Parasoft is a compliance-focused static application security testing (SAST) vendor that has shipped automated testing and static analysis tools since 1987, making it one of the longest-running companies in the SAST market. Based in Monrovia, California, Parasoft offers three language-specific products — C/C++test, Jtest, and dotTEST — each combining static analysis, unit testing, and code coverage in a single package.
Where Parasoft stands out from most SAST tools is its deep focus on safety-critical industries. Parasoft supports over 2,500 built-in static analysis rules and is one of only a handful of SAST vendors with TUV SUD certification for ISO 26262 and IEC 61508. Unlike general-purpose SAST tools like Checkmarx or Semgrep, Parasoft ships with tool qualification kits for DO-178C (aerospace), IEC 62304 (medical devices), and EN 50128 (rail) — building its entire workflow around compliance documentation for safety-critical software development.
Product Screenshots
Parasoft DTP Report Center — centralized dashboard with drag-and-drop widgets for requirements traceability, test coverage, violations, and code quality metrics across projects. Source: parasoft.com
Parasoft C/C++test static analysis running inside Eclipse IDE — violation list with severity classification, source code view, and detailed rule explanations. Source: parasoft.com
Parasoft C/C++test functional safety compliance workflow — MISRA rule checking with code coverage overlay and compliance evidence generation. Source: parasoft.com
Overview
Parasoft was founded in 1987, originally commercializing parallel computing research from Caltech. During the 1990s, the company pivoted to software testing automation, starting with runtime error detection for C/C++ (Insure++) and expanding to static analysis, unit test generation, and API testing.
Today Parasoft offers a suite of products that span the software testing lifecycle:
- C/C++test — Static analysis and unit testing for C and C++ (the flagship for safety-critical)
- Jtest — Static analysis, unit test generation, and code coverage for Java
- dotTEST — Static analysis for C# and .NET applications
- SOAtest — API testing and service virtualization
- DTP — Development Testing Platform for centralized reporting and analytics
- Insure++ — Runtime memory debugging for C/C++
Key Features at a Glance
| Feature | Details |
|---|---|
| Languages | C, C++, Java, C#/.NET (via three separate products) |
| Analysis Engine | Control flow, data flow, and pattern-based analysis with three tunable modes (Fast, Standard, Aggressive) |
| Built-in Rules | 2,500+ covering MISRA, AUTOSAR C++14, CERT, CWE, OWASP, JSF, Effective C++ |
| Safety Certifications | TUV SUD certified for ISO 26262 and IEC 61508 |
| Qualification Kits | DO-178C (DAL-A), IEC 62304, EN 50128, ISO 21434 |
| Custom Rules | RuleWizard visual editor for creating rules without code |
| AI Features | Violation prioritization, remediation suggestions, unit test generation, documentation assistant |
| IDE Support | Eclipse, IntelliJ IDEA, Visual Studio, VS Code |
| CI/CD Integration | Jenkins, Azure DevOps, GitLab CI/CD, GitHub Actions |
| Reporting | DTP (Development Testing Platform) with 50+ dashboard widgets |
| Unit Testing | Integrated in each product with code coverage analysis |
| Entry Pricing | C/C++test Individual from $35/month billed annually |
Key Features
Static analysis engine
Parasoft’s static analysis does more than simple pattern matching. The engine supports three analysis approaches:
- Control flow analysis models all possible execution paths including branches, loops, and exception handling
- Data flow analysis tracks variable states along execution paths to detect null pointers, division by zero, memory leaks, and uninitialized variables
- Pattern-based analysis matches code against known bug patterns and coding standard violations
C/C++test ships with over 2,500 rules. Teams can select from three tunable modes: Fast (quick feedback, fewer findings), Standard (balanced), and Aggressive (deep analysis, more results). Compared to Coverity, which focuses on deep interprocedural dataflow analysis across 22+ languages, Parasoft’s Aggressive mode performs similar interprocedural analysis but is limited to C, C++, Java, and C#/.NET.
