SonarQube Server (formerly SonarQube) vs Veracode comparison

SonarQube Server (formerly ...

Read 201 Veracode reviews

21,023 Views
14,085 Comparison Views

90% willing to recommend

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jun 15, 2025

Veracode and SonarQube Server are both leaders in code quality and security analysis. Veracode seems to have the upper hand with its API and IDE integrations, while SonarQube benefits from its open-source model and community support.

Features: Veracode offers static, dynamic, and software composition analysis, along with sandbox scanning capabilities that allow vulnerability review without affecting metrics. It supports various programming languages and easily integrates into DevOps pipelines. SonarQube Server is known for supporting multiple programming languages with integrated analysis, and an active community that provides plugins to enhance its versatility.

Room for Improvement: Veracode users need better handling of false positives, more robust reporting, and support for additional languages. Its tool integrations and user interface could also be enhanced. SonarQube Server could improve its vulnerability detection capabilities, integration with CI/CD pipelines, and reporting features for handling large projects.

Ease of Deployment and Customer Service: Veracode allows deployment across Private, Public, and Hybrid Cloud environments, providing flexibility but requiring specialized support. It offers good customer service but with variable responsiveness and technical depth. SonarQube Server supports On-premises, Private Cloud, and Hybrid Cloud deployments and is favored for its ease of use in DevOps pipelines. Customer service is well-regarded but faces delays with complex issues.

Pricing and ROI: Veracode is high-cost due to its comprehensive features, with a complex pricing model based on application size. It provides strong ROI by reducing vulnerability correction costs. SonarQube Server's open-source nature offers more flexible and often lower-cost pricing, appealing to organizations needing scalable code quality solutions. It yields favorable ROI by enhancing code quality at a lower direct cost, especially with its free community edition.

To learn more, read our detailed SonarQube Server (formerly SonarQube) vs. Veracode Report (Updated: July 2025).

SonarQube Server (formerly SonarQube) vs. Veracode

July 2025

Download the complete report

Helped 861,490 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

7.2

SonarQube Server boosts productivity, stability, and security through effective code analysis and vulnerability assessment, enhancing development processes.

Sentiment score

6.8

Veracode saves time, reduces manual processes, decreases penetration tests, enhances compliance, and improves code quality to prevent costly breaches.

I have seen a return on the investment from SonarQube Server (formerly SonarQube) because the value it adds relates to static code analysis and vulnerability assessments needed for our FDA approval process.

Sr Software Engineering Supervisor at Mozarc Medical

We see productivity increasing based on the fact that the code review is mostly automated, allowing the developer to fix the code themselves before assigning it to someone else to review, thus receiving that ROI.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.

For more quotes and insights, download the Veracode report

Senior Solutions Architect at IDS Comercial

Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Customer Service

Sentiment score

6.2

SonarQube Server's support is valued for community resources and documentation, though free version technical support is limited.

Sentiment score

7.3

Veracode's support is praised for expertise and responsiveness, but experiences vary, especially with complex issues and staffing.

The community support is quite effective.

Damyan Bogoev

Distinguish Engineer at Gtmhub

I would rate the technical support for SonarQube Server (formerly SonarQube) as a 10 because we have not faced any specific issues that required us to contact tech support, which is a very rare case.

Sr Software Engineering Supervisor at Mozarc Medical

They showed us where we can actually get those granular level reporting extracted for Excel, which was a quick guide.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

Access to the engineering team is crucial for faster feedback on the product fix process.

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

They are very responsive and quick to help with queries within our scope.

Kv Rao

Site Leader (India) at Industrial Scientific

They respond very quickly since security is something critical.

For more quotes and insights, download the Veracode report

Senior Solutions Architect at IDS Comercial

Scalability Issues

Sentiment score

7.1

SonarQube Server efficiently scales for various user volumes and project sizes, though infrastructure demands may rise in physical setups.

Sentiment score

7.5

Veracode offers robust scalability, efficiently managing diverse usage scenarios and volumes, maintaining smooth performance for various organizational sizes.

