CAST Highlight vs SonarQube comparison

CAST Highlight
Read 5 CAST Highlight reviews
  • 424 Views
  • 306 Comparison Views
100% willing to recommend
SonarQube
Read 112 SonarQube reviews
  • 48,783 Views
  • 39,042 Comparison Views
81% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive Summary
We performed a comparison between CAST Highlight and SonarQube based on real PeerSpot user reviews.

Find out in this report how the two Software Composition Analysis (SCA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed CAST Highlight vs. SonarQube Report (Updated: September 2022).
Buyer's Guide
CAST Highlight vs. SonarQube
September 2022
Download the complete report
Helped 793,295 peers since 2012
 

Categories and Ranking

CAST Highlight
Average Rating
7.8
Number of Reviews
5
Ranking in other categories
Software Composition Analysis (SCA) (13th)
SonarQube
Average Rating
8.0
Number of Reviews
112
Ranking in other categories
Application Security Tools (1st), Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

As of July 2024, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 1.4%, up from 0.9% compared to the previous year. The mindshare of SonarQube is 37.5%, down from 42.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Software Composition Analysis (SCA)
Unique Categories:
No other categories found
Application Security Tools
28.0%
Static Application Security Testing (SAST)
31.4%
 

Featured Reviews

AS
Oct 20, 2022
Easy to set up with optimized and automated insights
We get some code insights from CAST. We get insights as to if this or that function has way too many comments or things like that. We would like to backtrace, and understand how dependent that is as per the application. For example, when you are writing code in C Sharp versus writing code in C++, obviously, C++ has more complexities within that. What CAST does is CAST aggregates for different languages, and if they could provide us inputs for each of these languages separately, then that'd be great. When they classify code between their own code and third-party code, they classify it based on the number of files, and not really the number of lines. I'm not sure how extensive of a change this is on their end; however, it would be nice if they could tell us the number of lines of code that are not theirs. There's a bit of a learning curve at the outset. We have come across bugs occasionally. Technical support could be better.
Read full review
Wang Dayong - PeerSpot reviewer
May 10, 2023
Easy to integrate and has a plug-in that supports both C and C++ languages
We use the product to review our software codes. We have integrated the product to review our new delivery code When we deliver a code, the solution scans the code and reports whether the code has bugs or any other vulnerability issues. Thus the solution helps us identify issues and improve the…
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features of the CAST Highlight are the interface and there are three notations that are very simple to understand and communicate with."
"It offers good performance."
"The most valuable features of CAST Highlight are automation and speed."
"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."
"CAST Highlight is easy to use and has a good dashboard."
"I like that it helps us maintain our work quality and code security."
"We've configured it to run on each commit, providing feedback on our software quality. ]"
"Integrate it into the developers' workbench so that they can bench check their code against what will be done in the server-based audit version."
"The product itself has a friendly UI."
"If code coverage is a low number then that's of great value to me."
"The tool helps us to monitor and manage violations. It manages the bugs and security violations."
"This solution has the capability to analyze source code in almost all the languages in the market."
"The features of SonarQube that I find most valuable for identifying code smells are its comprehensive code analysis capabilities, which cover various aspects of code sustainability."
More SonarQube pros
 

Cons

"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."
"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."
"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."
"The ease of configuration and customization could be improved in CAST Highlight."
"There's a bit of a learning curve at the outset."
"We previously experienced issues with security but a segregated security violation has been implemented and the issues we experienced are being fixed."
"After scanning our code and generating a report, it would be helpful if SonarQube could also generate a solution to fix vulnerabilities in the report."
"The product provides false reports sometimes."
"This solution finds issues that are similar to what is found by Checkmarx, and it would be nice if the overlap could be eliminated."
"There isn't a very good enterprise report."
"In the next release, I would like to have notifications because now, it is a bit difficult. I think that's a feature which we could add there and it would benefit the users as well. For every full request, they should be able to see their bugs or vulnerability directly on the surface."
"We've been using the Community Edition, which means that we get to use it at our leisure, and they're kind enough to literally give it to us. However, it takes a fair amount of effort to figure out how to get everything up and running. Since we didn't go with the professional paid version, we're not entitled to support. Of course that could be self-correcting if we were to make the step to buy into this and really use it. Then their technical support would be available to us to make strides for using it better."
"Code security scanning could be improved."
More SonarQube cons
 

