Hey everyone, been diving deep into SAST tools for our team's upcoming C++ embedded projects (think automotive/industrial). We're down to two finalists: Checkmarx and Coverity. I know both are heavyweights, but I'm hoping some of you have real-world experience in a similar context.
Our main priorities are:
* **Accuracy (Precision):** Low false positive rate is critical. We can't afford to chase down hundreds of non-issues on tight hardware schedules.
* **C++ Standards Support:** We're using modern C++ (14/17) alongside some legacy code. Need good support for both.
* **Build Integration:** How well does it play with embedded toolchains (e.g., ARM GCC, Green Hills) and build systems like CMake?
* **Noise vs. Signal:** How "actionable" are the findings? Are they clear enough for engineers who aren't security specialists?
From my initial eval, Coverity seems to have a legendary reputation for depth and accuracy, especially for C/C++. But Checkmarx appears more flexible and modern in its platform approach, and I've heard good things about their query language for customizing rules.
Has anyone run both on similar codebases? I'm particularly curious about the *practical* differences in tuning them for an embedded environment. Was one significantly easier to integrate into a CI pipeline for a firmware project? Any gotchas with memory constraints or specific compiler quirks?
Automate the boring stuff.