CodeSonar vs Qualys Web Application Scanning comparison

Why PeerSpot?

AdaCore and Qualys are both solutions in the Application Security Tools category. AdaCore is ranked #35, while Qualys is ranked #20 with an average rating of 7.2. AdaCore holds a 1.0% mindshare in AS, compared to Qualys’s 1.8% mindshare. Additionally, 87% of AdaCore users are willing to recommend the solution, compared to 88% of Qualys users who would recommend it.

CodeSonar

Read 7 CodeSonar reviews

4,024 Views
2,777 Comparison Views

87% willing to recommend

Qualys Web Application Scan...

Read 40 Qualys Web Application Scanning reviews

7,432 Views
4,756 Comparison Views

88% willing to recommend

CodeSonar

Qualys Web Application Scan...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Qualys Web Application Scanning and CodeSonar offer strong competition in the cybersecurity sector with each catering to different aspects of security needs. Qualys has the upper hand in user support and accessibility, while CodeSonar takes the lead in detailed code analysis, offering value for in-depth security pursuits.

Features: Qualys Web Application Scanning provides comprehensive vulnerability detection, seamless integration capabilities, and a user-friendly interface. CodeSonar focuses on static code analysis, depth in identifying potential security risks, and detailed examination of code.

Room for Improvement: Qualys Web Application Scanning could work on enhancing real-time report customization, speeding up scanning processes, and expanding integration options. CodeSonar might benefit from a simpler learning curve, more intuitive navigation, and enhanced UI design.

Ease of Deployment and Customer Service: Qualys Web Application Scanning is known for straightforward deployment and reliable customer support, making it suitable for non-technical users. CodeSonar requires more technical understanding during deployment but offers a supportive service team for specialists familiar with in-depth analysis needs.

Pricing and ROI: Qualys generally offers a reasonable setup cost, providing good ROI with its comprehensive web security coverage suitable for organizations seeking broader security solutions. CodeSonar's higher initial investment is justified by the depth of its analysis, making it a beneficial long-term investment for companies focusing on detailed code security. Qualys is preferred for its quicker ROI, whereas CodeSonar's pricing aligns with more profound security analysis investments.

To learn more, read our detailed CodeSonar vs. Qualys Web Application Scanning Report (Updated: September 2026).

Buyer's Guide

CodeSonar vs. Qualys Web Application Scanning

September 2026

Download the complete report

Helped 915,341 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CodeSonar

Ranking in Application Security Tools

35th

Average Rating

8.2

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Static Code Analysis (10th)

Qualys Web Application Scan...

Ranking in Application Security Tools

20th

Average Rating

7.6

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (13th)

Mindshare comparison

As of October 2026, in the Application Security Tools category, the mindshare of CodeSonar is 1.0%, down from 1.4% compared to the previous year. The mindshare of Qualys Web Application Scanning is 1.8%, down from 2.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Qualys Web Application Scanning	1.8%
CodeSonar	1.0%
Other	97.2%

Application Security Tools

Featured Reviews

Mathieu ALBRESPY

Intigration Developer at ez-Wheel

Nice interface, quick to deploy, and easy to expand

This is the first time I've used this kind of software. It was the only one we could apply to analyze with MISRA rules. At my new company, I tried to use Klocwork. I tried to use it, just once so I cannot compare it exactly with CodeSonar. I also have a plugin for my Visual Studio and I try to make it work. It's not easy, however, I don't think that we have this kind of functionality with CodeSonar. It can do some incremental analysis. However, since this feature is also available on CodeSonar, it would be a good idea to have a plugin on Visual Studio just to have a quick analysis.

Read full review

AnkitSharma13

Security Officer at a tech vendor with 10,001+ employees

Web scanning needs improvement but offers good vulnerability detection

The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does. If Qualys Web Application Scanning could improve its crawling capability, it would be more user-friendly. Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities, which isn't as beneficial from my point of view. The Vulnerability Management also relies heavily on version numbers and will flag vulnerabilities based on the component version, but it doesn't check if a real fix exists, leading to flags on components that actually have workarounds available.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable features of CodeSonar were all the categorized classes provided, and reports of future bugs which might occur in the production code. Additionally, I found the buffer overflow and underflow useful."

"It has been able to scale."

"CodeSonar has helped our organization because it detects dead and nonusable parts of code to create a more optimized code."

"The tool is very good for detecting memory leaks."

"The most valuable feature of CodeSonar is the catching of dead code. It is helpful."

"It has helped us a lot with some issues and has helped us avoid bad code."

"The solution is very stable and we have used it for a long time with no issues."

