OWASP Zap vs SonarCloud comparison

Cancel
You must select at least 2 products to compare!
OWASP Logo
20,743 views|9,835 comparisons
87% willing to recommend
Sonar Logo
10,251 views|7,670 comparisons
100% willing to recommend
Comparison Buyer's Guide
Executive Summary

We performed a comparison between OWASP Zap and SonarCloud based on real PeerSpot user reviews.

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed OWASP Zap vs. SonarCloud Report (Updated: May 2024).
771,740 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
Pros
"It can be used effectively for internal auditing.""The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's very difficult.""​It has improved my organization with faster security tests.​""Automatic updates and pull request analysis.""It's great that we can use it with Portswigger Burp.""The solution is good at reporting the vulnerabilities of the application.""The HUD is a good feature that provides on-site testing and saves a lot of time.""The scalability of this product is very good."

More OWASP Zap Pros →

"Recently, they introduced support for mono reports and microservices, which is a noteworthy development as it provides a more detailed view of each service.""The most valuable feature of SonarCloud is its overall performance.""The solution can be installed locally.""The reports from SonarCloud are very good.""The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false positives and we can customize the rules.""For what it is meant to do, it works pretty well.""Its dashboard provides a unified view of various code quality metrics, including code duplication, unit test coverage, and security hotspots.""SonarCloud is overall a good tool for identifying code smells, bugs, and code duplication, but we've found that using Android Lint is more effective for our needs."

More SonarCloud Pros →

Cons
"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline.""I prefer Burp Suite to SWASP Zap because of the extensive coverage it offers.""Reporting format has no output, is cluttered and very long.""The documentation is lacking and out-of-date, it really needs more love.""Lacks resources where users can internally access a learning module from the tool.""It needs more robust reporting tools.""It would be ideal if I could try some pre-built deployment scenarios so that I don't have to worry about whether the configuration sector team is doing it right or wrong. That would be very helpful.""It doesn't run on absolutely every operating system."

More OWASP Zap Cons →

"SonarCloud's UI needs enhancement.""It would be helpful if notifications could go out to an extra person.""I've been told by the developers that the solution is too limited. It's not testing enough within the containers.""The documentation needs improvement on optimizing build time for seamless CI/CD integration with our Android apps.""There's room for improvement in the configuration process, particularly during the initial setup phase.""The reports could improve by providing more information. We are not able to use the reports in our operation until they are improved. Additionally, if the vendor provided more customization capabilities it would be a benefit.""CI/CD pipeline is part of a whole chain of design, development, and production, and it's becoming increasingly crucial to optimize the various tools across different stages. However, it's still a silo approach because the full integration is missing. This isn't just an issue with SonarCloud. It's a general problem with tooling.""SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird. We then need to manually go and mark the false positive."

More SonarCloud Cons →

Pricing and Cost Advice
  • "It is highly recommended as it is an open source tool."
  • "It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy."
  • "OWASP ZAP is a free tool provided by OWASP’s engineers and experts. There is an option to donate."
  • "As Zap is free and open-source, with tons of features similar to those of commercial solutions, I would definitely recommend trying it out."
  • "It's free. It's good for us because we don't know what the extent of our use will be yet. It's good to start with something free and easy to use."
  • "OWASP Zap is free to use."
  • "This app is completely free and open source. So there is no question about any pricing."
  • "This is an open-source solution and can be used free of charge."
  • More OWASP Zap Pricing and Cost Advice →

