No more typing reviews! Try our Samantha, our new voice AI agent.

Onapsis vs SonarQube comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Onapsis
Ranking in Application Security Tools
35th
Average Rating
8.0
Number of Reviews
1
Ranking in other categories
No ranking in other categories
SonarQube
Ranking in Application Security Tools
1st
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
135
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

As of June 2026, in the Application Security Tools category, the mindshare of Onapsis is 0.9%, up from 0.2% compared to the previous year. The mindshare of SonarQube is 12.7%, down from 24.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
SonarQube12.7%
Onapsis0.9%
Other86.4%
Application Security Tools
 

Featured Reviews

it_user19113 - PeerSpot reviewer
SAP Security Consulting Engineer at a computer software company with 10,001+ employees
It checks for and reports vulnerabilities on all SAP systems at the OS, DB and SAP levels.
I really love how Onapsis X1 is able to check SAP for threats; the reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience. Currently, it takes some background jobs and additional work to get them published. It was difficult to get interactive reports to the different levels of the business. I would have to download them and send them out, or save them on my SharePoint site and send out a weekly link. In the version of the product I was usingת I had to log into the X1 system directly to get to the reports. Reporting would be used by several different areas of the organizationת many of whom would be at the director and executive levels. It would not make sense to have them log directly into the tool to look at these reports. Add to this that there was only one ID that could be used to log in and view the reports. To solve this problemת I had to run all of the different reports; executive summary down to detailed analysis and then export them out to my security team SharePoint site. To automate this processת a batch script was created to run after the X1 analyzed the systems. The script would pull the reports and place them in the SharePoint site automatically, but it was a bit of a hassle to get set up.
Sathyamurthi Natarajan - PeerSpot reviewer
IT Officer (Solution Architect) at World Bank
We maintain high code standards with effective static code analysis and integration
SonarQube Server (formerly SonarQube) could be improved on the reporting front. Instead of grouping, I would prefer to scan the code as part of development and then generate a report on a daily basis among different units or projects, which is currently complicated. We need to change it to more of a portfolio report, where configuring or setting up things on the portfolio requires tagging at the ADO level.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It has hardened our SAP system by providing details of vulnerabilities in our SAP landscape."
"Our primary use case is to provide more coverage and reduce the reliance on code reviews alone, and it also provides confidence and helps begin a path towards continuous improvement."
"It is quality software, even if the plugins are often weaker than would be necessary to have a team centralize around it."
"SonarQube is a Code Quality Assurance tool that collects and analyzes source code and provides reports on the code quality of your project."
"The static code analysis is very good, and in the banking sector, we have found several vulnerabilities and many issues in the source code."
"I would recommend SonarQube to other users as it is a good solution and the security issues we experienced are being fixed."
"SonarQube is a very nice tool and people can learn to code better from the analysis it provides."
"SonarQube is a fantastic tool which saves us precious time."
"Improve the code coverage and evaluates the technical steps and percentage of code being resolved."
 

Cons

"Reporting was something I felt could be improved. It could be a little easier to use and to publish for consumption with a larger audience."
"The Enterprise edition has the additional features we need, but of course we have to pay for that."
"The interface could be a little better and should be enhanced."
"There is need for support for the additional languages and ease of use in adding new rules for detecting issues."
"CI/CD pipeline is part of a whole chain of design, development, and production, and it's becoming increasingly crucial to optimize the various tools across different stages. However, it's still a silo approach because the full integration is missing. This isn't just an issue with SonarCloud. It's a general problem with tooling."
"SonarCloud's UI needs enhancement."
"Price is high and only worth it if your organization has hundreds of developers."
"We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major."
"Code security scanning could be improved."
 

Pricing and Cost Advice

Information not available
"It's an open-source product."
"SonarQube is an open-source product that can be used free of charge."
"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."
"The solution is cheaper than other products."
"We use the solution free of cost."
"SonarQube is a fairly affordable solution for a larger scale if you have a specific role or specific department for secure code."
"We're using the Community Edition, and we don't pay for anything."
"There is both a free and licensed version. The free version has limitations on development languages and support."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Energy/Utilities Company
16%
Construction Company
13%
University
13%
Outsourcing Company
7%
Financial Services Firm
13%
Manufacturing Company
13%
Computer Software Company
12%
Comms Service Provider
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business43
Midsize Enterprise24
Large Enterprise79
 

Questions from the Community

Ask a question
Earn 20 points
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Also Known As

No data available
Sonar, SonarQube Cloud
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Sony, US Army, Westinghouse, AXA. Galicia, Daimler, Roche, Levi's, Siemens, ABB, KPMG, Mercardo Libre, Verizon, Bacardi, Adgas, Sicpa, Whirlpool, Leaseplan
Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.
Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: June 2026.
900,644 professionals have used our research since 2012.