Pricing and Cost Advice

"CAST Highlight is an expensive solution."
"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."
"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."
"It is a pretty costly tool. A lot of customers are resistant to using it."
"We are using the free, unlicensed version."
"The free version of SonarQube does everything that we need it to."
"We use the tool's community edition."
"The product’s price is lower than Veracode’s price."
"The licence is standard open source licensing"
"We are using the community version of the solution and we plan on purchasing licenses for the upgraded version soon. There is a limitation on how many lines of code can be scanned and this is why we are going to purchase a license for an increased amount."
"We use the solution free of cost."
"On the pricing side, it's 3,000 Euros for 1 million lines of code."
More SonarQube pricing and cost advice
report
See which vendors are best for you
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
See recommendations
793,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
17%
Insurance Company
10%
Manufacturing Company
10%
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
12%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about CAST Highlight?
The most valuable features of CAST Highlight are automation and speed.
See all answers
What is your experience regarding pricing and costs for CAST Highlight?
CAST Highlight is an expensive solution. On a scale from one to ten, where one is cheap, and ten is expensive, I rate the solution's pricing an eight or nine out of ten.
See all answers
What needs improvement with CAST Highlight?
The ease of configuration and customization could be improved in CAST Highlight.
See all answers
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
See all answers
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
See all answers
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
See all answers
 

Comparisons

Black Duck vs CAST Highlight Logo
Black Duck vs CAST Highlight
Compared 5% of the time
Snyk vs CAST Highlight Logo
Snyk vs CAST Highlight
Compared 5% of the time
Veracode vs CAST Highlight Logo
Veracode vs CAST Highlight
Compared 5% of the time
Checkmarx One vs CAST Highlight Logo
Checkmarx One vs CAST Highlight
Compared 4% of the time
GitLab vs CAST Highlight Logo
GitLab vs CAST Highlight
Compared 3% of the time
More CAST Highlight Competitors
Checkmarx One vs SonarQube Logo
Checkmarx One vs SonarQube
Compared 20% of the time
SonarCloud vs SonarQube Logo
SonarCloud vs SonarQube
Compared 13% of the time
Coverity vs SonarQube Logo
Coverity vs SonarQube
Compared 11% of the time
Veracode vs SonarQube Logo
Veracode vs SonarQube
Compared 9% of the time
HCL AppScan vs SonarQube Logo
HCL AppScan vs SonarQube
Compared 1% of the time
More SonarQube Competitors
 

Product Reports

Buyer's Guide
CAST Highlight
July 2024
CAST Highlight reportDownload CAST Highlight product report
Buyer's Guide
SonarQube
June 2024
SonarQube reportDownload SonarQube product report
 

Also Known As

No data available
Sonar
 

Learn More

CAST
Sonar
 

Interactive Demo

Demo not available
CAST
Sonar
 

Overview

CAST Highlight is a SaaS software intelligence product for performing rapid application portfolio analysis. It automatically analyzes source code of hundreds of applications in a week for Cloud Readiness, Software Composition Analysis (Open Source risks), Resiliency, and Technical Debt. Objective software insights from automated source code analysis combined with built-in qualitative surveys for business context enable more informed decision-making about application portfolios.

CAST is the software intelligence category leader. CAST technology can see inside custom applications with MRI-like precision, automatically generating intelligence about their inner workings - composition, architecture, transaction flows, cloud readiness, structural flaws, legal and security risks. It’s becoming essential for faster modernization for cloud, raising the speed and efficiency of Software Engineering, better open source risk control, and accurate technical due diligence. CAST operates globally with offices in North America, Europe, India, China. Visit www.castsoftware.com.

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

 

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF
Buyer's Guide
CAST Highlight vs. SonarQube
September 2022
Free Report: CAST Highlight vs. SonarQube
Find out what your peers are saying about CAST Highlight vs. SonarQube and other solutions. Updated: September 2022.
DOWNLOAD NOW
793,295 professionals have used our research since 2012.
See our CAST Highlight vs. SonarQube report.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.