No more typing reviews! Try our Samantha, our new voice AI agent.

Cisco SecureX [EOL] vs SonarQube comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Nov 5, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cisco SecureX [EOL]
Average Rating
9.0
Reviews Sentiment
8.2
Number of Reviews
13
Ranking in other categories
No ranking in other categories
SonarQube
Average Rating
8.0
Reviews Sentiment
7.0
Number of Reviews
137
Ranking in other categories
Application Security Tools (1st), Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Featured Reviews

Alon K - PeerSpot reviewer
CTO & VP of Cyber Solutions, Israel at Rockwell Automation
Gives our customers visibility and they don't have to go multiple management consoles anymore
One of the examples is related to forensics. The forensics are amazing because when you have enrichment, and the solutions talk with each other, when you need it, you have the ability to know everything in the organization: when, why, whatever. With just one click you have information from email, from the endpoint, from the web. Let's say that tomorrow morning, you have a ransom[ware] attack in your organization and you would like to know from which email it came, or where the customer saved the file, even though the incident didn't occur at the same moment. With SecureX, you have Cisco Threat Response inside. [With] one click, you get all of the flow. That's amazing value. That also releases resources for our customers. The customers don't have to connect many systems and try to register the event on each system, or to go to the SIEM and do a correlation. That's the one-stop shop for the customers, and that's amazing.
Vitthal Gole - PeerSpot reviewer
Devops Engineer at AIQOD
Automated code checks have improved quality gates and prevent weak code from reaching production
SonarQube could improve by reducing false positives in its static code analysis; while its detection capabilities are strong, some findings require manual verification, increasing developers' workload. More accurate analysis would enhance productivity, and SonarQube would benefit from enhanced AI-powered recommendations for fixing issues. For instance, in our pipeline, if it fails during SonarQube stage, we could check the dashboard for identified issues involving code smells, bugs, or duplicacy. An AI feature should be integrated into SonarQube to resolve issues quickly; optimizing scanning performance for very large repositories and providing faster analysis times would enhance the developer experience, especially in large code bases with frequent commits. For anyone planning to implement SonarQube, I advise starting by defining coding standards first and integrating Quality Gates into the pipeline. You can customize quality profiles to match project requirements; rather than relying entirely on default rules, you can adjust settings for stronger detection and enforcement. Organizations with advanced security, branch analysis, and governance features might consider commercial editions based on their needs.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I like that I don't have to jump around to five different products and log into five different places to view the data that it returns."
"Integrates well with our existing security infrastructure."
"It has evolved a lot, just that monitoring piece to the current Orchestrator piece. The additional analytics are there. They now have something called Insight, which can basically take data from Microsoft Azure AD and Intune to give us information about our endpoints. This is detailed information about the endpoints, from Secure Endpoint and all these different products. So, it is just constantly evolving. Every time that it evolves, we have more information with more visibility. There are more features that we have that just make everything so much easier, and it is in one place. I don't have to keep going back and forth. I don't have to go to Secure Endpoint and ISE to get the data. I don't have to go to Intune on Microsoft to get the information. It is all in one place."
"When it comes as a business bundle, we come to customers to provide a one-stop shop, and we provide a return of value on human resources, with an XDR SecureX platform offer that customers love."
"The most beneficial feature of Cisco SecureX for cybersecurity efforts is its integration with other Cisco solutions and the environment. This sets it apart, as its APIs and overall integration capabilities are very strong. Additionally, its detection capabilities are commendable."
"SecureX has been keeping our devices safe during the pandemic and we haven't had any major threats that have come in or that have been found on our devices."
"We've reduced our workload by 20 to 30 percent just from being able to focus on the important things, as this product really does a lot of the grunt work for you."
"This solution definitely helps us meet our cyber security goals and we haven't had any problems so far."
"Engineers have also learned from the results and have improved themselves as engineers. This will help them with their careers."
"While annoying occasionally with its issue reports, it is actually an invaluable source of better knowledge and applying it in practice to your solutions."
"The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false positives and we can customize the rules."
"It provides a holistic picture of all quality issues in a software project."
"The most valuable feature of SonarCloud is its overall performance."
"I do recommend SonarQube because it is an easy tool that you can deploy and configure, and after that you can measure the history of your obligation and integrate it with other tools like GitLab or GitHub or Azure DevOps to do quality code analysis."
"Provides local scanning for developers."
"The integrations SonarQube provides with our software delivery pipeline are very seamless."
 

