  As security becomes more relevant for many companies, the popularity of
static program analysis (SPA) tools is increasing. In this paper, we target the
use of SPA tools among companies in Germany with a focus on security. We give
insights on the current issues and the developers' willingness to configure the
tools to overcome these issues. Compared to previous studies, our study
considers the companies' culture and processes for using SPA tools. We
conducted an online survey with 256 responses and semi-structured interviews
with 17 product owners and executives from multiple companies. Our results show
a diversity in the usage of tools. Only half of our survey participants use SPA
tools. The free tools tend to be more popular among software developers. In
most companies, software developers are encouraged to use free tools, whereas
commercial tools can be requested. However, the product owners and executives
in our interviews reported that their developers do not request new tools. We
also find out that automatic security checks with tools are rarely performed on
each release.