"What I like best about CodeSonar is that it has fantastic speed, analysis and configuration times."

More CodeSonar pros

"Qualys Web Application Scanning is robust and mature from industry standards."

"I recommend Qualys Web Application Scanning as it is easy to set up scans and is affordable from a cost perspective."

"The product prevents possible vulnerabilities in our network."

"Qualys WAS' most valuable features are the navigation flow of the UI and the option for a different layer of security (identification and operation through email and mobile)."

"With our vulnerabilities under control, it's putting our services in compliance and minimizing our risk for exposure."

"The most valuable feature is that we are able to scan the services and put credentials like a user ID password, and we can verify the vulnerability level."

"It scans web applications to identify vulnerabilities during deployment."

"Qualys Web Application Scanning has multiple features like threat protection and container security scanning in one box."

More Qualys Web Application Scanning pros

Cons

"It was difficult for us to apply a rule, especially to a part of the code, and not apply it to the rest of the code."

"The scanning tool for core architecture could be improved."

"It would be beneficial for the solution to include code standards and additional functionality for security."

"The MISRA guidelines were not appropriately reported and there were some flags or errors."

"There could be a shared licensing model for the users."

"It was expensive."

"CodeSonar could improve by having better coding rules so we did not have to use another solution, such as MISRA C."

"In a future release, the solution should upgrade itself to the current trends and differentiate between the languages. If there are any classifications that can be set for these programming languages that would be helpful rather than having everything in the generic category."

More CodeSonar cons

"The area of false positives could be improved. There are quite a number of false positives as compared to other solutions. They could probably fine tune the algorithm to be able to reduce the number of false positives being detected."

"One area for improvement is the user interface. The new UI, which was recently upgraded, feels more complex and less user-friendly than the old version."

"It should have better automatic reporting."

"We receive false positives sometimes when using a solution that could be improved. However, the technical team provides us with the exact explanation why it was giving us that kind of error."

"We have many websites. We don't force scanning on all of them at once because it's taking some time."

"Please add manual penetration testing features. Also I didn't like the license terms and the features were limited compared to other tools used for web applications."

"The solution needs to adjust its pricing. They should make it more affordable."

"It is unclear how to build automation on Qualys. We do some automation, but not fully, because working is difficult."

More Qualys Web Application Scanning cons

Pricing and Cost Advice

"Our organization purchased a license to use the solution."

"The application’s pricing is high compared to other tools."

"Pricing is a bit costly."

"The solution's price depends on the number of licenses needed and the source code for the project."

"There are different options available with respect to licensing."

"Licensing was based on the number of assets that you want to scan on your network. You can also do licensing on subscription. On subscription, it is easier and more flexible. You tell Qualys that you want to move from the 1000 to 2000 band or the 3000 or 5000 band, then they will give you the quotation for it. Once you pay for it, applying the licensing is quite easy and effective."

"I rate the software’s pricing a six out of ten."

"Pricing was reasonable and competitive. It was not too far above the other products."

"We are on an annual license for the solution and the pricing could be more affordable."

"Qualys Web Application Scanning's pricing is a bit expensive compared to other solutions available in the market."

"We normally purchase an annual license."

"Qualys has an IT-based licensing based on a yearly license, which is a good way of handling it. However, in some cases, when we do the PCI scanning, the host will not like the scanning and we lose the IT license. So, this could be improved."

More Qualys Web Application Scanning pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

915,341 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

23%

University

Financial Services Firm

Computer Software Company

Financial Services Firm

12%

Manufacturing Company

11%

Outsourcing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	1
Large Enterprise	2

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	6
Large Enterprise	27

Questions from the Community

Ask a question

Earn 20 points

What is your experience regarding pricing and costs for Qualys Web Application Scanning?

Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.

See all answers

What needs improvement with Qualys Web Application Scanning?

See all answers

What is your primary use case for Qualys Web Application Scanning?

I use Qualys Web Application Scanning, and we are using Vulnerability Management. By Vulnerability Management, I mean not TotalCloud; they have some on-premises solutions also. Patch Management and...

