Try our new research platform with insights from 80,000+ expert users

SonarQube Server (formerly SonarQube) vs Tenable.io Web Application Scanning comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 30, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

SonarQube Server (formerly ...
Ranking in Application Security Tools
1st
Average Rating
8.0
Reviews Sentiment
7.5
Number of Reviews
113
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
Tenable.io Web Application ...
Ranking in Application Security Tools
21st
Average Rating
7.6
Reviews Sentiment
6.3
Number of Reviews
15
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of February 2025, in the Application Security Tools category, the mindshare of SonarQube Server (formerly SonarQube) is 25.6%, down from 27.1% compared to the previous year. The mindshare of Tenable.io Web Application Scanning is 1.3%, down from 1.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
 

Featured Reviews

Wang Dayong - PeerSpot reviewer
Easy to integrate and has a plug-in that supports both C and C++ languages
The product provides false reports sometimes. It also fails to understand the context of the code. It reports that a line of code has issues without considering its relation with the previous line. The product should improve the report quality. While it asks us to improve the code quality, it would be good if it also suggests how to improve the quality.
Harshal Deshmukh - PeerSpot reviewer
Simple tool to use, good dashboard capabilities and offers asset criticality ratings
It has good dashboard capabilities and gives good results with priority ratings, asset criticality ratings, and exposure scores for vulnerabilities. It also provides automated web application scanning, which customers appreciate because it doesn't disturb the web application or hamper the business. While testing the web application, sometimes it happens that the website or application goes down. But with Tenable.io Web Application Scanning, it doesn't affect the business. It has good unified web application scanning and exposure management.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"All the features of the solution are quite good."
"Any developer can easily identify issues using the process flow or steps provided by SonarQube. In terms of integration, SonarQube makes it quite easy, simplifying the steps for users."
"SonarQube is good for checking and maintaining code quality."
"The product itself has a friendly UI."
"I like that it has a better dashboard compared to Clockwork. It's also stable."
"The most valuable features are the dashboard reports and the ease of integrating it with Jenkins."
"The integrations SonarQube provides with our software delivery pipeline are very seamless."
"Can tweak rules and feed them into our build pipelines."
"The most valuable feature is the reporting, which provides a good level of detail with respect to vulnerabilities."
"It is fully automated."
"We can get detailed information about vulnerabilities."
"It collects the vulnerabilities on the hostnames and sends them to the Tenable.io cloud. Tenable has its own cloud where Tenable.io is running, but there are many connectors to other cloud solutions. Tenable can do vulnerability scanning for other cloud managers such as Azure, Amazon, and so on."
"The solution's instant reports feature is the most effective for detecting threats."
"We use the tool for our websites. We have a vulnerable subdomain. The tool helps to scan it for vulnerabilities."
"The most valuable features of Tenable.io Web Application Scanning are the integration into specific use cases and scanning. All of the features of the solution are useful."
"It has good unified web application scanning and exposure management."
 

Cons

"SonarQube can improve by scanning the internal library which currently it does not do. We are looking for a solution for this."
"The product's pricing could be lower."
"We also use Fortify, which is another tool to find security errors. Fortify is a better security tool. It is better than SonarQube in finding errors. Sometimes, SonarQube doesn't find some of the errors that Fortify is able to find. Fortify also has a community, which SonarQube doesn't have. Its installation is a little bit complex. We need to install a database, install the product, and specify the version of the database and the product. They can simplify the installation and make it easier. We use docker for the installation because it is easier to use. Its dashboard needs to be improved. It is not intuitive. It is hard to understand the interface, and it can be improved to provide a better user experience."
"The solution is a bit lacking on the security side, in terms of finding and identifying vulnerabilities."
"Our developers have complained about the Quality Gates and the number of false positives that this product reports."
"In terms of analysis and findings, other tools provide more in-depth insights and detailed steps to mitigate or handle issues."
"The product must improve security analysis."
"When we have a thousand products published over it, we expect it to be more efficient in terms of serving requests from the browser."
"The cloud and the on-premises versions have their own controllers, and there is no way to centrally manage controllers."
"Sometimes it lags with different cloud environments."
"It would be great if there were a dashboard that is more user-friendly."
"The dashboard could be more user-friendly."
"They have a general dashboard for web application scanning, but the dashboards and reporting can be improved. They probably have some features in their roadmap."
"The technical support should be improved. Currently, some attacks are detected while others are not."
"Tenable.io Web Application Scanning could improve by offering faster fuzzing."
"It isn't easy to manage vulnerabilities in Tenable."
 

Pricing and Cost Advice

"SonarQube is a fairly affordable solution for a larger scale if you have a specific role or specific department for secure code."
"On the pricing side, it's 3,000 Euros for 1 million lines of code."
"It's an open-source product."
"I do not know about the pricing as I am using the community edition, which is free. But I compared the pricing with Sigma, and it is higher than SonarQube."
"We did not purchase a license (required for C++ support), but this option was considered."
"There is both a free and licensed version. The free version has limitations on development languages and support."
"We're using the Community Edition, and we don't pay for anything."
"The developer edition is based on cost per lines of code."
"The pricing is okay."
"For Tenable.io Web Application Scanning, it comes to around 6,50,000 Indian rupees, plus taxes."
"The application is extremely affordable. There are no additional costs involved with licensing. We switched to Tenable.io Web Application Scanning from other solutions due to pricing."
"The price of the solution is reasonable compared to the competitors. The license cost is based on the number of users and the annual usage."
"Tenable.io Web Application Scanning is expensive for small businesses."
"I rate the product's pricing a four out of ten."
"It follows the same licensing scheme as Tenable.io and Tenable. sc."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
832,138 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
13%
Government
6%
Computer Software Company
14%
Financial Services Firm
12%
Government
12%
Manufacturing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
What do you like most about Tenable.io Web Application Scanning?
The most effective feature of the product is the ability to scan the entire environment.
What needs improvement with Tenable.io Web Application Scanning?
We would like some additional features. Sometimes it lags with different cloud environments. Private clouds are becoming more common, and the integration lags with those compared to AWS, Azure, or ...
What advice do you have for others considering Tenable.io Web Application Scanning?
Overall, I would rate it an eight out of ten. We deploy it for customers, and it's very easy to deploy. Some people are worried about the cost, but we try to sell it at a good rate, less than the o...
 

Also Known As

Sonar
No data available
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Information Not Available
IMDEX
Find out what your peers are saying about SonarQube Server (formerly SonarQube) vs. Tenable.io Web Application Scanning and other solutions. Updated: January 2025.
832,138 professionals have used our research since 2012.