We performed a comparison between Snyk and Sonatype Repository Firewall based on real PeerSpot user reviews.
Find out in this report how the two Software Composition Analysis (SCA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."I am the organizational deployment administrator for this tool, and I, along with other users in our company, especially the security team, appreciate the solution for several reasons. The UI is excellent, and scanning for security threats fits well into our workflow."
"The vulnerability analysis is the best aspect of the solution."
"WhiteSource is unique in the scanning of open-source licenses. Additionally, the vulnerabilities aspect of the solution is a benefit. We don't use WhiteSource in the whole organization, but we use it for some projects. There we receive a sense of the vulnerabilities of the open-source components, which improves our security work. The reports are automated which is useful."
"WhiteSource helped reduce our mean time to resolution since the adoption of the product."
"We use a lot of open sources with a variety of containers, and the different open sources come with different licenses. Some come with dual licenses, some are risky and some are not. All our three use cases are equally important to us and we found WhiteSource handles them decently."
"The dashboard view and the management view are most valuable."
"There are multiple different integrations there. We use Mend for CI/CD that goes through Azure as well. It works seamlessly. We never have any issues with it."
"We set the solution up and enabled it and we had everything running pretty quickly."
"Provides clear information and is easy to follow with good feedback regarding code practices."
"I find SCA to be valuable. It can read your libraries, your license and bring the best way to resolve your problem in the best scenario."
"I think all the standard features are quite useful when it comes to software component scanning, but I also like the new features they're coming out with, such as container scanning, secrets scanning, and static analysis with SAST."
"The most valuable feature of Snyk is the software composition analysis."
"The code scans on the source code itself were valuable."
"Snyk is a good and scalable tool."
"I am impressed with the product's security vulnerability detection. My peers in security are praising the tool for its accuracy to detect security vulnerabilities. The product is very easy to onboard. It doesn't require a lot of preparation or prerequisites. It's a bit of a plug-and-play as long as you're using a package manager or for example, you are using a GitHub repository. And that is an advantage for this tool because developers don't want to add more tools to what they're currently using."
"Snyk performs software composition analysis (SCA) similar to other expensive tools."
"The product's network and intrusion protection features are valuable. It also has rules and compliance features for security."
"We have been looking at how we could improve the automation to human involvement ratio from 60:40 to 70:30, or even potentially 80:20, as there is room for improvement here. We are discussing this internally and with Mend; they are very accommodating to us. We think they openly receive our feedback and do their best to implement our thoughts into the roadmap."
"The turnaround time for upgrading databases for this tool as well as the accuracy could be improved."
"Mend supports most of the common package managers, but it doesn't support some that we use. I would appreciate it if they can quickly make these changes to add new package managers when necessary."
"On the reporting side, they could make some improvements. They are making the reports better and better, but sometimes it takes a lot of time to generate a report for our entire organization."
"They're working on a UI refresh. That's probably been one of the pain points for us as it feels like a really old application."
"I would like to have an additional compliance pack. Currently, it does not have anything for the CIS framework or the NIST framework. If we directly run a scan, and it is under the CIS framework, we can directly tell the auditor that this product is now CIS compliant."
"I rated the solution an eight out of ten because WhiteSource hasn't built in a couple of features that we would have loved to use and they say they're on their roadmap. I'm hoping that they'll be able to build and deliver in 2022."
"WhiteSource only produces a report, which is nice to look at. However, you have to check that report every week, to see if something was found that you don't want. It would be great if the build that's generating a report would fail if it finds a very important vulnerability, for instance."
"One area where Snyk could improve is in providing developers with the line where the error occurs."
"Snyk's API and UI features could work better in terms of speed."
"The feature for automatic fixing of security breaches could be improved."
"It can be improved from the reporting perspective and scanning perspective. They can also improve it on the UI front."
"They need to improve the Snyk plugins and make it easier to make your optimizations based on your own needs or features."
"All such tools should definitely improve the signatures in their database. Snyk is pretty new to the industry. They have a pretty good knowledge base, but Veracode is on top because Veracode has been in this business for a pretty long time. They do have a pretty large database of all the findings, and the way that the correlation engine works is superb. Snyk is also pretty good, but it is not as good as Veracode in terms of maintaining a large space of all the historical data of vulnerabilities."
"We use Bamboo for CI.CD, and we had problems integrating Snyk with it. Ultimately, we got the two solutions to work together, but it was difficult."
"The solution's reporting and storage could be improved."
"The tool needs to improve its file systems. The product should also include zero test feature."
Snyk is ranked 1st in Software Composition Analysis (SCA) with 17 reviews while Sonatype Repository Firewall is ranked 11th in Software Composition Analysis (SCA) with 2 reviews. Snyk is rated 7.8, while Sonatype Repository Firewall is rated 8.6. The top reviewer of Snyk writes "A cost-effective solution that makes scanning your repositories a cinch". On the other hand, the top reviewer of Sonatype Repository Firewall writes "You will get clean code every time, and that's a great achievement". Snyk is most compared with SonarQube, Black Duck, Fortify Static Code Analyzer, Veracode and Aqua Cloud Security Platform, whereas Sonatype Repository Firewall is most compared with JFrog Security Essentials, Cisco Secure Firewall, Black Duck, GitHub and Veracode. See our Snyk vs. Sonatype Repository Firewall report.
See our list of best Software Composition Analysis (SCA) vendors and best Application Security Tools vendors.
We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