I would rate the scalability of SonarQube Server as a 10 because we can configure the server to scan multiple projects based on the number of lines.

Sr Software Engineering Supervisor at Mozarc Medical

I find SonarQube Server (formerly SonarQube) very scalable because we're able to create a new repository and integrate all the tools on that project and it just works.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

Cloud solutions are easier to scale than on-premise solutions.

Senior Solutions Architect at IDS Comercial

It has a good capacity to scale effectively.

For more quotes and insights, download the Veracode report

Lead Automation Quality Engineer in Leading UK Bank at Tata Consultancy

Stability Issues

Sentiment score

7.7

SonarQube Server is highly reliable, stable with minor issues often related to plugins or environments, and rarely crashes.

Sentiment score

7.9

Users find Veracode stable and reliable, with minimal downtime and effective workload handling despite minor issues.

I think SonarQube Server (formerly SonarQube) is stable, and we did not face any problems unless there was a power outage or if the LAN cable was plugged out.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Sr Software Engineering Supervisor at Mozarc Medical

If the Veracode server is down, we experience many issues during the scan.

For more quotes and insights, download the Veracode report

Lead Automation Quality Engineer in Leading UK Bank at Tata Consultancy

It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Room For Improvement

SonarQube Server needs better issue detection, usability, language support, integration, customizable features, and AI-driven dynamic testing enhancements.

Users seek improved false positives, dynamic scanning, UI/UX, language support, integration, reporting, and pricing in Veracode.

If I fix some vulnerabilities today, they reappear in the next scan, and there will be completely different issues that need to be fixed.

Sr Software Engineering Supervisor at Mozarc Medical

As soon as I see that they've got a new feature that integrates AI that is not as generative as other GenAI platforms that actually generate the code and help developers develop faster, I believe that capability is lacking.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.

Himadri Subudhi

Works

We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.

For more quotes and insights, download the Veracode report

Lead Automation Quality Engineer in Leading UK Bank at Tata Consultancy

A nice addition would be if it could be extended for scenarios with custom cleansers.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

Setup Cost

SonarQube Server provides cost-effective solutions for code quality, with competitive pricing and enhanced features for various project sizes.

Veracode's pricing is high but valued for comprehensive features, with flexible options and discounts available for enterprises.

I would rate the pricing for SonarQube Server (formerly SonarQube) as an 8, where 1 is very cheap and 10 is very expensive, because Coverity is very expensive, and while SonarQube is not cheap, it is still less expensive than Coverity.

Sr Software Engineering Supervisor at Mozarc Medical

They always offer around a two-year contract, but we always take a one-year contract because it's expensive.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

The freemium version of SonarQube Server offers excellent value, especially compared to the high costs of Snyk.

Damyan Bogoev

Distinguish Engineer at Gtmhub

It's not the most expensive solution.

Senior Solutions Architect at IDS Comercial

If there's a security gap, you'll never know the cost or effect.

Himadri Subudhi

Works

Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode.

For more quotes and insights, download the Veracode report

Lead Automation Quality Engineer in Leading UK Bank at Tata Consultancy

Valuable Features

SonarQube Server enhances code quality with language support, CI/CD integration, insightful dashboards, and an intuitive interface.

Veracode offers scalable security with static/dynamic analysis, seamless integrations, low false positives, and compliance-focused reporting, enhancing developer workflows.

Some of the static code analysis capabilities are the most beneficial.

Damyan Bogoev

Distinguish Engineer at Gtmhub

The most valuable features of SonarQube Server (formerly SonarQube) for us include having control of the rules, enabling and disabling them.

Sr Software Engineering Supervisor at Mozarc Medical

We use SonarQube Server's centralized management and visualization of code quality metrics on the dashboard because that's the executive dashboard that we send to the executives to show where we are in terms of quality, security, and where the company can improve.

For more quotes and insights, download the SonarQube Server (formerly SonarQube) report

Head of Software Engineering at ronaldmariah@gmail.com

It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.

Kv Rao

Site Leader (India) at Industrial Scientific

The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.

