Kiuwan vs SonarQube Server (formerly SonarQube) vs Veracode comparison

Kiuwan and Sonar are both solutions in the Application Security Tools category. Kiuwan is ranked #28 with an average rating of 7.8, while Sonar is ranked #1 with an average rating of 8.1. Kiuwan holds a 1.1% mindshare in AS, compared to Sonar’s 24.5% mindshare. Additionally, 93% of Kiuwan users are willing to recommend the solution, compared to 81% of Sonar users who would recommend it.

Kiuwan

Read 23 Kiuwan reviews

1,395 Views
1,064 Comparison Views

93% willing to recommend

SonarQube Server (formerly ...

Read 114 SonarQube Server (formerly SonarQube) reviews

32,190 Views
26,996 Comparison Views

81% willing to recommend

Veracode

Read 199 Veracode reviews

15,374 Views
10,793 Comparison Views

90% willing to recommend

Kiuwan

SonarQube Server (formerly ...

Veracode

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Kiuwan, SonarQube Server (formerly SonarQube), and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: May 2025).

Buyer's Guide

Application Security Tools

May 2025

Download the complete report

Helped 851,604 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of May 2025, in the Application Security Tools category, the mindshare of Kiuwan is 1.1%, up from 1.0% compared to the previous year. The mindshare of SonarQube Server (formerly SonarQube) is 24.5%, down from 27.0% compared to the previous year. The mindshare of Veracode is 9.4%, down from 10.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Mustufa Bhavnagarwala

CyberRisk Solution Advisor at Deloitte

Though a stable tool, the UI needs improvement

Kiuwan can improve its UI a little more. The user experience can be made better. Kiuwan offers a user interface that is similar to the one offered by Windows 7 or Windows 98, which I saw when I ran the tool and tried to scan the repository to find the security issues. The product's UI has certain shortcomings, where improvements are required.

Read full review

Chetan Jayatheertha

DevOps Manager at a computer software company with 5,001-10,000 employees

Has a great quality gate feature and improves the code coverage in your core base

We would like to have more visibility and more documentation, starting with the installation. It needs to be more standardized and explain all the features. We'd also like to get an idea of the level of stability we can get for our larger-sized projects. The notifications from the channel queue can be improved including email notifications. We currently rely on getting those notifications passed onto us and that should not be the case. The customization of different languages would also be helpful. If all the above could be implemented, SonarQube would be the best vulnerability security scanning tool.

