Black Duck Coverity
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships.
What Black Duck Coverity is
Black Duck Coverity is a paid static analysis tool for finding security vulnerabilities and code quality defects in source code before software ships. It examines code without running it, analyzing entire codebases across files and libraries. Coverity supports 22 programming languages and more than 250 frameworks, and includes rules aligned with standards such as MISRA, AUTOSAR, ISO 26262, PCI DSS, OWASP Top 10 and CWE Top 25. It is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. Developers can use the Code Sight IDE plug-in for real-time results, issue summaries and code fixes. IDE, source-control and CI connections can trigger scans on commits and pull requests; listed tools include GitHub, GitLab, Bitbucket, Azure DevOps and Jenkins. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is available by quote and customized to team size and codebase.
Good
- Analyzes code without executing it.
- Supports 22 languages and 250+ frameworks.
- IDE plug-in provides real-time results and code fixes.
- Scans can be triggered on commits and pull requests.
- Fully air-gapped on-premises deployment is supported.
Watch out
- No free plan is available.
- Pricing is provided by quote.
- Setup may require self-hosted deployment management.
Who it suits
Coverity suits enterprise development teams that need code analysis across large codebases, IDE and CI workflows, or standards-governed software projects. It is also relevant where fully air-gapped on-premises deployment is required.
Verdict
Coverity combines broad language and framework coverage with IDE, source-control and CI integrations. Teams should account for quote-based pricing and the deployment model they need.
Plans and prices
From Black Duck Coverity's own pricing page, checked 1 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Coverity Static Analysis | Priced on request | customized to team size and codebase · enterprise quote |
The facts
Each one read from Black Duck Coverity's own pages, with the date it was checked.
What it does
- Analysis method
- Coverity scans source code without executing it and analyzes entire codebases across files and libraries.checked 1 Oct 2026
- CI integrations
- The integrations page lists Coverity integrations for Jenkins, AWS CodeBuild, Azure DevOps, Concourse and Travis CI.checked 1 Oct 2026
- Compliance standards
- Supported standards include MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, CWE Top 25 and others.checked 1 Oct 2026
- Customer base
- Black Duck states that more than 4,000 organizations choose its software risk insight and that Coverity pricing is obtained through a no-obligation quote.checked 1 Oct 2026
- Deployment
- Coverity supports fully air-gapped on-premises deployment, including Kubernetes cluster support.checked 1 Oct 2026
- Developer integration
- The Code Sight IDE plug-in provides real-time results, issue summaries and code fixes while developers code.checked 1 Oct 2026
- Language coverage
- Coverity supports 22 programming languages and more than 250 frameworks.checked 1 Oct 2026
- Purpose
- Coverity is an enterprise-grade static analysis solution that finds and fixes security vulnerabilities and code quality defects before software ships.checked 1 Oct 2026
- Safety qualifications
- Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C.checked 1 Oct 2026
- SCM integrations
- The integrations page lists Coverity integrations for GitHub, GitLab, Bitbucket and Azure DevOps.checked 1 Oct 2026
- Security controls
- Coverity Connect provides SSL, LDAP, Kerberos and role-based access control features.checked 1 Oct 2026
- Workflow automation
- IDE, SCM and CI integrations can trigger scans on code commits and pull requests.checked 1 Oct 2026
The company
- Headquarters
- Burlington, Massachusetts, United Stateschecked 28 Sep 2026
Where it runs
- Supported server platforms
- Coverity Connect and Coverity Reports support Windows and Linux server platforms.checked 1 Oct 2026
Alternatives to Black Duck Coverity
- 1
Jazzer
Free planOpen sourceAPILinuxmacOSSelf-hosted7.3Free plan - 2
AFL++
Free planAndroidLinuxmacOSSelf-hosted7.2From €20,000 a year - 3
Mayhem
Free planWebAPILinuxmacOS7.0From $236 a month - 4
ClusterFuzz
Free planWebLinuxmacOSSelf-hosted6.8Free plan - 5
cargo-fuzz
Free planLinuxmacOSWindows6.7Free plan - 6
boofuzz
Free planAPILinuxSelf-hostedWindows6.4Free plan