Safety-critical compliance
This is Parasoft’s core differentiator. The compliance workflow covers:
| Standard | Industry | Support level |
|---|---|---|
| ISO 26262 | Automotive | TUV SUD certified |
| IEC 61508 | Functional safety | TUV SUD certified |
| DO-178C (DAL-A) | Aerospace / defense | Tool qualification kit |
| IEC 62304 | Medical devices | Tool qualification kit |
| EN 50128 | Rail | Tool qualification kit |
| ISO 21434 | Automotive cybersecurity | Compliance pack |
| MISRA C/C++ | Embedded systems | Full rule coverage |
| AUTOSAR C++14 | Automotive | Full rule coverage |
| CERT C/C++/Java | Security | Full rule coverage |
| CWE / OWASP | Application security | Full rule coverage |
The tool qualification kits automate much of the documentation burden. For DO-178C, this means generating the verification evidence required for DAL-A certification without manually assembling traceability matrices.
AI-powered analysis
Parasoft has added AI capabilities across its product line:
- Violation prioritization ranks static analysis findings by risk and impact, helping teams focus on the most critical issues first
- Remediation suggestions give contextual guidance for fixing violations, including natural language explanations
- Unit test generation creates test cases for Jtest and C/C++test with AI assistance
- Documentation assistant generates compliance documentation from analysis results
RuleWizard
RuleWizard is a visual editor for creating custom static analysis rules. Teams can define project-specific coding standards or organization-specific patterns without writing rule code. Rules created in RuleWizard run alongside the built-in 2,500+ checkers.
This is useful for teams that need to enforce internal coding guidelines beyond what industry standards cover, or for creating project-specific checks that match unusual code patterns in legacy systems.
CI/CD and IDE integration
Parasoft integrates into development workflows through:
- IDEs: Eclipse, IntelliJ IDEA, Visual Studio, and VS Code
- CI/CD: Jenkins, Azure DevOps, GitLab CI/CD, GitHub Actions
- Build systems: Make, CMake, Gradle, Maven, MSBuild
- Reporting: DTP (Development Testing Platform) aggregates results across tools and projects
Use Cases
Automotive software development
Teams building ADAS, infotainment, or ECU firmware use C/C++test with MISRA, AUTOSAR, and ISO 26262 rule sets. The TUV SUD certification simplifies audits and the qualification kit generates traceability documentation.
Aerospace and defense
DO-178C DAL-A compliance requires rigorous verification evidence. Parasoft’s tool qualification kit automates the process of demonstrating that the static analysis tool itself meets the standard’s requirements, a prerequisite for using any automated tool in the certification workflow.
Medical device software
IEC 62304 mandates specific verification activities for medical device software based on safety classification. C/C++test maps its analysis capabilities to IEC 62304 requirements and generates the evidence documentation.
Enterprise Java and .NET
Jtest and dotTEST serve enterprise teams that need to enforce OWASP, CERT, and CWE standards in Java and .NET applications. While these products are less differentiated than C/C++test in the general SAST market, they offer the advantage of a unified reporting platform through DTP.
Strengths & Limitations
Strengths:
- Deepest compliance workflow in the SAST market, with TUV SUD certification and qualification kits for five safety standards
- Over 35 years of focused development in static analysis and automated testing since 1987
- Bundles static analysis, unit testing, and code coverage in each product — unlike most SAST tools that require separate testing frameworks
- RuleWizard for custom rule creation without coding
- Strong in automotive, aerospace, medical device, and embedded verticals
Limitations:
- Three separate products for three language families; no single tool covering all languages
- Narrower language coverage compared to multi-language SAST tools like Checkmarx (30+ languages) or Semgrep (30+ languages)
- Enterprise pricing requires sales engagement for Essentials and above
- The tool qualification and compliance features add complexity that general application security teams may not need
- Less visibility in Gartner Magic Quadrant for AST compared to leaders like Coverity and Checkmarx
Getting Started
How Parasoft Compares
Parasoft targets a specific niche in the SAST market: teams that need compliance-certified tooling for safety-critical software development. For general-purpose application security, tools like Semgrep, SonarQube, or Checkmarx cover more languages and may be faster to adopt. For deep C/C++ analysis without the compliance overhead, Coverity or Klocwork are the primary alternatives.
Where Parasoft wins is when the development process itself requires certified tools and automated compliance documentation. If your organization builds software under ISO 26262, DO-178C, or IEC 62304, Parasoft’s qualification kits and TUV certification directly reduce the audit and certification burden.