Read full review

AkashKhurana

Senior Software Engineer at Publicis Sapient

Easy to configure, stable, and good vulnerability detection

Veracode's ability to prevent vulnerable code from being deployed into production is crucial. Typically, if a dependency we use has security issues or concerns, Veracode suggests upgrading to a more secure version. For example, if we're using a PayPal dependency with version 1.3 and it has a security bug, Veracode suggests upgrading to version 1.4 which fixes the issue. We usually make our project compatible with version 1.4, but sometimes Veracode recommends removing the dependent code altogether and adding the updated dependency from another repository. Veracode provides suggestions for resolving security issues and we implement them in our code after resolving any conflicts. We run the Veracode scan again and if it fails, we do not deploy the code to production. This is critical as it ensures that security issues such as bugs and fixes are addressed. Veracode consistently assists us in identifying security issues in third-party dependencies, while also ensuring the maintenance of code quality. Preventing security bugs and threats in our code improves the overall code quality of our company, which is essential given the significant concerns surrounding security today. Veracode's policy reporting is helpful for ensuring compliance with industry standards and regulations. Veracode's solution plays a major role in achieving compliance, including HIPAA compliance. Without Veracode scans, identifying security threats and third-party dependencies would be a tedious task for DevOps professionals. Veracode provides visibility into the status of our application during every phase of development, including continuous integration and continuous development CI/CD pipeline stages. This includes builds, package creation for deployment, and various enrollment stages such as develop, queue, stage, above, and production enrollment. Prior to each stage, a Veracode scan is run. This can be accessed through Jenkins or the CI/CD pipeline by clicking on the Veracode scan option, which provides a detailed report highlighting any security issues and concerns. Veracode performs statistical analysis, dynamic analysis, software composition analysis, and manual penetration tests throughout our software development life cycle. Veracode scans not only for third-party security issues but also for possible issues in our own code. This occurs in every phase of development, including the SDLC. For example, if we use an encryption algorithm with a private or public key that is easy to decode, Veracode will identify this as an error or warning in the report and suggest using multiple layers of encryption for the keys. The entire CI/CD process is part of DevOps. Therefore, the responsibility of configuring the Veracode tool usually falls on the DevOps professional. It is essential to integrate Veracode with the CI/CD pipeline within the project to ensure it is always incorporated. Whenever there is a priority or mandatory check required before deployment, Veracode should run beforehand. This integration is carried out by our DevSecOps team. Veracode's false positive rate is good, as it helps us identify possible security concerns in our code. In my opinion, it is advisable to run a Veracode scan on all codes. I have worked in the IT industry for five years, and I have observed that Veracode has been implemented in every project I have worked on. If a tool is improving our code quality and providing us with insights into potential security issues, it is always beneficial to use it. The false positive rate boosts our developers' confidence in Veracode when addressing vulnerabilities. Veracode also provides suggestions when there is a security issue with a dependency in version 1.7, prompting us to consider using version 1.8, which does not have security issues. This process involves the developers, and it leaves a positive impression on our managers and clients, demonstrating our commitment to security. We can show them that we were previously using version 1.7 but updated to version 1.8 after identifying the security issue with Veracode's help. Unfortunately, there is no centralized platform to check for network issues or problems with dependencies and versions. Veracode provides a centralized solution where we can scan our project and receive results. Veracode has helped our organization address flaws in our software and automation processes. Its positive impact has been reflected in our ROI, which increased when we started using Veracode. Without Veracode, we would be susceptible to security issues and potential hacking. However, after implementing Veracode scans, we have not encountered any such problems. It is critical for us to use Veracode because we capture sensitive data such as pharmacy information for real-time users, including patient prescriptions and refill schedules. This sensitive data could pose a significant problem if our code or software has security vulnerabilities. Fortunately, Veracode scans allow us to prevent such issues. Veracode has helped our developers save time by providing a solution that eliminates the need to manually check for dependencies or search the internet for information on which dependencies have issues. Instead, Veracode provides a detailed report that identifies the issues and recommends the appropriate version to use. Using Veracode ensures the quality of our code and also saves time for our developers. In my career of five years, Veracode has helped me resolve code issues eight times. Veracode has reduced our SecOps costs by identifying security vulnerabilities in our code. Without Veracode, if we were to go live with these issues, it could result in a breach of our encrypted data, potentially causing significant harm to our organization. This would require significant time and cost to resolve the issue and restore the data. Veracode has improved the quality of our code and reduced the risk of such incidents occurring, thereby minimizing their impact on our organization.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I've found the reporting features the most helpful."

"It provides value by offering options to enhance both code quality and the security of the company."

"The solution offers very good technical support."

"I like that I can scan the code without sending it to the Kiuwan cloud. I can do it locally on my device. When the local analyzer finishes, the results display on the dashboard in the cloud. It's essential for security purposes to be able to scan my code locally."

"I find it immensely helpful because it's not just about generating code; it's about ensuring efficiency in the execution."

"I have found the security and QA in the source code to be most valuable."

"I like that it provides a detailed report that lets you know the risk index and the vulnerability."

"I've tried many open source applications and the remediation or correction actions that were provided by Kiuwan were very good in comparison."

More Kiuwan pros

"The most valuable feature of SonarQube I have found to be the configuration that has allowed us to can make adjusts to the demands of the code review. It gives a specified classification regarding the skill, prioritization, and it is easy for me to review and make my code."

"SonarQube is good in terms of code review and to report on basic vulnerabilities in your applications."

"The most valuable features are the dashboard reports and the ease of integrating it with Jenkins."

"The most valuable features are the wide array of languages, multiple languages per project, the breakdown of bugs, and the description of vulnerabilities and code smells (best practices)."

"We advise all of our developers to have this solution in place."

"Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors."

"We use this solution for qualitative coding. We make use of the SonarLint plugin as well as the dashboard."

"It assists during the development with SonarLint and helps the developer to change his approach or rather improve his coding pattern or style. That's one advantage I've seen. Another advantage is that we can customize the rules."