  • "The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable."
  • "The price of SonarCloud is not expensive, it goes by the lines of code. 1 million lines per code are approximately 4,000 USD per year. If you need 2 million lines of code you would double the annual cost."
  • "I am using the free version of the solution."
  • "I rate the pricing a five out of ten."
  • "While not extremely cheap, it aligns well with market standards and offers good value."
  • "The current pricing is quite cheap."
  • More SonarCloud Pricing and Cost Advice →

    report
    Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
    771,740 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with… more »
    Top Answer:The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's… more »
    Top Answer:Recently, they introduced support for mono reports and microservices, which is a noteworthy development as it provides a more detailed view of each service.
    Top Answer:I would rate the price an eight out of ten because it's reasonable. While not extremely cheap, it aligns well with market standards and offers good value. It's an all-inclusive package where you pay a… more »
    Top Answer:There's room for improvement in the configuration process, particularly during the initial setup phase. Setting up features like mono reports can be challenging, and the existing documentation could… more »
    Ranking
    Views
    20,743
    Comparisons
    9,835
    Reviews
    12
    Average Words per Review
    392
    Rating
    7.6
    Views
    10,251
    Comparisons
    7,670
    Reviews
    7
    Average Words per Review
    583
    Rating
    8.4
    Comparisons
    SonarQube logo
    Compared 78% of the time.
    Veracode logo
    Compared 7% of the time.
    Checkmarx One logo
    Compared 5% of the time.
    GitLab logo
    Compared 3% of the time.
    Coverity logo
    Compared 2% of the time.
    Learn More
    Interactive Demo
    OWASP
    Demo Not Available
    Overview

    OWASP Zap is a free and open-source web application security scanner. 

    The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues. 

    With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

    SonarCloud is a cloud-based alternative of the SonarQube platform, offering continuous code quality and security analysis as a service. SonarCloud integrates seamlessly with popular version control and CI/CD platforms such as GitHub, Bitbucket, and Azure DevOps. It provides static code analysis to identify and help remediate issues such as bugs and security vulnerabilities. SonarCloud enables developers to receive immediate feedback on their code within their development environment, facilitating the maintenance of high-quality code standards, and promoting a culture of continuous improvement in software development projects. It helps produce software that is secure, reliable, and maintainable. SonarCloud is free for open-source projects and is offered as a paid subscription for private projects, priced per lines of code.

    Sample Customers
    1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS
    Top Industries
    REVIEWERS
    Computer Software Company25%
    Financial Services Firm15%
    Retailer10%
    Energy/Utilities Company10%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Financial Services Firm10%
    Government7%
    Manufacturing Company7%
    VISITORS READING REVIEWS
    Computer Software Company18%
    Financial Services Firm10%
    Manufacturing Company9%
    Healthcare Company5%
    Company Size
    REVIEWERS
    Small Business22%
    Midsize Enterprise30%
    Large Enterprise49%
    VISITORS READING REVIEWS
    Small Business21%
    Midsize Enterprise16%
    Large Enterprise64%
    REVIEWERS
    Small Business56%
    Midsize Enterprise33%
    Large Enterprise11%
    VISITORS READING REVIEWS
    Small Business23%
    Midsize Enterprise19%
    Large Enterprise57%
    Buyer's Guide
    OWASP Zap vs. SonarCloud
    May 2024
    Find out what your peers are saying about OWASP Zap vs. SonarCloud and other solutions. Updated: May 2024.
    771,740 professionals have used our research since 2012.

    OWASP Zap is ranked 7th in Static Application Security Testing (SAST) with 37 reviews while SonarCloud is ranked 10th in Static Application Security Testing (SAST) with 10 reviews. OWASP Zap is rated 7.6, while SonarCloud is rated 8.4. The top reviewer of OWASP Zap writes "Great for automating and testing and has tightened our security ". On the other hand, the top reviewer of SonarCloud writes "Beneficial vulnerability discovery, simple to maintain, and proactive support". OWASP Zap is most compared with SonarQube, Acunetix, Qualys Web Application Scanning, PortSwigger Burp Suite Professional and Rapid7 InsightAppSec, whereas SonarCloud is most compared with SonarQube, Veracode, Checkmarx One, GitLab and Coverity. See our OWASP Zap vs. SonarCloud report.

    See our list of best Static Application Security Testing (SAST) vendors.

    We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.