- Home
- Static Analysis Tools
- Black Duck Coverity
Black Duck Coverity
Burlington, Massachusetts, United States
What it is
Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It examines code without running it, across complete codebases, files, and libraries. Coverity supports 22 programming languages and more than 250 frameworks, with standards coverage that includes MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Its safety qualifications include TÜV SÜD certification for IEC 61508-3 support-tool requirements and qualification up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in provides in-editor results, issue summaries, and code fixes. IDE, source-control, and CI connections can start scans on commits and pull requests; listed integrations include GitHub, GitLab, Bitbucket, Azure DevOps, and Jenkins. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Coverity Connect and Coverity Reports support Windows and Linux servers. Pricing is available on request and customized to team size and codebase.
For and against
For
- Scans code without executing it.
- Supports 22 languages and over 250 frameworks.
- IDE plug-in provides results and code fixes.
- Scans can run on commits and pull requests.
- Supports fully air-gapped on-premises deployment.
Against
- Paid product; pricing is available on request.
- Free plan is not offered.
- Supported server platforms are Windows and Linux.
The verdict
Coverity combines broad language and framework support with compliance coverage and workflow integrations. Teams should account for its quote-based pricing and confirm that its supported deployment and server platforms fit their environment.
Who it suits
Coverity suits organizations that need static code analysis across large codebases, including teams working with compliance or safety standards. Its air-gapped deployment and IDE, SCM, and CI integrations may fit teams with controlled development workflows.
Plans and prices
Coverity Static Analysis
customized to team size and codebase · enterprise quote
Read 1 Oct 2026 · blackduck.com
On the record
- Analysis method
- Coverity scans source code without executing it and analyzes entire codebases across files and libraries.blackduck.com · read 1 Oct 2026
- CI integrations
- The integrations page lists Coverity integrations for Jenkins, AWS CodeBuild, Azure DevOps, Concourse and Travis CI.blackduck.com · read 1 Oct 2026
- Compliance standards
- Supported standards include MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, CWE Top 25 and others.blackduck.com · read 1 Oct 2026
- Customer base
- Black Duck states that more than 4,000 organizations choose its software risk insight and that Coverity pricing is obtained through a no-obligation quote.blackduck.com · read 1 Oct 2026
- Deployment
- Coverity supports fully air-gapped on-premises deployment, including Kubernetes cluster support.blackduck.com · read 1 Oct 2026
- Developer integration
- The Code Sight IDE plug-in provides real-time results, issue summaries and code fixes while developers code.blackduck.com · read 1 Oct 2026
- Language coverage
- Coverity supports 22 programming languages and more than 250 frameworks.blackduck.com · read 1 Oct 2026
- Purpose
- Coverity is an enterprise-grade static analysis solution that finds and fixes security vulnerabilities and code quality defects before software ships.blackduck.com · read 1 Oct 2026
- Safety qualifications
- Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C.blackduck.com · read 1 Oct 2026
- SCM integrations
- The integrations page lists Coverity integrations for GitHub, GitLab, Bitbucket and Azure DevOps.blackduck.com · read 1 Oct 2026
- Security controls
- Coverity Connect provides SSL, LDAP, Kerberos and role-based access control features.docs.blackduck.com · read 1 Oct 2026
- Supported server platforms
- Coverity Connect and Coverity Reports support Windows and Linux server platforms.docs.blackduck.com · read 1 Oct 2026
- Workflow automation
- IDE, SCM and CI integrations can trigger scans on code commits and pull requests.blackduck.com · read 1 Oct 2026
