No more typing reviews! Try our Samantha, our new voice AI agent.

CAST Highlight vs Sonatype Lifecycle comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Mar 11, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CAST Highlight
Ranking in Software Composition Analysis (SCA)
16th
Average Rating
7.8
Reviews Sentiment
7.1
Number of Reviews
7
Ranking in other categories
No ranking in other categories
Sonatype Lifecycle
Ranking in Software Composition Analysis (SCA)
6th
Average Rating
8.4
Reviews Sentiment
7.0
Number of Reviews
48
Ranking in other categories
Application Security Tools (12th), Cloud Cost Management (10th), Software Supply Chain Security (6th), AI Software Development (15th)
 

Mindshare comparison

As of April 2026, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 1.2%, up from 0.9% compared to the previous year. The mindshare of Sonatype Lifecycle is 4.7%, down from 5.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Software Composition Analysis (SCA) Mindshare Distribution
ProductMindshare (%)
Sonatype Lifecycle4.7%
CAST Highlight1.2%
Other94.1%
Software Composition Analysis (SCA)
 

Featured Reviews

Jayanti Rode - PeerSpot reviewer
Technical Associate Manager at Accenture
Identifies migration blockers and boosters while facing challenges with platform-specific roadblocks
The solution provides agnostic blockers for platforms as well as for containerization. Within that containerization, it offers generic blockers. However, my project might require it to provide Windows-specific blockers or Linux-specific blockers, as I often work with only one platform at a time. If I received categorization in containerization blockers, it would save time. Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time. Initially, I receive a response from support, however, if there is involvement from R&D or other teams, it may take longer than expected. The support team is challenging when sharing source code. As this is a static code analysis tool, it sometimes requires source code for R&D. However, CAST clients may be restricted from sharing due to business logic and nondisclosure agreements. This creates a challenge, and I may have to share pseudo code or seek client approval, risking escalation.
@RahulVerma  - PeerSpot reviewer
Presales Engineer at Rah Infotech Pvt Ltd
Compliance used to slow us down. Sonatype Lifecycle turned it into an automated, streamlined step that accelerates delivery instead of blocking it.
Sonatype Lifecycle already does a nice job, but as you use it, you can’t help but notice a few spots where it could feel even smoother. Imagine opening it and immediately seeing a clearer, friendlier dashboard that tells you exactly what deserves your attention without digging around. As you move through your workflow, it would be great if the tool connected more naturally with what you’re already using, so everything just flows. And when an issue pops up, instead of leaving you guessing, it could guide you through what to do next in a way that feels simple and supportive. Even having a bit more visibility into anything happening behind the scenes would make the experience feel more complete. It’s already strong, but with touches like these, it could feel even more helpful and intuitive in everyday use.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features of CAST Highlight are automation and speed."
"We've been using it for two years and found that it is really profitable to have the product in our arsenal."
"We are using CAST Highlight for the location because it's an indicator for us that can differentiate us from the other health insurance company, and we are using the indicator as proof of the quality of service for our application."
"It offers good performance."
"The solution provides agnostic blockers for platforms as well as for containerization."
"CAST Highlight provides a clear overview of the role portfolio and allows users to assess the overall quality of the environment. Users can see where improvements are needed and follow up on trends of the application."
"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."
"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable, and it works seamlessly with most languages."
"What's really nice about that is it shows a graph of all the versions for that particular component, and it marks out the ones that have a vulnerability and the ones that don't have a vulnerability."
"Vulnerability detection accuracy is good."
"We really like the Nexus Firewall. There are increasing threats from npm, rogue components, and we've been able to leverage protection there. We also really like being able to know which of our apps has known vulnerabilities."
"Using the solution we have been able to clean our environment, providing more protection for our applications."
"The solution enables us to manage and secure the component part of our software supply chain, and we have definitely had 1,000 or more components quarantined during our use of the product, all of which is technical debt we would have accrued if we hadn't been using it."
"Automating the Jenkins plugins and the build title is a big plus."
"The violation reports provided by Lifecycle are key, giving specific details on the types of violations and identifying the component within the application."
"When I started to install the Nexus products and started to integrate them into our development cycle, it helped us construct or fill out our development process in general. The build stage is a really good template for us and it helped establish a structure that we could build our whole continuous integration and development process around. Now our git repos are tagged for different build stages data, staging, and for release. That aligns with the Nexus Lifecycle build stages."
 

