No more typing reviews! Try our Samantha, our new voice AI agent.

Onapsis vs SonarQube comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Onapsis
Ranking in Application Security Tools
34th
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
SonarQube
Ranking in Application Security Tools
1st
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
136
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

As of April 2026, in the Application Security Tools category, the mindshare of Onapsis is 0.8%, up from 0.2% compared to the previous year. The mindshare of SonarQube is 14.5%, down from 25.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
SonarQube14.5%
Onapsis0.8%
Other84.7%
Application Security Tools
 

Featured Reviews

it_user19113 - PeerSpot reviewer
SAP Security Consulting Engineer at a computer software company with 10,001+ employees
It checks for and reports vulnerabilities on all SAP systems at the OS, DB and SAP levels.
I really love how Onapsis X1 is able to check SAP for threats; the reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience. Currently, it takes some background jobs and additional work to get them published. It was difficult to get interactive reports to the different levels of the business. I would have to download them and send them out, or save them on my SharePoint site and send out a weekly link. In the version of the product I was usingת I had to log into the X1 system directly to get to the reports. Reporting would be used by several different areas of the organizationת many of whom would be at the director and executive levels. It would not make sense to have them log directly into the tool to look at these reports. Add to this that there was only one ID that could be used to log in and view the reports. To solve this problemת I had to run all of the different reports; executive summary down to detailed analysis and then export them out to my security team SharePoint site. To automate this processת a batch script was created to run after the X1 analyzed the systems. The script would pull the reports and place them in the SharePoint site automatically, but it was a bit of a hassle to get set up.
KH
Sr Software Engineering Supervisor at Mozarc Medical
Gains control over rule customization and achieves reliable vulnerability assessment
The deployment process took me about 2 or 3 hours to deploy SonarQube Server (formerly SonarQube), although I do not remember exactly since it was done about 2 years back. Currently, about 10 of my developers are using SonarQube Server (formerly SonarQube) in my company. I do not have plans to increase the usage of SonarQube Server (formerly SonarQube) in the future as there will not be any requirement to increase. I am a senior software engineer and supervisor at Mozark Medical. My corporate email address is karthik.k.a.r.t.h.i.k.h.a.r.p.a.n.h.a.l.l.i@mozarkmedical.com. Overall, I would rate SonarQube Server (formerly SonarQube) as a 9 out of 10.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It has hardened our SAP system by providing details of vulnerabilities in our SAP landscape."
"This product has helped us improve the quality of code within the business and ensure all new developers keep to a similar code convention per project."
"I would recommend SonarQube; it is a good deal compared to all other tools on the market and certainly helped us, it is a good tool and should be definitely used."
"It provides a holistic picture of all quality issues in a software project."
"The stability is good."
"I do recommend SonarQube because it is an easy tool that you can deploy and configure, and after that you can measure the history of your obligation and integrate it with other tools like GitLab or GitHub or Azure DevOps to do quality code analysis."
"The static code analysis is very good, and in the banking sector, we have found several vulnerabilities and many issues in the source code."
"SonarQube lets us find security issues during development and testing so that we can release more secure and higher quality applications."
"The product itself has a friendly UI, it's easy to use and we understand how to manage the admin control panel, it's really quick, and it's really easy to perform admin jobs using the control panel."
 

Cons

"Reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience."
"Technical support could be better. If we request support, it's a little bit delayed, and it's not consistent on email."
"We found a solution with dynamic testing, and are looking to find a solution that can be used for both types of testing."
"Expression of common vulnerabilities and exposures is not always current."
"Their dashboarding is very limited. They can improve their dashboards for multiple areas, such as security review, maintainability, etc. They have all this information, so they should publish all this information on the dashboard so that the users can view the summary and then analyze it further. This is something that I would like to see in the next version."
"It utilizes a lot of resources from the servers. I think this issue should be resolved because it takes approx 20% of the CPU utilization."
"We previously experienced issues with security but a segregated security violation has been implemented and the issues we experienced are being fixed."
"An improvement is with false positives. Sometimes the tool can say there is an issue in your code but, really, you have to do things in a certain way due to external dependencies, and I think it's very hard to indicate this is the case."
"From a reporting perspective, we sometimes have problems interpreting the vulnerability scan reports. For example, if it finds a possible threat, our analysts have to manually check the provided reports, and sometimes we have issues getting all the data needed to properly verify if it's accurate or not."
 

Pricing and Cost Advice

Information not available
"I am using the free version of the solution."
"The beauty of this solution is the free open-source version is capable enough in doing pretty much what an enterprise-level version can do."
"We are using the free, unlicensed version."
"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."
"We are using the Community edition of SonarQube."
"I use the full trial version of SonarQube."
"The price of SonarCloud is not expensive, it goes by the lines of code. 1 million lines per code are approximately 4,000 USD per year. If you need 2 million lines of code you would double the annual cost."
"The free version of SonarQube does everything that we need it to."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
892,287 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Energy/Utilities Company
16%
University
13%
Construction Company
11%
Outsourcing Company
7%
Financial Services Firm
13%
Manufacturing Company
13%
Computer Software Company
12%
Comms Service Provider
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business43
Midsize Enterprise24
Large Enterprise79
 

Questions from the Community

Ask a question
Earn 20 points
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Also Known As

No data available
Sonar, SonarQube Cloud
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Sony, US Army, Westinghouse, AXA. Galicia, Daimler, Roche, Levi's, Siemens, ABB, KPMG, Mercardo Libre, Verizon, Bacardi, Adgas, Sicpa, Whirlpool, Leaseplan
Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.
Find out what your peers are saying about SonarSource Sàrl, Veracode, Checkmarx and others in Application Security Tools. Updated: April 2026.
892,287 professionals have used our research since 2012.