Sonatype Lifecycle and GitGuardian Platform are key players in the software security category. GitGuardian may have the upper hand due to its real-time secret detection and incident management capabilities.
Features: Sonatype Lifecycle specializes in open-source governance by providing security at every development stage, policy enforcement, continuous monitoring, and open-source intelligence. It integrates seamlessly into DevOps pipelines and enhances data quality management. GitGuardian Platform features real-time secret detection, proactive remediation, and risk minimization across codebases. It emphasizes incident management and enables collaboration between developers and security teams.
Room for Improvement: Sonatype Lifecycle could enhance its support for outdated Maven versions, integration, and reporting capabilities. It also needs to extend support for various languages and transitive dependencies, along with documentation and UI improvements. GitGuardian could improve Azure DevOps integration, streamline historical scans, enhance incident management, and reduce false positives.
Ease of Deployment and Customer Service: Sonatype is primarily deployed on-premises with hybrid cloud options, supported by robust technical support yet occasionally slow customer service. GitGuardian is mainly deployed on the public cloud with some on-premises options, noted for fast, effective support but facing minor implementation challenges.
Pricing and ROI: Sonatype Lifecycle has competitive pricing perceived as costly but providing value through bundled licenses and security measures that potentially reduce long-term expenses. GitGuardian's pricing is reasonable and competitive, but per-user costs can become high for larger teams. Both see ROI in improved security posture, though it remains challenging to quantify.
I can certainly say that we have saved significant time and resources in terms of people and automation.
The majority of our incidents for critical detectors and important secret types are remediated automatically or proactively by developers through GitGuardian's notification system, without security team involvement.
We have seen cost savings and efficiency improvements as we now know what happens in what was previously a black box.
I would rate their technical support a nine out of ten.
I would rate the technical support as excellent.
They are helpful when we raise any tickets.
In terms of scalability, I would rate it around a ten out of ten, as it handles all the repositories and commit activity we have.
I would rate it a ten out of ten for scalability.
Currently, what GitGuardian Platform is doing works effectively.
JFrog is easier to configure for high availability as it does not require extra components.
We set up a lot of the repository, so GitGuardian is a required check.
The SaaS platform has experienced two significant moments of downtime or instability in the last six months, requiring notices and retrospectives.
I would rate the stability of the GitGuardian Platform as excellent with no downtimes.
Sonatype Lifecycle is very stable, especially in the binary repository management use case for managing binary artifacts.
Another thing that would be good to see is some more metrics on the usage of the GitGuardian pre-push hooks.
The self-healing activity by developers isn't reflected in the analytics, requiring us to collect this data ourselves.
We are looking for better metrics and audit data, wanting more features such as knowing which users are creating the most secrets or committing the most secrets, what repository, what directory, and who is not checking in secrets.
We also noticed a lack of detailed information for configuring Sonatype Lifecycle for high availability and data recovery.
Overall, the secret detection sector is expensive, but we are happy with the value we get.
It's fairly priced, as it performs a lot of analysis and is a valuable tool.
For larger numbers like our case with 1,000 user licenses, JFrog becomes much more cost-effective, roughly ten times cheaper than Sonatype.
One of the best features of the solution is the ability to use pre-push hooks.
A high number of our exposures are remediated by developers before security needs to step in, as the self-healing playbook process engages them automatically.
GitGuardian Platform performs the capability to detect secrets in real time exceptionally, as it activates from the commit and can detect it immediately.
The integration into our CICD pipeline enables us to continuously monitor code changes and identify new vulnerabilities.
The most valuable feature for us is Sonatype Lifecycle's capability in identifying vulnerabilities.
GitGuardian helps organizations detect and fix vulnerabilities in source code at every step of the software development lifecycle. With GitGuardian’s policy engine, security teams can monitor and enforce rules across their VCS, DevOps tools, and infrastructure-as-code configurations.
Widely adopted by developer communities, GitGuardian is used by more than 500,000 developers and is the #1 app in the security category on the GitHub Marketplace. GitGuardian is also trusted by leading companies, including Instacart, Genesys, Orange, Iress, Beyond Identity, NOW: Pensions, and Stedi.
GitGuardian Platform includes automated secrets detection and remediation. By reducing the risks of secrets exposure across the SDLC, GitGuardian helps software-driven organizations strengthen their security posture and comply with frameworks and standards.
Its detection engine is trained against more than a billion public GitHub commits every year, and it covers 350+ types of secrets such as API keys, database connection strings, private keys, certificates, and more.
GitGuardian brings security and development teams together with automated remediation playbooks and collaboration features to resolve incidents fast and in full. By pulling developers closer to the remediation process, organizations can achieve higher incident closing rates and shorter fix times.
The platform integrates across the DevOps toolchain, including native support for continuously scanning VCS platforms like GitHub, Gitlab, Azure DevOps and Bitbucket or CI/CD tools like Jenkins, CircleCI, Travis CI, GitLab pipelines, and many more. It also integrates with ticketing and messaging systems like Splunk, PagerDuty, Jira and Slack to support teams with their incident remediation workflows. GitGuardian is offered as a SaaS platform but can also be hosted on-premise for organizations operating in highly regulated industries or with strict data privacy requirements.
Sonatype Lifecycle is an open-source security and dependency management software that uses only one tool to automatically find open-source vulnerabilities at every stage of the System Development Life Cycle (SDLC). Users can now minimize security vulnerabilities, permitting organizations to enhance development workflow. Sonatype Lifecycle gives the user complete control over their software supply chain, allowing them to regain wasted time fighting risks in the SDLC. In addition, this software unifies the ability to define rules, actions, and policies that work best for your organizations and teams.
Sonatype Lifecycle allows users to help their teams discover threats before an attack has the chance to take place by examining a database of known vulnerabilities. With continuous monitoring at every stage of the development life cycle, Sonatype Lifecycle enables teams to build secure software. The solution allows users to utilize a complete automated solution within their existing workflows. Once a potential threat is identified, the solution’s policies will automatically rectify it.
Benefits of Open-source Security Monitoring
As cybersecurity attacks are on the rise, organizations are at constant risk for data breaches. Managing your software supply chain gets trickier as your organization grows, leaving many vulnerabilities exposed. With easily accessible source code that can be modified and shared freely, open-source monitoring gives users complete transparency. A community of professionals can inspect open-source code to ensure fewer bugs, and any open-source dependency vulnerability will be detected and fixed rapidly. Users can use open-source security monitoring to avoid attacks through automatic detection of potential threats and rectification immediately and automatically.
Reviews from Real Users
Sonatype Lifecycle software receives high praise from users for many reasons. Among them are the abilities to identify and rectify vulnerabilities at every stage of the SDLC, help with open-source governance, and minimize risk.
Michael E., senior enterprise architect at MIB Group, says "Some of the more profound features include the REST APIs. We tend to make use of those a lot. They also have a plugin for our CI/CD.”
R.S., senior architect at a insurance company, notes “Specifically features that have been good include:
• the email notifications
• the API, which has been good to work with for reporting, because we have some downstream reporting requirements
• that it's been really user-friendly to work with.”
"Its engine itself is most valuable in terms of the way it calculates and decides whether a security vulnerability exists or not. That's the most important thing. Its security is also pretty good, and its listing about the severities is also good," says Subham S., engineering tools and platform manager at BT - British Telecom.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.