Static Code Analysis

Now pick what to compare Klocwork against.

Klocwork clear

Open a name for its full profile

Aikido SAST
Scored
Aikido Security · Freemium · 5 capabilities in this domain · 4.22 / 5
Compare →
Snyk Code
Scored
Snyk · Freemium · 5 capabilities in this domain · 4.07 / 5
Compare →
GitHub Code Security
Scored
GitHub · Freemium · 4 capabilities in this domain · 4.05 / 5
Compare →
Semgrep Code
Scored
Semgrep · Freemium · 5 capabilities in this domain · 3.95 / 5
Compare →
Veracode Static Analysis
Scored
Veracode · Commercial · 6 capabilities in this domain · 3.90 / 5
Compare →
SonarQube
Scored
SonarSource · Freemium · 3 capabilities in this domain · 3.89 / 5
Compare →
Checkmarx One SAST
Scored
Checkmarx · Commercial · 6 capabilities in this domain · 3.88 / 5
Compare →
OpenText Fortify Static Code Analyzer
Scored
OpenText · Commercial · 3 capabilities in this domain · 3.69 / 5
Compare →
Coverity
Scored
Black Duck Software · Commercial · 2 capabilities in this domain · 3.56 / 5
Compare →
Klocwork
Scored
Perforce · Commercial · 2 capabilities in this domain · 3.48 / 5
selected
HCL AppScan Source
Scored
HCL Software · Commercial · 2 capabilities in this domain · 3.34 / 5
Compare →
Opengrep
Scored
Opengrep Project · Open Source · 2 capabilities in this domain · 3.06 / 5
Compare →
Semgrep Community Edition
Scored
Semgrep · Open Source · 2 capabilities in this domain · 2.96 / 5
Compare →
Brakeman
Scored
Brakeman Project · Free · 1 capabilities in this domain · 2.85 / 5
Compare →
Find Security Bugs
Scored
SpotBugs Community · Open Source · 2 capabilities in this domain · 2.66 / 5
Compare →
gosec
Scored
securego · Open Source · 1 capabilities in this domain · 2.66 / 5
Compare →
Bandit
Scored
Python Code Quality Authority (PyCQA) · Open Source · 1 capabilities in this domain · 2.59 / 5
Compare →
GitHub Advanced Security for Azure DevOps
Capabilities only
Microsoft · Commercial · 1 capabilities in this domain
Compare →
Mobile Security Framework (MobSF)
Capabilities only
MobSF Project · Open Source · 1 capabilities in this domain
Compare →
NowSecure Platform
Capabilities only
NowSecure · Commercial · 1 capabilities in this domain
Compare →

In Static Code Analysis

GitHub Code Security

GitHub · Static Code Analysis

Close ×

FreemiumCompany4.05 / 5

CodeQL treats code as a queryable database to find vulnerabilities with inter-procedural data flow; results appear as pull request annotations, Copilot Autofix proposes fixes, and security campaigns burn down debt. It is free for public repositories and licensed per active committer for private repositories.

Website ↗

What it does9 capabilities · 6 at full coverage

6 of 9 at full coverage, 8 through a named feature.

Software Composition Analysis★PartialDEPS · via a feature · level 1 · 23 providers
Automated Remediation Pull RequestsFullDEVSEC · via a feature · level 2 · 12 providers
Automated Ticketing & Remediation WorkflowPartialEVM · via a feature · level 2 · 8 providers
Contextual Remediation GuidanceFullEVM · via a feature · level 3 · 5 providers
Vulnerability SLA TrackingPartialEVM · via a feature · level 2 · 6 providers
Custom Security Rule AuthoringFullSAST · via a feature · level 3 · 8 providers
Incremental Diff ScanningFullSAST · level 2 · 8 providers
Static Application Security TestingFullSAST · via a feature · level 2 · 21 providers
Taint & Data-Flow AnalysisFullSAST · via a feature · level 3 · 10 providers