See all answers

Comparisons

SonarQube vs CodeSonar

Compared 11% of the time

Polyspace Code Prover vs CodeSonar

Compared 8% of the time

Coverity Static vs CodeSonar

Compared 7% of the time

Veracode vs CodeSonar

Compared 6% of the time

CrowdStrike Falcon Cloud Security vs CodeSonar

Compared 2% of the time

More CodeSonar Competitors

Checkmarx SAST vs Qualys Web Application Scanning

Compared 8% of the time

SonarQube vs Qualys Web Application Scanning

Compared 7% of the time

Veracode vs Qualys Web Application Scanning

Compared 6% of the time

GitHub vs Qualys Web Application Scanning

Compared 6% of the time

OWASP Zap vs Qualys Web Application Scanning

Compared 5% of the time

More Qualys Web Application Scanning Competitors

Product Reports

Buyer's Guide

Application Security Tools

September 2026

Download CodeSonar product report

Buyer's Guide

Qualys Web Application Scanning

September 2026

Download Qualys Web Application Scanning product report

Also Known As

No data available

Qualys WAS

Overview

CodeSonar offers a potent tool for static code analysis, adept in detecting runtime errors and security vulnerabilities, with a fast deployment process and scalable capabilities. Its quick analysis and efficient web interface provide a strong basis for code quality validation.

CodeSonar specializes in identifying runtime errors, dead code, and security threats while providing features like code surfing and browsing. It offers a highly efficient web interface, though users find initial setup complex and highlight the need for better static analysis, broader language support beyond C and C++, and an improved licensing model. Despite these challenges, its integration with Jenkins and technical guidance support makes it a reliable choice for teams in defense and software quality assessment. Deployment is quick and easy, yet initial costs are a common concern among users.

What are the key features of CodeSonar?

Quick Analysis: Delivers fast runtime error detection and reporting.
GUI Interface: Offers a user-friendly experience for code browsing.
Scalability: Efficiently deploys across various environments.
Security and Code Detection: Identifies vulnerabilities and potential bugs.
Effective Configuration: Simplified log and analysis configuration.

What benefits can be seen in user reviews?

Detection of Code Vulnerabilities: Enhances security with robust threat detection.
Process Integration: Seamlessly integrates with DevOps tools such as Jenkins.
Scalable Deployment: Quickly adaptable in expanding environments.
GUI Usability: Highly efficient for technical teams to navigate.

CodeSonar is primarily implemented in industries like defense and companies prioritizing code quality. Teams utilize its static code analysis and threat detection capabilities, integrating with Jenkins for continuous integration workflows. Security checks post-builds and technical support are common, aiding in effective defect management.

AdaCore

Qualys Web Application Scanning offers advanced vulnerability management, progressive scheduling, and seamless integration with DevOps environments. Its user-friendly design enables enterprises to enhance security with comprehensive scanning and detailed forensic insights.

Qualys Web Application Scanning addresses enterprise-level security challenges by providing robust solutions for vulnerability management, penetration testing, and compliance checks. While easing the navigation process, it supports risk mitigation with precise risk ratings, minimal false positives, and detailed reporting. However, it faces challenges with its complex interface, authenticated scanning, and automation features. Integrating smoothly with CI/CD pipelines, it is suitable for continuous and automated scanning, adapting to diverse company requirements.

What are the standout features of Qualys Web Application Scanning?

Progressive Scheduling: Enables efficient management of scanning activities, optimizing for time-sensitive scenarios.
Vulnerability Management: Offers robust identification and management of vulnerabilities across various applications.
Integration with DevOps: Seamlessly integrates with CI/CD pipelines, supporting rapid development cycles.
Risk Ratings: Provides precise risk assessments, crucial for prioritizing security efforts.
Engaging Dashboard: Offers an intuitive interface for navigating security tasks efficiently.

What benefits or ROI should users look for in Qualys Web Application Scanning reviews?

Scalability: Supports enterprise needs with a design adaptable to diverse security demands.
Risk Mitigation: Detailed alerts and forensic insights aid in reducing potential threats.
Comprehensive Reporting: Facilitates informed decision-making with clear, concise reports.
Penetration Testing: Enhances security assessments with ongoing evaluation capabilities.

Organizations across sectors like education, banking, and international data centers leverage Qualys Web Application Scanning for conducting penetration testing, scanning web applications, and managing vulnerabilities. It aids in audit security and compliance, identifying threats, and generating user-friendly reports, making it a valuable asset for maintaining strong security postures.

Qualys

Sample Customers

Viveris, Micrel Medical Devices, Olympus, SOFTEQ, SONY

BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.

Buyer's Guide

CodeSonar vs. Qualys Web Application Scanning

September 2026

Free Report: CodeSonar vs. Qualys Web Application Scanning

Find out what your peers are saying about CodeSonar vs. Qualys Web Application Scanning and other solutions. Updated: September 2026.

DOWNLOAD NOW

915,341 professionals have used our research since 2012.

See our CodeSonar vs. Qualys Web Application Scanning report.

See our list of best Application Security Tools vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.