CodeSonar vs Qualys Web Application Scanning comparison

AdaCore and Qualys are both solutions in the Application Security Tools category. AdaCore is ranked #35, while Qualys is ranked #19 with an average rating of 7.4. AdaCore holds a 1.0% mindshare in AS, compared to Qualys’s 1.7% mindshare. Additionally, 87% of AdaCore users are willing to recommend the solution, compared to 88% of Qualys users who would recommend it.

CodeSonar

Read 7 CodeSonar reviews

3,629 Views
2,468 Comparison Views

87% willing to recommend

Qualys Web Application Scan...

Read 40 Qualys Web Application Scanning reviews

6,493 Views
4,091 Comparison Views

88% willing to recommend

CodeSonar

Qualys Web Application Scan...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Qualys Web Application Scanning and CodeSonar offer strong competition in the cybersecurity sector with each catering to different aspects of security needs. Qualys has the upper hand in user support and accessibility, while CodeSonar takes the lead in detailed code analysis, offering value for in-depth security pursuits.

Features: Qualys Web Application Scanning provides comprehensive vulnerability detection, seamless integration capabilities, and a user-friendly interface. CodeSonar focuses on static code analysis, depth in identifying potential security risks, and detailed examination of code.

Room for Improvement: Qualys Web Application Scanning could work on enhancing real-time report customization, speeding up scanning processes, and expanding integration options. CodeSonar might benefit from a simpler learning curve, more intuitive navigation, and enhanced UI design.

Ease of Deployment and Customer Service: Qualys Web Application Scanning is known for straightforward deployment and reliable customer support, making it suitable for non-technical users. CodeSonar requires more technical understanding during deployment but offers a supportive service team for specialists familiar with in-depth analysis needs.

Pricing and ROI: Qualys generally offers a reasonable setup cost, providing good ROI with its comprehensive web security coverage suitable for organizations seeking broader security solutions. CodeSonar's higher initial investment is justified by the depth of its analysis, making it a beneficial long-term investment for companies focusing on detailed code security. Qualys is preferred for its quicker ROI, whereas CodeSonar's pricing aligns with more profound security analysis investments.

To learn more, read our detailed CodeSonar vs. Qualys Web Application Scanning Report (Updated: August 2026).

Buyer's Guide

CodeSonar vs. Qualys Web Application Scanning

August 2026

Download the complete report

Helped 908,800 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CodeSonar

Ranking in Application Security Tools

35th

Average Rating

8.2

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Static Code Analysis (10th)

Qualys Web Application Scan...

Ranking in Application Security Tools

19th

Average Rating

7.6

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (14th)

Mindshare comparison

As of August 2026, in the Application Security Tools category, the mindshare of CodeSonar is 1.0%, down from 1.5% compared to the previous year. The mindshare of Qualys Web Application Scanning is 1.7%, down from 2.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Qualys Web Application Scanning	1.7%
CodeSonar	1.0%
Other	97.3%

Application Security Tools

Featured Reviews

Mathieu ALBRESPY

Intigration Developer at ez-Wheel

Nice interface, quick to deploy, and easy to expand

This is the first time I've used this kind of software. It was the only one we could apply to analyze with MISRA rules. At my new company, I tried to use Klocwork. I tried to use it, just once so I cannot compare it exactly with CodeSonar. I also have a plugin for my Visual Studio and I try to make it work. It's not easy, however, I don't think that we have this kind of functionality with CodeSonar. It can do some incremental analysis. However, since this feature is also available on CodeSonar, it would be a good idea to have a plugin on Visual Studio just to have a quick analysis.

Read full review

AnkitSharma13

Security Officer at a tech vendor with 10,001+ employees

Web scanning needs improvement but offers good vulnerability detection

The downside of Qualys Web Application Scanning is that it cannot crawl automatically. If I provide an IP address and a login form, it does basic testing, but it doesn't go deep as IBM AppScan does. If Qualys Web Application Scanning could improve its crawling capability, it would be more user-friendly. Qualys Web Application Scanning does IP-level testing, requiring direct input of credentials, and can only scan a few pages to provide known generic vulnerabilities, which isn't as beneficial from my point of view. The Vulnerability Management also relies heavily on version numbers and will flag vulnerabilities based on the component version, but it doesn't check if a real fix exists, leading to flags on components that actually have workarounds available.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"What I like best about CodeSonar is that it has fantastic speed, analysis and configuration times. Its detection of all runtime errors is also very good, though there were times it missed a few. The configuration of logs by CodeSonar is also very fantastic which I've not seen anywhere else. I also like the GUI interface of CodeSonar because it's very user friendly and the tool also shows very precise logs and results."