What it proves39 controls across 12 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.18 / 42PO.4.1 PW.4.4 PW.7.1 PW.7.2 RV.1.1 RV.1.2 RV.2.2 RV.3.3
SAMM 2.07 / 90I-DM-1-A I-DM-2-A I-DM-2-B I-SB-2-B V-ST-1-A V-ST-2-A V-ST-3-A
ASVS 5.03 / 17V1 V15 V5
CRA3 / 41Annex I Part I (2)(a) Annex I Part II (2) Annex I Part II (3)
CSF 2.03 / 106GV.SC-07 ID.RA-01 PR.PS-06
OWASP Top 103 / 10A01:2025 A03:2025 A05:2025
S2C2F3 / 25SCA-1 SCA-2 UPD-2
CIS Controls2 / 18CIS 16 CIS 7
CNAS Top 102 / 10CNAS-2 CNAS-7
DSOMM2 / 19IG-Test-KPI TV-Static-Depth-Applications
Scorecard2 / 20SAST Vulnerabilities
SP 800-204D1 / 11204D-CI-COMMIT

What it stops5 techniques · 3 risks

5 techniques countered, 5 of them common

Exploit Public-Facing ApplicationT1190Very Common
Exploitation of Known Vulnerable ComponentVery Common
Injection ExploitationVery Common
Compromise Software Dependencies and Development ToolsT1195.001Common
SSRF to Cloud Metadata Credential TheftCommon

3 risks reduced

Critical exposures lost in an unprioritized finding backlogHigh
Exploitable flaw in first-party application codeHigh
Known vulnerability in a reachable dependency is exploitedHigh

Where it runs3 phases · 2 ways to deploy

Capabilities per lifecycle phase

Code7
Build3
Monitor4

How it is delivered

CI/CD integrationSaaS

What it unlocks9 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Run SAST on critical repositoriesLow effort
Scan dependencies for known vulnerabilities and licensesLow effort
Track findings with severity SLAsLow effort

Level 2

Scan every pull request and block new high-confidence issuesLow effort

Level 3

Practice test-driven security with security unit testsMedium effort
Prioritize by exploitabilityMedium effort
Tune rules and automate triageMedium effort

Level 4

Custom rules from incidents and pentestsMedium effort

Level 5

Eliminate vulnerability classesHigh effort

How it holds up11 criteria scored · 3 strengths · 2 limitations

Scored 0 to 5 against the evaluation criteria

Coverage from pre-commit to runtime3.5
Language, framework and ecosystem breadth3.8
Context-driven prioritization3.2
CI/CD and developer workflow integration4.8
APIs and extensibility4.5
Actionable remediation guidance4.5
Accuracy and noise4.2
Governance and compliance reporting3.6
AI capability maturity and AI security coverage4.4
Total cost and licensing fit4.0
Operational effort and skills required4.3

Strengths

Deep semantic analysis with community query packs
Native pull request experience
AI autofix

Limitations

GitHub-centric
Build required for compiled languages

Best for

Organizations hosting code on GitHub

What it costs3 tiers · Per active committer · free tier

LicensingPer active committer

Priced peractive committer per month

BillingSubscription

Scales withUnique people who pushed code to covered repositories in the last 90 days

Public repositoriesFreeactive committer/month · Monthly
Code Security$30active committer/month · Monthly
Planning estimateestimate$330contributing developer/year · Annual

Total cost

Cost tracks real development activity; occasional contributors and bots can inflate counts; enabling a feature on more repositories raises cost.

What it takes to run1 FTE at peak · 1 role

Peak staffing1 FTE

Roles it needs

Application Security Engineer0.5–1 FTE

What it works with10 languages · 2 standards · 4 features

Named features

CodeQL code scanningCodeQL code scanning in GitHub Code Security.
Copilot AutofixAICopilot Autofix in GitHub Code Security.
Dependency reviewDependency review in GitHub Code Security.
Security campaignsSecurity campaigns in GitHub Code Security.

Languages

C and C++C# and .NETGoJavaJavaScript and TypeScriptKotlinPythonRubyRustSwift

Standards and formats

Common Weakness EnumerationStatic Analysis Results Interchange Format

AI features

Copilot Autofix

What else to look at3 competing · 3 comparable head to head · 2 siblings

Comparable head to head

Competes with

Aikido SASTFreemium · 4.22
Semgrep CodeFreemium · 3.95
Snyk CodeFreemium · 4.07

Same family

DependabotFree
GitHub Secret ProtectionFreemium

What backs this upin 1 pipeline

In use

Payments API release pipeline · Build and analyze
Payments API release pipeline · Dependency intake

Gantry 7.1.0 · OFF.12 · OFF.13