it efficiently serves both small and large organizations.
No sentiment score available
 

Setup Cost

Sentiment score
3.0
Coverity's pricing is perceived as expensive and complex, despite providing multi-language access without code limitations.
No sentiment score available
Coverity is considered expensive compared to other tools like SonarQube, which is much cheaper.
 

Stability Issues

Sentiment score
8.5
Coverity is praised for its stability and reliability, with users rating its performance highly and noting minimal configurations needed.
No sentiment score available
 

Valuable Features

Sentiment score
8.2
Coverity enhances code quality with low false positives, security analysis, customizable options, and seamless integration into development workflows.
No sentiment score available
The most valuable feature of Coverity is its interprocedural analysis.
 

Categories and Ranking

Coverity
Average Rating
7.8
Reviews Sentiment
6.5
Number of Reviews
41
Ranking in other categories
Static Application Security Testing (SAST) (4th)
Mend.io
Average Rating
8.4
Reviews Sentiment
7.3
Number of Reviews
29
Ranking in other categories
Application Security Tools (17th), Software Composition Analysis (SCA) (7th), Static Code Analysis (4th), Software Supply Chain Security (1st)
 

Mindshare comparison

Coverity and Mend.io aren’t in the same category and serve different purposes. Coverity is designed for Static Application Security Testing (SAST) and holds a mindshare of 8.4%, up 7.2% compared to last year.
Mend.io, on the other hand, focuses on Software Composition Analysis (SCA), holds 8.7% mindshare, down 11.0% since last year.
Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
 

Featured Reviews

Md. Shahriar Hussain - PeerSpot reviewer
Offers impressive reporting features with user-friendliness and high scalability
The solution can be easily setup but requires heavy integration due to the multiple types of port and programming languages involved. Comparing the resource requirements of the solution I would say it can be installed effortlessly. I would rate the initial setup an eight out of ten. A professional needs some pre-acquired knowledge to manage Coverity's deployment process, but the local solution partners provide support well enough for trouble-free deployment. The overall deployment process of Coverity took around two and a half hours in our organization. The deployment duration depends upon the operating system and resources including high-end RAM and CPU processors.
Jeffrey Harker - PeerSpot reviewer
Easy to use, great for finding vulnerabilities, and simple to set up
Finding vulnerabilities is pretty easy. Mend (formerly WhiteSource) does a great job of that and we had quite a few when we first put this in place. Governance up until that time had been manual and when we tried to do manual governance of a large codebase, our chances of success were pretty minimal. Mend (formerly WhiteSource) does a very good job of finding the open-source, checking the versions, and making sure they're secure. They notify us of critical high, medium, and low impacts, and if anything is wrong. We find the product very easy to use and we use it as a core part of our strategy for scanning product code moving toward release. We use Mend (formerly WhiteSource) Smart Fix. I’d say pretty much everything in Mend (formerly WhiteSource) is easy to use. We really don't have too much difficulty using the product at all. I've implemented other scanners and tools and had much more trouble with those products than we've ever had with Mend (formerly WhiteSource). That’s extremely important. It's hard to sell to some of these teams to put any level of overhead on top of their product development efforts and the fact that Mend (formerly WhiteSource) is as easy as it is to use is a critical aspect of adoption here. It scores very highly on that scale. Mend (formerly WhiteSource) Smart Fix helps our developers fix vulnerable transitive dependencies. It's all very helpful to our development community. First of all, we're able to find that there are issues. Second of all, we're able to figure out very quickly what needs to be done to remediate the issues. Mend (formerly WhiteSource) helped reduce our mean time to resolution since adopting it. A lot of it is process improvement and technical aspects that can tell us how to go about remediating the issues. We get that out of Mend (formerly WhiteSource). Making the developers aware that these issues are there and insisting they be corrected and making the effort to do that visibly is very valuable to us. Overall, Mend (formerly WhiteSource) helped dramatically reduce the number of open-source software vulnerabilities running in our production at any given point in time. I won't give metrics, however, it's fair to say that our state before and after Mend (formerly WhiteSource) is dramatically different and moved in a positive direction. Mend's ability to integrate our developer's existing workflows, including their IDE repository and CI is good. Azure DevOps is really important. That's what the pipelines are. That's a very important piece of the entire puzzle. If this was just an external scanner where periodically we'd go through and scan our repos and give them a report, we’d do that with pen testing products, for example, for security testing. The problem is, by the time they get those reports, they've already shipped the code to multiple environments and it's too late to stop the train. With these features being baked into the pipelines like this, they know immediately. As a result, we're able to quickly take action to remediate findings.
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
816,636 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
32%
Computer Software Company
15%
Financial Services Firm
8%
Government
4%
Financial Services Firm
17%
Computer Software Company
16%
Manufacturing Company
12%
Energy/Utilities Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
What do you like most about Coverity?
The solution has improved our code quality and security very well.
What is your experience regarding pricing and costs for Coverity?
Coverity is considered expensive compared to other tools like SonarQube, which is much cheaper.
How does WhiteSource compare with SonarQube?
Red Hat Ceph does well in simplifying storage integration by replacing the need for numerous storage solutions. This solution allows for multiple copies of replicated and coded pools to be kept, ea...
How does WhiteSource compare with Black Duck?
We researched Black Duck but ultimately chose WhiteSource when looking for an application security tool. WhiteSource is a software solution that enables agile open source security and license compl...
What do you like most about Mend.io?
The best feature is that the Mend R&D team does their due diligence for all the vulnerabilities. In case they observe any important or critical vulnerabilities, such as the Log4j-related vulner...
 

Comparisons

 

Also Known As

Synopsys Static Analysis
WhiteSource, Mend SCA, Mend.io Supply Chain Defender, Mend SAST
 

Overview

 

Sample Customers

SAP, Mega International, Thales Alenia Space
Microsoft, Autodesk, NCR, Target, IBM, vodafone, Siemens, GE digital, KPMG, LivePerson, Jack Henry and Associates
Find out what your peers are saying about Coverity vs. Mend.io and other solutions. Updated: September 2022.
816,636 professionals have used our research since 2012.