Black Duck Coverity
Black Duck Coverity: A broad hybrid code-analysis platform for security, quality, compliance, and delivery workflows. Ranked #4 of 25 in Static Application Security Testing Software by our editors (8.5/10); pricing: Pricing on request; best for organizations needing mature hybrid code analysis.
At a glance
- Editor score8.5 / 10
- PricingPricing on request
- Best forOrganizations needing mature hybrid code analysis
- Analysis targetSource
- Facts checked22 Sep 2026
Where it wins
- Analyzes source code for security and code-quality defects without execution
- Supports compliance reporting for OWASP, CWE, MISRA, CERT, and PCI DSS
- Connects IDE, pull-request, commit, and CI/CD scanning workflows
Where it doesn't
- Contact-sales pricing makes plan-by-plan comparison less direct
- Software composition analysis is not included
- Its enterprise scope may exceed narrower application-security needs
Our verdict on Black Duck Coverity
Black Duck Coverity is an enterprise static application security testing solution for development and security teams working on complex, regulated, safety-critical, embedded, and enterprise software. It analyzes source code without executing it, identifying security vulnerabilities, code-quality defects, and compliance issues across files, libraries, and large codebases. The platform supports web, Windows, Linux, macOS, API, and self-hosted environments, with cloud and on-premises analysis deployment options.
Coverity’s strongest fit is its coverage across the software delivery process. Code Sight integrations bring analysis into Eclipse, Microsoft Visual Studio, IntelliJ IDEA, and Android Studio, while pull-request and commit-triggered scanning supports review workflows. Black Duck Bridge connects analysis with GitHub Actions, GitLab, Azure DevOps, Jenkins, and Bitbucket. Centralized finding management through Coverity Connect gives teams a shared place to manage results, while configurable checkers and tuning can adapt analysis to project requirements. Reporting aligns with OWASP, CWE, MISRA, CERT, PCI DSS, and other standards.
The published pricing model is contact sales, so organizations should plan for a quote-led buying process rather than a public tier comparison. Coverity is suited to teams that need source analysis, CI/CD integration, IDE support, centralized findings, and hybrid deployment in one platform. It is less suitable for buyers seeking a narrowly focused tool or a package that includes software composition analysis, since SCA is not included. Teams choosing Coverity should also assess whether its enterprise-oriented scope matches their development and compliance workflows.
Your product? Our editors can test Black Duck Coverity in depth and publish a review, labelled as paid · from $149/mo →
Black Duck Coverity pricing
Black Duck Coverity fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Not verified |
| Analysis target | Source |
| Supported languages | Not verified |
| IDE support | Yes |
| CI/CD support | Yes |
| Deployment | Self-hosted |
| SCA included | Not verified |
| Fix guidance | Yes |
| Deployment | Self-hosted |
| Platforms | Web, Windows, macOS, Linux |
| Compliance & security | PCI DSS |
| Support | Community, Docs |
| Built for | Mid-market, Enterprise (editorial estimate) |
| Integrations | 3 integrations: IDEs, source code management systems, CI/CD pipelines |
| Pricing | Pricing on request (source) |
| Website | blackduck.com |
| Facts checked | 22 Sep 2026 |
Black Duck Coverity integrations
Black Duck Coverity lists 3 integrations on its own site.
- IDEs
- source code management systems
- CI/CD pipelines
Alternatives to Black Duck Coverity
- Semgrep CodeBroad SAST coverage with strong pull-request, IDE, CI/CD, and custom-rule support.9.2
- GitHub CodeQLA strong fit for GitHub teams that want customizable semantic code scanning.8.9
- Veracode Static AnalysisA broad cloud SAST service for enterprises securing mixed application targets.8.7
See all Black Duck Coverity alternatives →
Black Duck Coverity vs the competition
- Black Duck Coverity vs Semgrep Code
- Black Duck Coverity vs GitHub CodeQL
- Black Duck Coverity vs Veracode Static Analysis
- Black Duck Coverity vs CodeSonar
- Black Duck Coverity vs Klocwork
- Black Duck Coverity vs Horusec
Compare Black Duck Coverity with any tool side by side →
Also Ranked In
Black Duck Coverity is ranked in 5 of our directories.
Used Black Duck Coverity? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Black Duck Coverity for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Black Duck Coverity is listed in our Static Application Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/black-duck-coverity/"><img src="https://www.itechguides.com/best/badge/black-duck-coverity.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update