Try our new research platform with insights from 80,000+ expert users

SonarQube Server (formerly SonarQube) vs Synopsys Defensics comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

SonarQube Server (formerly ...
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
113
Ranking in other categories
Application Security Tools (1st), Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
Synopsys Defensics
Average Rating
8.6
Number of Reviews
4
Ranking in other categories
Fuzz Testing Tools (5th)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. SonarQube Server (formerly SonarQube) is designed for Application Security Tools and holds a mindshare of 26.7%, down 27.4% compared to last year.
Synopsys Defensics, on the other hand, focuses on Fuzz Testing Tools, holds 20.5% mindshare, up 12.0% since last year.
Application Security Tools
Fuzz Testing Tools
 

Featured Reviews

Wang Dayong - PeerSpot reviewer
Easy to integrate and has a plug-in that supports both C and C++ languages
The product provides false reports sometimes. It also fails to understand the context of the code. It reports that a line of code has issues without considering its relation with the previous line. The product should improve the report quality. While it asks us to improve the code quality, it would be good if it also suggests how to improve the quality.
it_user586716 - PeerSpot reviewer
Technical support provided protocol-specific documentation to prove that some positives were not false.
A security assurance engineer was able to perform due diligence across all network-facing protocols. My prior organization designed, developed and deployed a Network Attached Storage (NAS) appliance. A key part of the company wide security assurance program for all products, is to perform penetration testing against all network facing IP ports. For the web, SSL and RESTful APIs, there are very good COTS and open source tools to perform Dynamic Application Security Testing (DAST) testing. Unfortunately for NAS protocols like SMB, NFS, CIFS, and iSCSI, I researched and found that Codenomicon Defensics was the only viable source to satisfy our DAST requirements. Through the use of Selenium for automated web testing, it was easily found out that Codenomicon Defensics could be integrated into our Continuous Integration / Continuous Deployment (CI / CD) Agile processes, specific to automated testing. Also, like many of the other application security testing products, Defensics incorporates automatic update support and works on Windows, MacOS and Linux desktops.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Using SonarQube has helped us to identify areas of technical debt to work on, resulting in better code, fewer vulnerabilities, and fewer bugs."
"Issue Explanations: Documentation with detailed samples. Helps in growing technical knowledge and re-writing logic to conforming solutions."
"Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors."
"The most valuable features are the dashboard, the ability to drill down to the code, user-friendly, and the technical debt estimation."
"The SonarQube dashboard looks great."
"The most valuable feature of this solution is that it is free."
"The product itself has a friendly UI."
"I follow Quality Gate's graduation model within organization, and it is extremely helpful for me to benchmark products."
"The product is related to US usage with TLS contact fees, i.e. how more data center connections will help lower networking costs."
"We have found multiple issues in our embedded system network protocols, related to buffer overflow. We have reduced some of these issues."
"Whatever the test suit they give, it is intelligent. It will understand the protocol and it will generate the test cases based on the protocol: protocol, message sequence, protocol, message structure... Because of that, we can eliminate a lot of unwanted test cases, so we can execute the tests and complete them very quickly."
 

Cons

"SonarQube could improve by adding automatic creation of tasks after scanning and more support for the Czech language."
"From a reporting perspective, we sometimes have problems interpreting the vulnerability scan reports. For example, if it finds a possible threat, our analysts have to manually check the provided reports, and sometimes we have issues getting all the data needed to properly verify if it's accurate or not."
"The solution could improve by having better-consulting services."
"We've been using the Community Edition, which means that we get to use it at our leisure, and they're kind enough to literally give it to us. However, it takes a fair amount of effort to figure out how to get everything up and running. Since we didn't go with the professional paid version, we're not entitled to support. Of course that could be self-correcting if we were to make the step to buy into this and really use it. Then their technical support would be available to us to make strides for using it better."
"The product's pricing could be lower."
"This is a well-rounded solution, however, some features could be made available on the free version. The price of the solution could be reduced."
"I don't believe you can have metrics of code quality based upon code analysis. I don't think it's possible for a computer to do it."
"There are limitations to the free version that limit development options as far as languages."
"It does not support the complete protocol stack. There are some IoT protocols that are not supported and new protocols that are not supported."
"Sometimes, when we are testing embedded devices, when we trigger the test cases, the target will crash immediately. It is very difficult for us to identify the root cause of the crash because they do not provide sophisticated tools on the target side. They cover only the client-side application... They do not have diagnostic tools for the target side. Rather, they have them but they are very minimal and not very helpful."
"Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install."
 

Pricing and Cost Advice

"For the Community edition, there is no extra cost. It's totally free. The Enterprise edition, Data Center edition, and Developer edition are the paid versions."
"We are using the Developer Edition and the cost is based on the amount of code that is being processed."
"The developer edition is based on cost per lines of code."
"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."
"SonarQube is an open-source product that can be used free of charge."
"We are using the community version of the solution and we plan on purchasing licenses for the upgraded version soon. There is a limitation on how many lines of code can be scanned and this is why we are going to purchase a license for an increased amount."
"I think comparing the product to competitors it should be less expensive."
"The beauty of this solution is the free open-source version is capable enough in doing pretty much what an enterprise-level version can do."
"Licensing is a bit expensive."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
824,067 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
13%
Government
6%
Computer Software Company
21%
Manufacturing Company
17%
Financial Services Firm
9%
Healthcare Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
Ask a question
Earn 20 points
 

Also Known As

Sonar
Defensics, Codenomicon Defensics
 

Learn More

 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Information Not Available
Coriant, CERT-FI, Next Generation Networks
Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: December 2024.
824,067 professionals have used our research since 2012.