"The solution is very stable and we have used it for a long time with no issues."

"CodeSonar has helped our organization because it detects dead and nonusable parts of code to create a more optimized code."

"There is nice functionality for code surfing and browsing."

"It has been able to scale."

"The most valuable features of CodeSonar were all the categorized classes provided, and reports of future bugs which might occur in the production code. Additionally, I found the buffer overflow and underflow useful."

"The tool is very good for detecting memory leaks."

"It has helped us a lot with some issues and has helped us avoid bad code."

More CodeSonar pros

"You can integrate your Burp Suite results and create an integrated report. Also, the way it shows the results - threats and exploit details - makes remediation very easy."

"It is a cloud-based solution, so it is easy to scale."

"Its most valuable features are patch management, vulnerability management, and PCI compliance."

"It scans web applications to identify vulnerabilities during deployment."

"Qualys WAS' most valuable features are the navigation flow of the UI and the option for a different layer of security (identification and operation through email and mobile)."

"The Qualys Web Application Scanning solution offers a single comprehensive console and consolidated reporting, covering all aspects from on-prem to cloud and compliance, etcetera."

"The most valuable features are scanning analysis and reporting."

"With our vulnerabilities under control, it's putting our services in compliance and minimizing our risk for exposure."

More Qualys Web Application Scanning pros

Cons

"CodeSonar could improve by having better coding rules so we did not have to use another solution, such as MISRA C."

"It was difficult for us to apply a rule, especially to a part of the code, and not apply it to the rest of the code."

"In a future release, the solution should upgrade itself to the current trends and differentiate between the languages. If there are any classifications that can be set for these programming languages that would be helpful rather than having everything in the generic category."

"There could be a shared licensing model for the users."

"It was expensive."

"The MISRA guidelines were not appropriately reported and there were some flags or errors."

"The scanning tool for core architecture could be improved."

"It would be beneficial for the solution to include code standards and additional functionality for security."

More CodeSonar cons

"The software’s pricing could be improved."

"The reporting contains too many false positives."

"The scanner reports a lot of false positives, which is something that needs to be improved."

"We receive false positives sometimes when using a solution that could be improved. However, the technical team provides us with the exact explanation why it was giving us that kind of error."

"The area of false positives could be improved. There are quite a number of false positives as compared to other solutions. They could probably fine tune the algorithm to be able to reduce the number of false positives being detected."

"The pricing of Qualys is quite expensive in comparison with the other products in this category that are offering pretty much the same thing."

"There could be better management and faster scanning."

"The virus code updates are not frequent enough."

More Qualys Web Application Scanning cons

Pricing and Cost Advice

"Pricing is a bit costly."

"The application’s pricing is high compared to other tools."

"Our organization purchased a license to use the solution."

"The solution's price depends on the number of licenses needed and the source code for the project."

"The product has a very good licensing model."

"We are on an annual license for the solution and the pricing could be more affordable."

"It is an expensive platform."

"There are different options available with respect to licensing."

"We normally purchase an annual license."

"I rate the software’s pricing a six out of ten."

"The product pricing is fair and reasonably priced."

"Licensing was based on the number of assets that you want to scan on your network. You can also do licensing on subscription. On subscription, it is easier and more flexible. You tell Qualys that you want to move from the 1000 to 2000 band or the 3000 or 5000 band, then they will give you the quotation for it. Once you pay for it, applying the licensing is quite easy and effective."

More Qualys Web Application Scanning pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

908,800 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

22%

Computer Software Company

University

Financial Services Firm

13%

Manufacturing Company

11%

Computer Software Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	1
Large Enterprise	2

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	6
Large Enterprise	27

Questions from the Community

Ask a question

Earn 20 points

What is your experience regarding pricing and costs for Qualys Web Application Scanning?

Regarding pricing, I think for personal use, it is costly, but if organizations are ready to pay, then it is fine as they are using it.

See all answers

What needs improvement with Qualys Web Application Scanning?

See all answers

What is your primary use case for Qualys Web Application Scanning?

I use Qualys Web Application Scanning, and we are using Vulnerability Management. By Vulnerability Management, I mean not TotalCloud; they have some on-premises solutions also. Patch Management and...