Himadri Subudhi

Works

It fixes issues directly in the IDE while you're doing it.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

For more quotes and insights, download the Veracode report

Categories and Ranking

SonarQube Server (formerly ...

Ranking in Application Security Tools

1st

Ranking in Static Application Security Testing (SAST)

1st

Average Rating

8.0

Reviews Sentiment

7.2

Number of Reviews

116

Ranking in other categories

Software Development Analytics (1st)

Veracode

Ranking in Application Security Tools

2nd

Ranking in Static Application Security Testing (SAST)

2nd

Average Rating

8.2

Reviews Sentiment

7.0

Number of Reviews

201

Ranking in other categories

Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (2nd)

Mindshare comparison

As of July 2025, in the Application Security Tools category, the mindshare of SonarQube Server (formerly SonarQube) is 22.7%, down from 26.7% compared to the previous year. The mindshare of Veracode is 9.0%, down from 10.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Q&A Highlights

Netanya Carmi

Content Manager at PeerSpot

Nov 15, 2021

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use and understand, SonarQube is a great solution if you want to quickly focus on functional requirements. There were some security issues with our code that SonarQube did not find. Defining the quality of rules should be improved to ensure that low-performance code does not move forward to production. We would like to see better security scanning and statistical analysis from SonarQube. Using Veracode, on the other hand, we have never had a problem with vulnerable code going into production. We like the visibility of application status across all testing types which Veracode presents in a single dashboard. Even if you are running different types of scans, you have everything in one place, which is very convenient. Veracode helps us keep a high-security standard, which is very important to us. It would really improve Veracode if the mitigation process was somehow added to the dashboard or made more streamlined. Currently, one has to go back and forth between one or more screens and it makes it a bit complicated. Regarding the pipeline scan, we found Veracode can be very fast with Java-based applications but slow with other applications. It would be helpful if the scan completion and scan progress would improve - the time estimates are not always accurate. Conclusion These are two great solutions, each with a slightly different focus. SonarQube has a solid focus on code quality. It offers a very good free version. The SonarQube free version covers 10-15 languages, which can be very limiting for some and there are also some limitations with support. The integration is there, but you do not get full integration with the free version. Overall, the SonarQube free version is a very good option for small businesses. SonarQube does offer an Enterprise license that is very competitively priced. Veracode's main focus is security. It is more closely related to an application security scanning solution. There is no free version and it is considered an expensive solution when comparing price with other similar solutions. However, Veracode offers many features and applications that other solutions do not. One favorite is scanning for compliance; we have some situations where we need to consistently scan code for security to satisfy different compliance regulations. Veracode helps us do that.

Featured Reviews

Consistent improvements in code quality and security with effective integration and reliable technical support

Head of Software Engineering at ronaldmariah@gmail.com

The features of SonarQube Server (formerly SonarQube) that I find most useful are the suggestions received from reviewing the code. When they review the code, they provide suggestions on how to fix it, and we find those very useful from a development perspective. We use SonarQube Server's (formerly SonarQube) centralized management and visualization of code quality metrics on the dashboard because that's the executive dashboard that we send to the executives to show where we are in terms of quality, security, and where the company can improve. We use that for organizational improvement purposes. The ability to tailor metrics tracking in SonarQube Server (formerly SonarQube) has been beneficial to my team. There are team-specific dashboards which are related to specific repositories they utilize, and we have that aggregative dashboard that shows the whole organization's performance. We can drill down per specific repository, which makes it easier for the team to improve specific things.

Read full review

Sajal Sharma

Test Analyst - Security at Net solutions India Pvt.