Cons

"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive."
"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."
"There's a bit of a learning curve at the outset."
"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."
"It is a pretty costly tool. A lot of customers are resistant to using it."
"Technical support could be better."
"There could be potential improvements or additional features added to CAST Highlight to make it better."
"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."
"One of the things that we specifically did ask for is support for transitive dependencies."
"The GUI is simple, so it's easy to use. It started as great to use, but for larger scale companies, it also comes with some limitations."
"As far as the relationship of, and ease of finding the relationships between, libraries and applications across the whole enterprise goes, it still does that. They could make that a little smoother, although right now it's still pretty good."
"They could do with making more plugins for the more common integration engines out there; right now, it supports automation engine by Jenkins but it doesn't fully support something like TeamCity."
"Unfortunately, we haven't been able to take full advantage of Nexus."
"The reporting capability is good but I wish it was better. I sent the request to support and they raised it as an enhancement within the system. An example is filtering by version. If I have a framework that is used in all applications, but version 1 is used in 50 percent of them and version 2 in 25 percent, they will show as different libraries with different usage. But in reality, they're all using one framework."
"One downside to Sonatype life-cycle is that it's Policies and alert is feel overwhelming , when first seen by the team as it is too early in security journey/life-cycle. Usually just highlighting gaps is best as too informative dashboards lead to priority fatigue."
"Fortify's software security center needs a design refresh."
 

Pricing and Cost Advice

"It is a pretty costly tool. A lot of customers are resistant to using it."
"CAST Highlight is an expensive solution."
"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."
"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."
"The license fee may be a bit harder for startups to justify. But it will save you a headache later as well as peace of mind. Additionally, it shows your own customers that you value security stuff and will protect yourselves from any licensing issues, which is good marketing too."
"We're pretty happy with the price, for what it is delivering for us and the value we're getting from it."
"In addition to the license fee for IQ Server, you have to factor in some running costs. We use AWS, so we spun up an additional VM to run this. If the database is RDS that adds a little bit extra too. Of course someone could run it on a pre-existing VM or physical server to reduce costs. I should add that compared to the license fee, the running costs are so minimal they had no effect on our decision to use IQ Server."
"There are additional costs in commercial offerings for add-ons such as Nexus Container or IDE Advanced Toolkit. They come with additional fees or licenses."
"Given the number of users we have, it is one of the most expensive tools in our portfolio, which includes some real heavy-duty tools such as GitLab, Jira, etc. It is definitely a bit on the expensive side, and the ambiguity in how the licenses are calculated adds to the cost as well. If there is a better understanding of how the licenses are being calculated, there would be a better agreement between the two parties, and the cost might also be a little less. There is no extra cost from Sonatype. There is an operational cost on the BT side in terms of resources, etc."
"Pricing is comparable with some of the other products. We are happy with the pricing."
"In comparison with other tools, Sonatype Nexus Lifecycle could be more expensive. Still, at the same time, my company prioritizes security, so the pricing for Sonatype Nexus Lifecycle hasn't been an issue. If IT security weren't at the top of the list for my company, somebody would have raised the question about cost and how Sonatype Nexus Lifecycle is in terms of ROI. So far, there's been no question about the price. The cost of Sonatype Nexus Lifecycle hasn't been a problem so far. My company pays for the license yearly, plus technical support."
"It's expensive, but you get what you pay for. There were no problems with the base license and how they do it. It was transparent. You don't have to worry. You can scan to your heart's delight."
report
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
885,789 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
8%
Government
7%
Outsourcing Company
7%
Financial Services Firm
26%
Manufacturing Company
10%
Computer Software Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise5
By reviewers
Company SizeCount
Small Business13
Midsize Enterprise8
Large Enterprise31
 

Questions from the Community

What is your experience regarding pricing and costs for CAST Highlight?
The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.
What needs improvement with CAST Highlight?
The solution provides agnostic blockers for platforms as well as for containerization. Within that containerization, it offers generic blockers. However, my project might require it to provide Wind...
What is your primary use case for CAST Highlight?
For CAST, I use it in cloud migration roadmap and in open source safety issues. These are my two main use cases.
How does Sonatype Nexus Lifecycle compare with SonarQube?
We like the data that Sonatype Nexus Lifecycle consistently delivers. This solution helps us in fixing and understanding the issues a lot quicker. The policy engine allows you to set up different t...
What is your experience regarding pricing and costs for Sonatype Nexus Lifecycle?
From my experience, the licensing side is pretty straightforward to handle. Most of the cost and pricing considerations really come down to how the solution is deployed. Since we work with partners...
What needs improvement with Sonatype Nexus Lifecycle?
Sonatype Lifecycle already does a nice job, but as you use it, you can’t help but notice a few spots where it could feel even smoother. Imagine opening it and immediately seeing a clearer, friendli...
 

Comparisons

 

Also Known As

No data available
Sonatype Nexus Lifecycle, Nexus Lifecycle, Sonatype Container
 

Overview

 

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF
Genome.One, Blackboard, Crediterform, Crosskey, Intuit, Progress Software, Qualys, Liberty Mutual Insurance
Find out what your peers are saying about CAST Highlight vs. Sonatype Lifecycle and other solutions. Updated: March 2026.
885,789 professionals have used our research since 2012.