See all answers

Comparisons

SonarQube vs CodeSonar

Compared 13% of the time

Coverity Static vs CodeSonar

Compared 9% of the time

Polyspace Code Prover vs CodeSonar

Compared 8% of the time

Veracode vs CodeSonar

Compared 7% of the time

More CodeSonar Competitors

Checkmarx SAST vs Qualys Web Application Scanning

Compared 8% of the time

SonarQube vs Qualys Web Application Scanning

Compared 8% of the time

GitHub vs Qualys Web Application Scanning

Compared 6% of the time

OWASP Zap vs Qualys Web Application Scanning

Compared 6% of the time

Veracode vs Qualys Web Application Scanning

Compared 5% of the time

More Qualys Web Application Scanning Competitors

Product Reports

Buyer's Guide

Application Security Tools

July 2026

Download CodeSonar product report

Buyer's Guide

Qualys Web Application Scanning

July 2026

Download Qualys Web Application Scanning product report

Also Known As

No data available

Qualys WAS

Overview

CodeSonar offers a potent tool for static code analysis, adept in detecting runtime errors and security vulnerabilities, with a fast deployment process and scalable capabilities. Its quick analysis and efficient web interface provide a strong basis for code quality validation.

CodeSonar specializes in identifying runtime errors, dead code, and security threats while providing features like code surfing and browsing. It offers a highly efficient web interface, though users find initial setup complex and highlight the need for better static analysis, broader language support beyond C and C++, and an improved licensing model. Despite these challenges, its integration with Jenkins and technical guidance support makes it a reliable choice for teams in defense and software quality assessment. Deployment is quick and easy, yet initial costs are a common concern among users.

What are the key features of CodeSonar?

Quick Analysis: Delivers fast runtime error detection and reporting.
GUI Interface: Offers a user-friendly experience for code browsing.
Scalability: Efficiently deploys across various environments.
Security and Code Detection: Identifies vulnerabilities and potential bugs.
Effective Configuration: Simplified log and analysis configuration.

What benefits can be seen in user reviews?

Detection of Code Vulnerabilities: Enhances security with robust threat detection.
Process Integration: Seamlessly integrates with DevOps tools such as Jenkins.
Scalable Deployment: Quickly adaptable in expanding environments.
GUI Usability: Highly efficient for technical teams to navigate.

CodeSonar is primarily implemented in industries like defense and companies prioritizing code quality. Teams utilize its static code analysis and threat detection capabilities, integrating with Jenkins for continuous integration workflows. Security checks post-builds and technical support are common, aiding in effective defect management.

AdaCore

Qualys Web Application Scanning offers advanced vulnerability management, progressive scheduling, and seamless integration with DevOps environments. Its user-friendly design enables enterprises to enhance security with comprehensive scanning and detailed forensic insights.

Qualys Web Application Scanning addresses enterprise-level security challenges by providing robust solutions for vulnerability management, penetration testing, and compliance checks. While easing the navigation process, it supports risk mitigation with precise risk ratings, minimal false positives, and detailed reporting. However, it faces challenges with its complex interface, authenticated scanning, and automation features. Integrating smoothly with CI/CD pipelines, it is suitable for continuous and automated scanning, adapting to diverse company requirements.

What are the standout features of Qualys Web Application Scanning?

Progressive Scheduling: Enables efficient management of scanning activities, optimizing for time-sensitive scenarios.
Vulnerability Management: Offers robust identification and management of vulnerabilities across various applications.
Integration with DevOps: Seamlessly integrates with CI/CD pipelines, supporting rapid development cycles.
Risk Ratings: Provides precise risk assessments, crucial for prioritizing security efforts.
Engaging Dashboard: Offers an intuitive interface for navigating security tasks efficiently.

What benefits or ROI should users look for in Qualys Web Application Scanning reviews?

Scalability: Supports enterprise needs with a design adaptable to diverse security demands.
Risk Mitigation: Detailed alerts and forensic insights aid in reducing potential threats.
Comprehensive Reporting: Facilitates informed decision-making with clear, concise reports.
Penetration Testing: Enhances security assessments with ongoing evaluation capabilities.

Organizations across sectors like education, banking, and international data centers leverage Qualys Web Application Scanning for conducting penetration testing, scanning web applications, and managing vulnerabilities. It aids in audit security and compliance, identifying threats, and generating user-friendly reports, making it a valuable asset for maintaining strong security postures.

Qualys

Sample Customers

Viveris, Micrel Medical Devices, Olympus, SOFTEQ, SONY

BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.

Buyer's Guide

CodeSonar vs. Qualys Web Application Scanning

August 2026

Free Report: CodeSonar vs. Qualys Web Application Scanning

Find out what your peers are saying about CodeSonar vs. Qualys Web Application Scanning and other solutions. Updated: August 2026.

DOWNLOAD NOW

908,800 professionals have used our research since 2012.

See our CodeSonar vs. Qualys Web Application Scanning report.

See our list of best Application Security Tools vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.