Snyk and SonarQube Cloud compete in the software security and code quality market. Snyk seems to have the upper hand in ease of integration and developer support, while SonarQube Cloud excels in code quality analysis and comprehensive metrics.
Features: Snyk stands out for its Slack integration, self-service capabilities, and an accurate vulnerability database, tailored for environments focused on swift vulnerability management and container security. SonarQube Cloud provides comprehensive code quality analysis, effective code duplication detection, and maintains detailed code quality metrics.
Room for Improvement: Snyk could enhance its offering with additional security features like SAST or DAST and broader language support, along with better customization of notifications. Some users also experience issues with IDE plug-in performance. SonarQube Cloud could improve false positive management and add auto-commit functionality. Enhancements in documentation could make setup and integration smoother for users.
Ease of Deployment and Customer Service: Snyk provides flexible deployment options across private, public, and hybrid environments, with generally responsive technical support. SonarQube Cloud focuses on public cloud infrastructure for simpler deployment, though it offers limited on-premises solutions. Both solutions are noted for their supportive customer service and fast communication.
Pricing and ROI: Snyk offers a scalable, flexible, premium pricing model, with users noting the cost is justified by features and significant time saved in problem resolution. SonarQube Cloud uses a pricing model based on lines of code, suitable for small to medium applications. Both platforms deliver good value based on organizational needs.
It is easily integrable with the CI/CD pipeline and supports multiple projects with its extensive plugin options.
The product is designed for bigger clients, while smaller companies are often put aside.
We could understand the implementation of the product and other features without the need for human interaction.
Our long-standing association has ensured smooth communication, resulting in favorable support experiences and satisfactory issue resolution.
Their response time aligns with their SLA commitments.
The customer service and support for SonarQube Cloud are responsive and helpful.
Integrating it into different solutions is straightforward.
Snyk allows for scaling across large organizations, accommodating tens of thousands of applications and over 60,000 repositories.
It has been used in multiple projects and performs well.
There are limitations, and it seems to have fewer capabilities than Veracode.
SonarQube Cloud is a scalable product, and I rate its scalability at seven out of ten.
It is a quite stable solution.
From my team's feedback, it is almost an eight out of ten.
It lacks the ability to select branches on its Web UI, forcing users to rely on CLI or CI/CD for that functionality.
Both Veracode and Snyk should implement this new scoring system for CVSS and AIVSS.
The inclusion of AI to remove false positives would be beneficial.
Static code analysis is good, but the product lacks dynamic code scanning capabilities, an area where Veracode excels.
To improve SonarQube Cloud (formerly SonarCloud), it should excel in all these domains.
I would like to see SonarQube Cloud provide more detailed solutions for fixing code issues, especially solutions related to CVEs.
After negotiations, we received a special package with a good price point.
Snyk is recognized as the cheapest option we have evaluated.
Snyk is less expensive.
From my experience, SonarQube Cloud (formerly SonarCloud) is very expensive for small companies.
SonarQube Cloud is roughly equivalent in cost to Veracode, maybe a little cheaper.
We used the open-source version of SonarQube Cloud for its minimum features and did not license its extensive capabilities.
Snyk helps detect vulnerabilities before code moves to production, allowing for integration with DevOps and providing a shift-left advantage by identifying and fixing bugs before deployment.
Our integration of Snyk into GitHub allows us to automatically scan codebases and identify issues, which has improved efficiency.
The best feature of Snyk is the integration with our ticketing system, which is Jira.
I use SonarQube Cloud (formerly SonarCloud) to check the quality of developer code and identify vulnerabilities.
It is integrated easily with the CI/CD pipeline, saving time and cost.
The most valuable features of SonarQube Cloud (formerly SonarCloud) include code inspection, addressing technical debt, and identifying security vulnerabilities.
| Product | Market Share (%) |
|---|---|
| Snyk | 4.6% |
| SonarQube Cloud (formerly SonarCloud) | 4.2% |
| Other | 91.2% |
| Company Size | Count |
|---|---|
| Small Business | 20 |
| Midsize Enterprise | 9 |
| Large Enterprise | 21 |
| Company Size | Count |
|---|---|
| Small Business | 8 |
| Midsize Enterprise | 3 |
| Large Enterprise | 4 |
Snyk's AI Trust Platform empowers developers to innovate securely in AI-driven environments, ensuring rapid and secure software development with enhanced policy governance.
Snyk’s platform integrates AI-ready engines across the software development lifecycle, offering broad coverage with high speed and accuracy essential for fast-paced coding environments. AI-driven features include visibility, prioritization, and tailored security policies that enable proactive threat prevention and quick remediation. By focusing on LLM engineering and AI code analysis, Snyk supports secure and productive development processes. The platform's partnerships, including GenAI code assistants, enhance AI application security by addressing new threats and code velocity challenges.
What are the key features of Snyk?Snyk is implemented across industries focusing on agile development and DevSecOps, enhancing software delivery speed and security. It is widely used for continuous monitoring and adherence to security and licensing standards, especially in environments relying on Docker image security and CI/CD pipeline integration.
SonarQube Cloud offers static code analysis and application security testing, seamlessly integrating into CI/CD pipelines. It's a vital tool for identifying vulnerabilities and ensuring code quality before deployment.
SonarQube Cloud is widely used for its ability to integrate with tools like GitHub, Jenkins, and Bitbucket, providing critical feedback at the pull request level. It's designed to help organizations maintain clean code by acting as a quality gate. This service supports development methodologies including sprints and Kanban for ongoing vulnerability management. While appreciated for its dashboard and integration capabilities, some users find initial setup challenging and note the need for enhanced documentation. The recent addition of mono reports and microservices support offers deeper insights into security and code quality, though container testing limitations and false positives are noted drawbacks. Manual intervention is sometimes required to address detailed reporting, with external tools being necessary for comprehensive analysis. Notifications for larger teams during serious issues and streamlined integration of new features are also areas of improvement.
What are the key features of SonarQube Cloud?In specific industries, SonarQube Cloud finds application in finance and healthcare where code integrity and security are paramount. It allows teams to identify critical vulnerabilities early and ensures that software development aligns with industry regulations and standards. By continuously analyzing code, it aids organizations in deploying secure and reliable applications, fostering trust and compliance.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
