We performed a comparison between OWASP Zap and SonarCloud based on real PeerSpot user reviews.
Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."You can run it against multiple targets."
"The API is exceptional."
"It has improved my organization with faster security tests."
"Automatic updates and pull request analysis."
"Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope."
"It has evolved over the years and recently in the last year they have added, HUD (Heads Up Display)."
"The solution is scalable."
"The product discovers more vulnerabilities compared to other tools."
"The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false positives and we can customize the rules."
"For what it is meant to do, it works pretty well."
"The most valuable feature of SonarCloud is its overall performance."
"Recently, they introduced support for mono reports and microservices, which is a noteworthy development as it provides a more detailed view of each service."
"Its dashboard provides a unified view of various code quality metrics, including code duplication, unit test coverage, and security hotspots."
"I'm not implementing the solutions. However, I've talked to the people who deploy the tools, and they are happy with how easy setting up SonarCloud is."
"The reports from SonarCloud are very good."
"The solution can be installed locally."
"The documentation is lacking and out-of-date, it really needs more love."
"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline."
"If there was an easier to understand exactly what has been checked and what has not been checked, it would make this solution better. We have to trust that it has checked all known vulnerabilities but it's a bit hard to see after the scanning."
"It needs more robust reporting tools."
"Lacks resources where users can internally access a learning module from the tool."
"The reporting feature could be more descriptive."
"They stopped their support for a short period. They've recently started to come back again. In the early days, support was much better."
"The automated vulnerability assessments that the application performs needs to be simplified as well as diversified."
"It would be helpful if notifications could go out to an extra person."
"There's room for improvement in the configuration process, particularly during the initial setup phase."
"I've been told by the developers that the solution is too limited. It's not testing enough within the containers."
"The documentation needs improvement on optimizing build time for seamless CI/CD integration with our Android apps."
"SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird. We then need to manually go and mark the false positive."
"The reports could improve by providing more information. We are not able to use the reports in our operation until they are improved. Additionally, if the vendor provided more customization capabilities it would be a benefit."
"CI/CD pipeline is part of a whole chain of design, development, and production, and it's becoming increasingly crucial to optimize the various tools across different stages. However, it's still a silo approach because the full integration is missing. This isn't just an issue with SonarCloud. It's a general problem with tooling."
"SonarCloud's UI needs enhancement."
OWASP Zap is ranked 7th in Static Application Security Testing (SAST) with 37 reviews while SonarCloud is ranked 10th in Static Application Security Testing (SAST) with 10 reviews. OWASP Zap is rated 7.6, while SonarCloud is rated 8.4. The top reviewer of OWASP Zap writes "Great for automating and testing and has tightened our security ". On the other hand, the top reviewer of SonarCloud writes "Beneficial vulnerability discovery, simple to maintain, and proactive support". OWASP Zap is most compared with SonarQube, Acunetix, Qualys Web Application Scanning, Veracode and Rapid7 InsightAppSec, whereas SonarCloud is most compared with SonarQube, Veracode, Checkmarx One, GitLab and Coverity. See our OWASP Zap vs. SonarCloud report.
See our list of best Static Application Security Testing (SAST) vendors.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
