For the project I'm currently working on, the customer mandates that we must use SonarQube, Fortify and Nexus IQ. Not once has any of them found any kind of se

For the project I'm currently working on, the customer mandates that we must use SonarQube, Fortify and Nexus IQ. Not once has any of them found any kind of security issue. In fact every single thing they have raised has been a false positive, or just plain time wasting (e.g. forcing some arbitrary level of branch coverage). Also, they can be so slow - more time is spent in the build pipeline on these tools than is spent in actual build, test and deployment combined (even including integration tests)! Fortify is particularly slow (up to 10 minutes!), and provides no value whatsoever. I've used SonarQube on several other projects too; it seems to be very popular in enterprise circles in particular. Never once have I seen it raise a security issue. On occasion it points out the odd accessibility issue, but that's it.