No more typing reviews! Try our Samantha, our new voice AI agent.

Onapsis vs SonarQube comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Onapsis
Ranking in Application Security Tools
38th
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
SonarQube
Ranking in Application Security Tools
1st
Average Rating
8.0
Reviews Sentiment
7.0
Number of Reviews
138
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

As of October 2026, in the Application Security Tools category, the mindshare of Onapsis is 0.9%, up from 0.3% compared to the previous year. The mindshare of SonarQube is 10.6%, down from 21.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
SonarQube10.6%
Onapsis0.9%
Other88.5%
Application Security Tools
 

Featured Reviews

it_user19113 - PeerSpot reviewer
SAP Security Consulting Engineer at a computer software company with 10,001+ employees
It checks for and reports vulnerabilities on all SAP systems at the OS, DB and SAP levels.
I really love how Onapsis X1 is able to check SAP for threats; the reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience. Currently, it takes some background jobs and additional work to get them published. It was difficult to get interactive reports to the different levels of the business. I would have to download them and send them out, or save them on my SharePoint site and send out a weekly link. In the version of the product I was usingת I had to log into the X1 system directly to get to the reports. Reporting would be used by several different areas of the organizationת many of whom would be at the director and executive levels. It would not make sense to have them log directly into the tool to look at these reports. Add to this that there was only one ID that could be used to log in and view the reports. To solve this problemת I had to run all of the different reports; executive summary down to detailed analysis and then export them out to my security team SharePoint site. To automate this processת a batch script was created to run after the X1 analyzed the systems. The script would pull the reports and place them in the SharePoint site automatically, but it was a bit of a hassle to get set up.
Vitthal Gole - PeerSpot reviewer
Devops Engineer at AIQOD
Automated code checks have improved quality gates and prevent weak code from reaching production
SonarQube could improve by reducing false positives in its static code analysis; while its detection capabilities are strong, some findings require manual verification, increasing developers' workload. More accurate analysis would enhance productivity, and SonarQube would benefit from enhanced AI-powered recommendations for fixing issues. For instance, in our pipeline, if it fails during SonarQube stage, we could check the dashboard for identified issues involving code smells, bugs, or duplicacy. An AI feature should be integrated into SonarQube to resolve issues quickly; optimizing scanning performance for very large repositories and providing faster analysis times would enhance the developer experience, especially in large code bases with frequent commits. For anyone planning to implement SonarQube, I advise starting by defining coding standards first and integrating Quality Gates into the pipeline. You can customize quality profiles to match project requirements; rather than relying entirely on default rules, you can adjust settings for stronger detection and enforcement. Organizations with advanced security, branch analysis, and governance features might consider commercial editions based on their needs.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It has hardened our SAP system by providing details of vulnerabilities in our SAP landscape."
"The solution offers a very good community edition."
"Before you even compile, it can catch known vulnerability issues or patterns."
"We use SonarQube to find vulnerabilities in the source code, for better code quality, and code security."
"I'm not implementing the solutions. However, I've talked to the people who deploy the tools, and they are happy with how easy setting up SonarCloud is."
"It automatically scans for code, detects vulnerabilities, and generates daily reports."
"Apart from the security point of view, I like that it makes it easy to detect code smells and other issues in terms of code quality and standards."
"We have a big organization with a lot of applications and all of our critical applications are on this platform."
"While annoying occasionally with its issue reports, it is actually an invaluable source of better knowledge and applying it in practice to your solutions."
 

Cons

"Reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience."
"In terms of what can be improved, the areas that need more attention in the solution are its architecture and development."
"We've been using the Community Edition, which means that we get to use it at our leisure, and they're kind enough to literally give it to us. However, it takes a fair amount of effort to figure out how to get everything up and running. Since we didn't go with the professional paid version, we're not entitled to support. Of course that could be self-correcting if we were to make the step to buy into this and really use it. Then their technical support would be available to us to make strides for using it better."
"When we have a thousand products published over it, we expect it to be more efficient in terms of serving requests from the browser."
"We had some issues with the scanner."
"Code security could be better. They are already focusing on it, but I see a lot of improvement opportunities over there. I can see a lot of false positives in terms of security. They need to make the tests more accurate so that the false positives are not detected so frequently. It would also help if they provided us with an installer."
"A little bit more emphasis on security and a bit more security scanning features would be nice."
"The learning curve can be fairly steep at first, but then, it's not an entry-level type of application."
"I have found this solution creates more noise than competitors."
 

Pricing and Cost Advice

Information not available
"There is both a free and licensed version. The free version has limitations on development languages and support."
"We are using the Community edition of SonarQube."
"There are many different packages with different pricing options available. We are able to try what we have and if we need extra features we can upgrade the license."
"This product is open source and very convenient."
"We use the free version; there are no hidden costs or licensing required."
"I use the full trial version of SonarQube."
"A low cost long-term solution for non-critical situations."
"SonarQube is a fairly affordable solution for a larger scale if you have a specific role or specific department for secure code."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
916,117 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
University
13%
Construction Company
13%
Energy/Utilities Company
13%
Outsourcing Company
7%
Manufacturing Company
13%
Financial Services Firm
13%
Computer Software Company
10%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise24
Large Enterprise80
 

Questions from the Community

Ask a question
Earn 20 points
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Comparisons

 

Also Known As

No data available
Sonar, SonarQube Cloud
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Sony, US Army, Westinghouse, AXA. Galicia, Daimler, Roche, Levi's, Siemens, ABB, KPMG, Mercardo Libre, Verizon, Bacardi, Adgas, Sicpa, Whirlpool, Leaseplan
Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: September 2026.
916,117 professionals have used our research since 2012.