More SonarQube Server (formerly SonarQube) pros

"Veracode offers various security features."

"The platform itself has a lot of AppSec best practices information, especially in the mitigation recommendation process."

"I have found the user interface extremely helpful in prioritizing issues."

"Static scanning and software composition analysis are very helpful. I and my colleagues don't need to be an expert on all of those ancillary things, so we can focus more on the business deliverables."

"Stable and scalable, with good reporting features. Helps in detecting and managing vulnerabilities and risks."

"Wide range of platforms and technology assessments."

"Veracode creates a list of issues. You can go through them one by one and click through to a new window with all the information about the issue discovered."

"I like the way the flaws are reported in the system."

More Veracode pros

Cons

"The product's UI has certain shortcomings, where improvements are required."

"I would like to see better integration with the Visual Studio and Eclipse IDEs."

"The solution seems to give us a lot of false positives. This could be improved quite a bit."

"It would be beneficial to streamline calls and transitions seamlessly for improved functionality."

"I would like to see additional languages supported."

"It could improve its scalability abilities."

"The development-to-delivery phase."

"The next release should include more flexibility in the reporting."

More Kiuwan cons

"There are limitations to the free version that limit development options as far as languages."

"We have tens of millions of code to be analyzed and processed. There can be some performance degradation if we are applying Sonar Link to large code or code that is complex. When the code had to be analyzed is when we ran into the main issues. There were several routines involved to solve those performance issues but this process should be improved."

"The tool needs to be more compatible with C/C++ language"

"New plug-ins should be integrated into SonarCloud to give more flexibility to the product."

"We've been using the Community Edition, which means that we get to use it at our leisure, and they're kind enough to literally give it to us. However, it takes a fair amount of effort to figure out how to get everything up and running. Since we didn't go with the professional paid version, we're not entitled to support. Of course that could be self-correcting if we were to make the step to buy into this and really use it. Then their technical support would be available to us to make strides for using it better."

"We also use Fortify, which is another tool to find security errors. Fortify is a better security tool. It is better than SonarQube in finding errors. Sometimes, SonarQube doesn't find some of the errors that Fortify is able to find. Fortify also has a community, which SonarQube doesn't have. Its installation is a little bit complex. We need to install a database, install the product, and specify the version of the database and the product. They can simplify the installation and make it easier. We use docker for the installation because it is easier to use. Its dashboard needs to be improved. It is not intuitive. It is hard to understand the interface, and it can be improved to provide a better user experience."

"SonarQube could improve its static application security testing as per the industry standard."

"The solution is a bit lacking on the security side, in terms of finding and identifying vulnerabilities."

More SonarQube Server (formerly SonarQube) cons

"The language version support could be improved."

"The interface is one thing I find a little challenging. Veracode's interface feels a little outdated compared to other solutions, and it could be modernized. I'm mostly happy with the features, but Vercaode could add Docker image scanning."

"Straightforward to set up, but the configuration of the rules engine is difficult and complicated."

"The triage indicator was kind of hard to find. It's a very small arrow and I had no idea it was there."

"While Veracode is way ahead of its competitors on Gartner Magic Quadrant, it's a bit more expensive than Fortify. It's a good solution for the cost, but if we had a high budget, we would go with Checkmarx, which is much better than Veracode."

"A nice addition would be if it could be extended for scenarios with custom cleansers."

"The overall reporting structure is complicated, and it's difficult to understand the report."

"I've found that Veracode is not particularly suitable for Dynamic Application Security Testing."

More Veracode cons

Pricing and Cost Advice

"Check with your account manager."

"This solution is cheaper than other tools."

"Nothing special. It's a very fair model."

"The price of Kiuwan is lower than that of other tools on the market."

"Kiuwan is an open-source solution and free to use."

"I recommend contacting a sales person who will create the best plan payment plan for you, as we did."

"It follows a subscription model. I think the price is somewhere in the middle."

"I am satisfied with the pricing."

"Get the paid version which allows the customized dashboard and provides technical support."

"SonarQube is an open-source product that can be used free of charge."

"We have a license with 125,000 lines of code. We did not purchase a lot of lines but it is specific to our code environment."

"We did not purchase a license (required for C++ support), but this option was considered."

"It's an open-source product."

"We are using the open-source version, which is available free of cost."

