BMC AMI DevX vs. Coverity Static Analysis (SAST)

I love these tools! However, my company has not yet transitioned from SCLM to a modern repository, and this is causing most of our developers to remain within TSO for all their development. It's been a slow adoption up to this point, but we are moving toward more modernization this year and next, so with any luck, we'll see usage pick up. Success depends on the speed at which your management is willing to move.

Incentivized

Best suits for large scale and dynamic development environment. It may be best tool if you want to release your apps with less TAT. However if you have a CRM tool which is COTS product it can offer little help. Even then you should be familiar with what features of Coverity Static Analysis (SAST) are helpful for your development environment

Incentivized

• The tool I use is fairly intuitive. It doesn't take long to be using it full time.
• Changing the layout/view is fairly easy. This allows it to fit individual preferences.
• It is helpful to be able to view specific windows in full screen. Usually, I have it set up to view multiple windows, but sometimes, I just want to view one window in full-screen mode.

Incentivized

• It can provide security scanning dashboard
• Help detect vulnerabilities and recommend remediation
• Integration of devsecops helps speed up release cycles

Incentivized

• Download source code plug-in on Azure DevOps to allow downloading prod version even if it's not in the assignment.
• Publishing Test Results on Azure DevOps from Total Test plugin
• Integration with DevEnterprise in Workbench and GenAI capabilities for enhance code analysis (Accross multiple programs/applications)

Incentivized

• Coverage of integration with other security tools can be improved
• Customisation of dashboard to enable customer choice of tracking
• Showcase devsecops progressive tasks from SLA and violation from code scanner perspective

Incentivized

This is a very good range of tools that we use daily to maintain our programs

Incentivized

It's really simple to use either in batch mode or CICS mode. It is very convinient for debugging purpose.

Incentivized

The tool is very reliable and we have had very few cases where we have had to contact support.

Incentivized

With one exception, we did not observe any slowdown in development activity when using the AMI DEVX Code DEBug tool.

Incentivized

Support has been amazing compared to Optim. Further, new features are very regular with File-AID - I can't remember the last time Optim had a significant update. File-AID support is very receptive to feature requests and reported bugs, including sending out hotfixes quickly.

Incentivized

The learning phase is relatively easy to implement.

Incentivized

The installation teams for these products have never complained about any difficulties during the integration of this range of tools into our IT system.

Incentivized

The names may have changed over the years, but anyone who has been around for a while will recognize them. For Software Configuration Management, I have used TSO/ISPF/SCLM, Panvalet, ChangeMan, Librarian, Endevor, and now Code Pipeline. All of them met the basic requirements. All of them had their advantages and disadvantages. Code Pipeline, however, stands head and shoulders above the rest in simplicity, completeness, effectiveness, efficiency, and elegance.

Incentivized

Coverity Static Analysis (SAST) has wide coverage in terms of Owasp Top 10 vulnerabilities, various types of languages, backward integration. While other tools offer similar experience of code scanning, coverity helps in pointed recommendations for quick closure of vulnerabilities. The historical analysis of vulnerabilities is a good value add in understanding which type of code and which language is better in improving cyber security maturity.

Incentivized

• Possitive impact. It is main product suite to enable devops in the mainframe applications team. All developers use these on day-to-day work.
• Negative impact: Recent usability issues caused disappointment in the application teams. It became hard motivate the development community to increase usage.

Incentivized

• Helped reduce efforts of development team avoiding rework
• Increased security maturity
• Increased efficiency of the teams

Incentivized