About Klocwork

Klocwork is a web-based static application security testing (SAST software designed to help businesses identify and fix software security issues in compliance with security standards such as OWASP, CWE, PCI DSS, CERT and ISO/IEC TS 17961 and DISA STIG. It offers differential analysis, which lets IT professionals analyze files using system context data through the Klocwork Server.

DevOps teams using Klocwork can control access permissions, manage approval workflows, generate compliance and security reports, display metrics and trending data and prioritize defects on the basis of severity, lifecycle and location. Containerized builds enable managers to use internal or external cloud services to streamline code analysis. Additionally, businesses can integrate the...


Read More

Supported Operating System(s):

7 Reviews of Klocwork

Average User Ratings

Overall

4.57 / 5 stars

Ease-of-use

3.5

Value for money

4.5

Customer support

4.5

Functionality

4.5

Ratings Snapshot

5 stars

(4)

4

4 stars

(3)

3

3 stars

(0)

0

2 stars

(0)

0

1 stars

(0)

0

Likelihood to Recommend

Not likely

Very likely

Filter reviews by:

Sort by: Most Helpful | Most Recent

Showing 1 - 7 of 7 results

Do you use this product?Write a review

January 2018

Randall from Mountain State Information Systems, Inc.

Verified Reviewer

Company Size: 11-50 employees

Time Used: More than 2 years

Review Source: Capterra


Ease-of-use

3.0

Value for money

5.0

Customer support

5.0

Functionality

5.0

January 2018

Great at finding true positive issues in source code without needing to compile

This tool provided my company an easy means to find code defects on partial and full source code builds. The results of the tool have been very good. Although manual analysis is still required to determine which issues the customer are interested in, the time invested in setting up, running the tool, and manually analyzing the results, is well worth it.

Pros

Klocwork works great with source code whether a complete or partial build. Easy to run the tool with minimal setup work. Tool has a higher chance of producing true positives vs false positives if setup right. Checker warnings are easy to understand and there is decent documentation explaining what each checker does. Klocwork Insight's web interface is easy to work with and provides a little help for tracing issues. Klocwork's Checker Studio enables users to create their own custom checkers, which are easy to deploy. The tool is great at finding critical issues in code, especially for buffer overflows, array out of bounds, null pointer dereferences, and dead code. The tool also maintains history of builds run and does build comparisons on each run for it to flag what warnings are new or not.

Cons

Running the tool for us is usually done on a Unix server via command line, which users have expressed they would not prefer to a GUI. There is no easy way to extract the results from the tool to an Excel spreadsheet, but there are ways around it via scripting. There is no good documentation on Checker Studio, on how to create checkers, especially on how to program in KAST, even more so for Path checkers.

December 2018

Devendra from Information Technology and Services

Company Size: 501-1,000 employees

Industry: Information Technology and Services

Time Used: More than 2 years

Review Source: Capterra


Ease-of-use

5.0

Value for money

5.0

Customer support

4.0

Functionality

5.0

December 2018

Very good in checking run time problems !!

As our main case is to detect some run time issues and using Klocwork we are getting these issues.

Pros

For our project we would like check run time issues like Divided by Zero, Array out of Bounds, Null pointer issues and so on. Klocwork is very good in this and has some good number of checkers for these problems. In addition to this Klocwork has direct plugin availability to lot of IDE's which will be helpful for all the developers.

Cons

I would say that Klocwork has almost all good features as per my experience.

May 2020

Anonymous

Verified Reviewer

Company Size: 10,000+ employees

Time Used: More than 2 years

Review Source: Capterra


Ease-of-use

3.0

Value for money

3.0

Customer support

3.0

Functionality

4.0

May 2020

Powerful tool, but...

Pros

Klocwork is a powerful static code checker. It helps to improve code global quality and to early detect errors.

Cons

But it is a litte bit tricky to customize. Learning curve is not so short.

December 2018

Raviteja from Information Technology and Services

Company Size: 201-500 employees

Industry: Information Technology and Services

Time Used: Less than 2 years

Review Source: Capterra


Ease-of-use

5.0

Value for money

5.0

Customer support

5.0

Functionality

5.0

December 2018

Good Tool for On the fly Analysis!!

Before using Klocwork we used to check our Internal Standards manually but now Klocwork has completely removed this manual process.

Pros

I most loved feature in Klocwork as per my experience would be its on the fly analysis feature. This feature will help us in checking our code while developing, which will reduce the time in delivering our product. One more best thing would be Custom Checkers which are very important for us where we will be checking our internal Standards without Manual Intrevention.

Cons

The entire process of creating custom checkers is bit lengthy which I feel bit uncomfortable.

January 2019

Dinesh from Information Technology and Services

Company Size: 501-1,000 employees

Industry: Information Technology and Services

Time Used: Less than 2 years

Review Source: Capterra


Ease-of-use

5.0

Value for money

4.0

Customer support

4.0

Functionality

4.0

January 2019

Good and User Friendly Static Code Analyzer

My Company has completely eliminated the manual process of checking the internal Standards. We can get the reports of the project in a very easy way and we can even customize this according to our requirements.

Pros

It has very good Checker List and also it is having very decent documentation for each and every Checker. Setting up the tool is very easy and straightforward. It is very easy to create one's own Internal Checkers.

Cons

AS per my view creating custom checkers would be lengthy. Except this Klocwork has almost all the good features.

February 2018

User Profile Picture

Fred from BridgePoint Technologies, LLC

Verified Reviewer

Company Size: 51-200 employees

Time Used: Less than 12 months

Review Source: Capterra


Ease-of-use

3.0

Value for money

5.0

Customer support

4.0

Functionality

4.0

February 2018

It's a source code analysis tool. You can feed it either a piece of code up to a full build with tho

Pros

Klocwork is great at finding software defects such as array and buffer out of bounds violations, Null pointer dereferences, unreachable code, memory leaks, unused variables, etc. If the build is setup correctly, the tool often produces accurate results. Customers have complimented us with our findings as we were able to point out significant issues in their software. Klocwork can be used on incremental builds and it will determine which warnings are new, unchanged, or fixed since the last run. The tool has very descriptive warnings and great documentation with examples to use. Their website also contains mappings from their checker warnings to industry coding standards such as MISRA and others.

Cons

It doesn't have a user friendly interface for running the tool. Although it won't prevent you from running it on any piece of code or software build, the tool produces much less false positives when the input build is setup properly, which often requires some effort. Klocwork is run via command line, so the user must have knowledge of the necessary commands, command line arguments, and configuration setup. Although the results can be viewed through the Klocwork Insight Review web interface, there is no easy way for the user to export the data to a spreadsheet for offline viewing and analysis.

January 2019

Anonymous

Verified Reviewer

Company Size: 10,000+ employees

Time Used: Less than 2 years

Review Source: Capterra


Ease-of-use

2.0

Value for money

4.0

Customer support

5.0

Functionality

5.0

January 2019

A solid static code analyzer.

Pros

All the common bugs are easily handled and the tool has surprised me in finding very well hidden and unusual bugs producing accurate results even when the code was only partially built. The availability of IDEs plugin is a plus.

Cons

The user interface could be improved a lot as well as the output format. Creating custom checkers could be simplified as it is, in my opinion, the Achilles' heel of the product.