Offers shift-left security strategy and helps us with the latest security configurations, OWASP standards, and SAST standards

It's robustness is the main benefit to the organization. As it gets upgraded with time, it also improves the coverage – security configuration coverages and vulnerability coverages. It also updates itself with the latest known vulnerabilities that are uploaded to the NVD, OWASP, or other databases. So it gets upgraded itself with that. And so with each upgrade, it gets better and better. The solution offers the ability to prevent vulnerable code from going into production. It provides us with a report containing multiple remediations and mitigations for each vulnerability. For example, if it finds a cross-site scripting vulnerability, it will also include references like CWE and CVE records, instructions on how to fix it, and the specific line of code or module where the vulnerability is present. This helps us fix the issues accordingly. I'm a penetration tester and DevSecOps engineer. I evaluate the findings, mark false positives, and manually exploit vulnerabilities if they exist. If we need further clarification, we raise a ticket with the Veracode team and get consultancy from them. We are a software development team. If we find a vulnerability, I exploit it and come back with the best possible mitigation, and the dev team fixes it. If we use Veracode Fix, it might use third-party implementations or make changes we aren't aware of. We need to be very aware of what our application is using internally. It should be known to us. As per my experience, the solution's policy reporting ensures compliance with industry standards. It comes with multiple features. I get the most out of it, and it's good. The solution provides visibility into application status at every phase of development. Like static analysis, dynamic analysis, software composition, and manual penetration tests - throughout the SDLC We have a pipeline that I maintain. I use the Veracode API account and have integrated it with AWS and our Jenkins pipeline. We use Snyk for SCA and Veracode for SAST scanning. At the earliest stage of the build, the SAST scan runs along with the JS and PHP files. It provides us with reports, which are then handed over to the other tools we depend on. If I validate the report or check the Veracode dashboard and find vulnerabilities, I mark them as false positives or existing issues. We work on multiple projects, but the one I'm handling these days only uses Veracode for SAST. It's been about one and a half years since I've been working with Veracode and this project. It is quite impressive. There are some things Veracode cannot find, like code obfuscations inside the code and some insecure randoms. Sometimes, it misses those flaws. But overall, if I compare it with other tools, it is better. I will definitely recommend others to use this tool. We run the scan before each deployment. If the dev team builds a new module or something, we scan it along with all the files. If we find anything, we get it fixed. That's how it works. Veracode is quite important to the organization's shift-left security strategy because we make a scan for each deployment. Sometimes, if I think we need to perform a shift-left, I just make a scan before deployment and check for any misconfiguration or vulnerability in the code.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

861,490 professionals have used our research since 2012.

Answers from the Community

Netanya Carmi

Content Manager at PeerSpot

Nov 15, 2021

Which gives you more for your money - SonarQube or Veracode?

2 out of 6 answers

reviewer1553658

Senior Product Specialist at a tech services company with 51-200 employees

Sep 6, 2021

Klocwork

Read full answer

Mauro Verderosa

Cybersecurity Expert at PSYND

Sep 6, 2021

They are mainly two different products. If your goal is to set the quality on code then SonarQube is your answer. On the other side, if your main goal is to set high-quality standards in terms of cybersecurity (i.e. both security and compliance with regulations), then Veracode is a better match.

Read full answer

See all 6 answers

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Computer Software Company

15%

Manufacturing Company

13%

Government

Computer Software Company

16%

Financial Services Firm

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

Which gives you more for your money - SonarQube or Veracode?

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.

What needs improvement with Veracode?

Veracode Greenlight scans the code while the developer writes it. It will be beneficial for developers if Veracode Greenlight includes Python.

Checkmarx One vs SonarQube Server (formerly SonarQube)

Comparisons

Compared 14% of the time

Coverity vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

GitHub Advanced Security vs SonarQube Server (formerly SonarQube)

Compared 11% of the time

SonarQube Cloud (formerly SonarCloud) vs SonarQube Server (formerly SonarQube)

Compared 6% of the time

Semgrep vs SonarQube Server (formerly SonarQube)

Compared 5% of the time

More SonarQube Server (formerly SonarQube) Competitors

Checkmarx One vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 7% of the time

OpenText Core Application Security vs Veracode

Compared 4% of the time

Snyk vs Veracode

Compared 4% of the time

OpenText Static Application Security Testing vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

SonarQube Server (formerly SonarQube)

June 2025

SonarQube Server (formerly SonarQube) report

Download SonarQube Server (formerly SonarQube) product report

Download Veracode product report

June 2025

Also Known As

Sonar

Crashtest Security , Veracode Detect

Interactive Demo

Sonar

Demo not available

Overview

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

Sonar

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.