"I was using the Community Edition, which is available free of charge."

More SonarQube Server (formerly SonarQube) pricing and cost advice

"Compared to the typical software composition analysis solutions, Veracode is not so costly, although the static analysis part of it is a little costlier."

"If you're licensing, and you're looking at licensing models, you might want to ask Veracode about their microservice, depending on the company. If you are a microservice architecture, I would suggest asking them about their microservice pricing. I would suggest that you evaluate that with your code and their other licensing model, which is like a lump sum in size of artifacts, and just make sure that you price that out with them, because there might be some tradeoffs that can be made in price."

"From a cost perspective, it seems okay, although we will probably evaluate alternatives next time it's up for renewal because for us, it's a relatively high cost, and we want to make sure that we are using our resources most appropriately."

"It is an expensive solution, but it's the best solution available on the market. If you want something at the top, you have to pay a bit more than the average."

"I don't really get too involved in the cost sides of things that's in my job, I'm more of a technical focus, but I have heard from my manager and a couple other people that the solution is quite expensive."

"Veracode is costly. They have different license models for different customers. What we had was based on the amount of code that has been analyzed. The license that we had was capped to a certain amount, for example, 5 Gig. There would be an extra charge for anything above 5 Gig."

"Pricing/licensing is complicated."

"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

851,604 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

17%

Financial Services Firm

15%

Manufacturing Company

Insurance Company

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Computer Software Company

16%

Financial Services Firm

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Kiuwan?

The most valuable feature of the solution stems from the fact that it is quick when processing and giving an output o...

See all answers

What is your experience regarding pricing and costs for Kiuwan?

I'm not entirely sure about the price and business aspects, but I assume Checkmarx might be less expensive. I think C...

See all answers

What needs improvement with Kiuwan?

Kiuwan can improve its UI a little more. The user experience can be made better. Kiuwan offers a user interface that ...

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which ...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and securi...

See all answers

What do you like most about Veracode?

The SAST and DAST modules are great.

See all answers

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and da...

See all answers

What needs improvement with Veracode?

Veracode Greenlight scans the code while the developer writes it. It will be beneficial for developers if Veracode Gr...

See all answers

Comparisons

Snyk vs Kiuwan

Compared 9% of the time

Checkmarx One vs Kiuwan

Compared 9% of the time

SonarQube Cloud (formerly SonarCloud) vs Kiuwan

Compared 5% of the time

Fortify on Demand vs Kiuwan

Compared 5% of the time

GitLab vs Kiuwan

Compared 5% of the time

More Kiuwan Competitors

Checkmarx One vs SonarQube Server (formerly SonarQube)

Compared 13% of the time

Coverity vs SonarQube Server (formerly SonarQube)

Compared 13% of the time

GitHub Advanced Security vs SonarQube Server (formerly SonarQube)

Compared 11% of the time

SonarQube Cloud (formerly SonarCloud) vs SonarQube Server (formerly SonarQube)

Compared 8% of the time

More SonarQube Server (formerly SonarQube) Competitors

Checkmarx One vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 6% of the time

Snyk vs Veracode

Compared 5% of the time

Fortify on Demand vs Veracode

Compared 5% of the time

Fortify Static Code Analyzer vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Kiuwan

May 2025

Download Kiuwan product report

Buyer's Guide

SonarQube Server (formerly SonarQube)

April 2025

SonarQube Server (formerly SonarQube) report

Download SonarQube Server (formerly SonarQube) product report

Buyer's Guide

Veracode

April 2025

Download Veracode product report

Also Known As

No data available

Sonar

Crashtest Security , Veracode Detect

Interactive Demo

Demo not available

Kiuwan

Sonar

Demo not available

Veracode

Overview

Software analytics technology with a breadth of third party integrations that takes into account the wealth of applications your teams are currently using.

We facilitate and encourage work between unlocalized teams. We understand the complexity of working on multi technology environments, constantly striving to increase the number of programming languages and technologies we support.

Kiuwan

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

Sonar

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

DHL, BNP Paribas, Zurich, AXA, Ernst & Young, KFC, Santander, Latam, Ferrovial

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Application Security Tools

May 2025

Download Free Report

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: May 2025.

DOWNLOAD NOW

851,604 professionals have used our research since 2012.