No more typing reviews! Try our Samantha, our new voice AI agent.

Defensics Protocol Fuzzing vs SonarQube comparison

Why PeerSpot?

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Defensics Protocol Fuzzing
Average Rating
8.6
Number of Reviews
4
Ranking in other categories
Fuzz Testing Tools (4th)
SonarQube
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
139
Ranking in other categories
Application Security Tools (1st), Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

While both are Quality Assurance solutions, they serve different purposes. Defensics Protocol Fuzzing is designed for Fuzz Testing Tools and holds a mindshare of 16.1%, down 22.4% compared to last year.
SonarQube, on the other hand, focuses on Application Security Tools, holds 10.2% mindshare, down 20.7% since last year.
Fuzz Testing Tools Mindshare Distribution
ProductMindshare (%)
Defensics Protocol Fuzzing16.1%
PortSwigger Burp Suite Professional35.2%
GitLab30.2%
Other18.5%
Fuzz Testing Tools
Application Security Tools Mindshare Distribution
ProductMindshare (%)
SonarQube10.2%
Checkmarx One6.8%
Snyk4.8%
Other78.2%
Application Security Tools
 

Featured Reviews

SK
Senior Technical Lead at HCL Technologies
Product security tests for switches and router sections
Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install. What I see in the documentation isn't that. Even if something doesn't malfunction, sometimes it is hard to install and execute. The product needs video documentation. This would help a lot more.
Vitthal Gole - PeerSpot reviewer
Devops Engineer at AIQOD
Automated code checks have improved quality gates and prevent weak code from reaching production
SonarQube could improve by reducing false positives in its static code analysis; while its detection capabilities are strong, some findings require manual verification, increasing developers' workload. More accurate analysis would enhance productivity, and SonarQube would benefit from enhanced AI-powered recommendations for fixing issues. For instance, in our pipeline, if it fails during SonarQube stage, we could check the dashboard for identified issues involving code smells, bugs, or duplicacy. An AI feature should be integrated into SonarQube to resolve issues quickly; optimizing scanning performance for very large repositories and providing faster analysis times would enhance the developer experience, especially in large code bases with frequent commits. For anyone planning to implement SonarQube, I advise starting by defining coding standards first and integrating Quality Gates into the pipeline. You can customize quality profiles to match project requirements; rather than relying entirely on default rules, you can adjust settings for stronger detection and enforcement. Organizations with advanced security, branch analysis, and governance features might consider commercial editions based on their needs.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The stability of this product is great; we tested it under multiple constraints and even on cloud services it is absolutely stable."
"ROI was 100%. Since there are no product suites available that provide the level of testing available with Codenomicon, the development, quality and security assurance departments know that the investment was correct."
"The product is related to US usage with TLS contact fees, i.e. how more data center connections will help lower networking costs."
"We have found multiple issues in our embedded system network protocols, related to buffer overflow. We have reduced some of these issues."
"Simple and straightforward GUI."
"Whatever the test suit they give, it is intelligent; it will understand the protocol and it will generate the test cases based on the protocol: protocol, message sequence, protocol, message structure, and because of that, we can eliminate a lot of unwanted test cases so we can execute the tests and complete them very quickly."
"When it comes to security, this solution is pretty great."
"It easily ties into our continuous integration pipeline."
"If code coverage is a low number then that's of great value to me."
"We have a big organization with a lot of applications and all of our critical applications are on this platform."
"The most valuable feature of this solution is that it is free."
"The static code analysis is very good, and in the banking sector, we have found several vulnerabilities and many issues in the source code."
"While annoying occasionally with its issue reports, it is actually an invaluable source of better knowledge and applying it in practice to your solutions."
"I follow Quality Gate's graduation model within organization, and it is extremely helpful for me to benchmark products."
 

Cons

"It requires understanding the Defensics protocol."
"It does not support the complete protocol stack. There are some IoT protocols that are not supported and new protocols that are not supported."
"You can't implement proprietary ciphering algorithms, nor can you modify protocol models if you need to test customized public protocols."
"Codenomicon Defensics should be more advanced for the testing sector. It should be somewhat easy and flexible to install."
"Sometimes, when we are testing embedded devices, when we trigger the test cases, the target will crash immediately. It is very difficult for us to identify the root cause of the crash because they do not provide sophisticated tools on the target side. They cover only the client-side application... They do not have diagnostic tools for the target side. Rather, they have them but they are very minimal and not very helpful."
"There could be better integration with other products. It could have more functionality, and the updates could be faster."
"We previously experienced issues with security but a segregated security violation has been implemented and the issues we experienced are being fixed."
"SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan."
"When we have a thousand products published over it, we expect it to be more efficient in terms of serving requests from the browser."
"The software testing tool capability could improve. It does not always integrate well. You have to use a specific plugin and the plugin does not always go in Apple's applications."
"The learning curve can be fairly steep at first, but then, it's not an entry-level type of application."
"Reporting features are missing in SonarCloud."
"In terms of what can be improved, the areas that need more attention in the solution are its architecture and development."
 

Pricing and Cost Advice

"Licensing is a bit expensive."
"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."
"I requested this license for one million lines of code and they accepted this."
"There is both a free and licensed version. The free version has limitations on development languages and support."
"A low cost long-term solution for non-critical situations."
"SonarQube is a cost-effective solution."
"The price of SonarCloud is not expensive, it goes by the lines of code. 1 million lines per code are approximately 4,000 USD per year. If you need 2 million lines of code you would double the annual cost."
"I think comparing the product to competitors it should be less expensive."
"Some of the plugins that were previously free are not free now."
report
Use our free recommendation engine to learn which Fuzz Testing Tools solutions are best for your needs.
920,769 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
10%
Comms Service Provider
10%
Computer Software Company
8%
Manufacturing Company
7%
Manufacturing Company
13%
Financial Services Firm
12%
Computer Software Company
10%
Comms Service Provider
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise25
Large Enterprise81
 

Questions from the Community

Ask a question
Earn 20 points
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Also Known As

Codenomicon Defensics
Sonar, SonarQube Cloud
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Coriant, CERT-FI, Next Generation Networks
Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.