Cons

"If they could make the Cisco Umbrella piece a little bit more advanced or easier to manage, that would help. We use it for filtering and when you compare it to a normal content filter, it lacks some functionality."
"One of the improvements the product needs is more integration with collaboration platforms."
"It is good that it provides information. However, I think that there needs to be more actionable items for us based on the information provided."
"They could put in more third-party [integrations]... also more playbooks, out-of-the-box, for automation [would be helpful]."
"The automation and orchestration could be simpler."
"Remediation stuff could be integrated into the product's automation."
"They could expand into more areas. The more third-parties that we have tied into it, the better. The capabilities are there. As they just continue to involve the product, the more things that you can look into, then the more analytics that you can get. Also, the more data that we can get, then the better off we will be."
"The automation and orchestration could be simpler. It could be that all the other parts are that easy to use so that these stick out as a negative, but that's the trickiest part for us. The workflows within the orchestration are just a bit more difficult."
"SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird, and we then need to manually go and mark the false positive."
"It requires advanced heuristics to recognize more complex constructs that could be disregarded as issues."
"There is need for support for the additional languages and ease of use in adding new rules for detecting issues."
"SonarQube is not development-centric like Snyk."
"We had some issues where the Quality Gate check sometimes gets stuck and it is unclear."
"However, it takes a fair amount of effort to figure out how to get everything up and running."
"The product must improve security analysis."
"The solution has a very shallow SAST scanning; that is something that can be improved."
 

Pricing and Cost Advice

"The pricing is competitive, especially for education institutions. Licensing can be a little bit difficult to navigate, especially with resellers with Cisco, but for us it has been pretty easy."
"For the value you get, the pricing of the solution is excellent."
"Cisco SecureX is more expensive than Trend Micro. However, considering the integration capabilities with other solutions and the quality of technical support, I believe there's justification for the price difference."
"It comes free with all Cisco products. So, it is a good price."
"It would be nice if they had a different pricing model. Most of our budget for projects goes towards Cisco."
"The pricing is the best part of this solution. It is free if you buy Umbrella or Duo Security. It is also a good solution."
"The product is absolutely free to any customer. As such, the only thing one must keep in mind is that as long as he already has one Cisco security product, irregardless of what that product is, SecureX is available for free."
"You can spend less money for another solution, but if you really want to have a good solution you have to pay. We are happy that we are getting such a good solution for what we are spending."
"The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable."
"A low cost long-term solution for non-critical situations."
"We are using the open-source version, which is available free of cost."
"I think comparing the product to competitors it should be less expensive."
"It's an open-source product."
"SonarQube is a cost-effective solution."
"The solution has a free version and a license version. The license is priced reasonably, the cost of hiring one programmer is more expensive than the solution."
"I do not know about the pricing as I am using the community edition, which is free. But I compared the pricing with Sigma, and it is higher than SonarQube."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
909,563 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Outsourcing Company
19%
Construction Company
15%
Marketing Services Firm
8%
Comms Service Provider
6%
Financial Services Firm
13%
Manufacturing Company
13%
Computer Software Company
11%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise7
Large Enterprise3
By reviewers
Company SizeCount
Small Business44
Midsize Enterprise24
Large Enterprise80
 

Questions from the Community

Ask a question
Earn 20 points
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Also Known As

Kenna.AppSec, Kenna.VI
Sonar, SonarQube Cloud
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

NHS, Rackspace, UNC Pembroke, University of North Carolina at Charlotte, Missing Piece
Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: July 2026.
909,563 professionals have used our research since 2012.