Skip to content
SPECIFICTION
Get listed

Black Duck Coverity

blackduck.com

WebWindowsmacOSLinuxSelf-hosted
Visit blackduck.com
Spec score 7.8 #16 of 38 in Static Analysis Tools

What it is

Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It analyzes code without executing it, scanning across files and libraries in entire codebases. Black Duck lists support for 22 programming languages and more than 250 frameworks, along with standards including MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in offers real-time results, issue summaries, and code fixes. IDE, SCM, and CI integrations can trigger scans on commits and pull requests; listed connections include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, and others. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is customized to team size and codebase and supplied by quote.

Spec sheet

Purpose
Coverity is an enterprise-grade static analysis solution that finds and fixes security vulnerabilities and code quality defects before software ships.Read 1 Oct 2026 · blackduck.com
Deployment
Coverity supports fully air-gapped on-premises deployment, including Kubernetes cluster support.Read 1 Oct 2026 · blackduck.com
Headquarters
Burlington, Massachusetts, United StatesRead 28 Sep 2026 · blackduck.com
Analysis method
Coverity scans source code without executing it and analyzes entire codebases across files and libraries.Read 1 Oct 2026 · blackduck.com
CI integrations
The integrations page lists Coverity integrations for Jenkins, AWS CodeBuild, Azure DevOps, Concourse and Travis CI.Read 1 Oct 2026 · blackduck.com
Compliance standards
Supported standards include MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, CWE Top 25 and others.Read 1 Oct 2026 · blackduck.com
Customer base
Black Duck states that more than 4,000 organizations choose its software risk insight and that Coverity pricing is obtained through a no-obligation quote.Read 1 Oct 2026 · blackduck.com
Developer integration
The Code Sight IDE plug-in provides real-time results, issue summaries and code fixes while developers code.Read 1 Oct 2026 · blackduck.com
Language coverage
Coverity supports 22 programming languages and more than 250 frameworks.Read 1 Oct 2026 · blackduck.com
Safety qualifications
Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C.Read 1 Oct 2026 · blackduck.com
SCM integrations
The integrations page lists Coverity integrations for GitHub, GitLab, Bitbucket and Azure DevOps.Read 1 Oct 2026 · blackduck.com
Security controls
Coverity Connect provides SSL, LDAP, Kerberos and role-based access control features.Read 1 Oct 2026 · docs.blackduck.com
Supported server platforms
Coverity Connect and Coverity Reports support Windows and Linux server platforms.Read 1 Oct 2026 · docs.blackduck.com
Workflow automation
IDE, SCM and CI integrations can trigger scans on code commits and pull requests.Read 1 Oct 2026 · blackduck.com

Plans and prices

Coverity Static Analysis Priced on request customized to team size and codebase · enterprise quote Read 1 Oct 2026 · blackduck.com

Every Black Duck Coverity plan and price →

Strong points and limits

Strong points

  • Scans code without executing it.
  • Supports 22 languages and over 250 frameworks.
  • IDE plug-in provides real-time results and code fixes.
  • Scans can trigger on commits and pull requests.
  • Supports fully air-gapped on-premises deployment.

Limits

  • No free plan is listed.
  • Pricing is customized and available by quote.
  • Coverity Connect and Reports servers support Windows and Linux.

Who it suits

Coverity suits enterprise development teams that need static source-code analysis across languages and frameworks. Its air-gapped deployment and listed safety qualifications may be relevant to teams with deployment or standards requirements.

Verdict

Coverity pairs broad static analysis coverage with developer integrations and air-gapped deployment options. Teams need a quote, and should verify that its language, framework, and deployment support fit their codebase.

Where Specifiction places it

Alternatives to Black Duck CoverityAll alternatives →