No more typing reviews! Try our Samantha, our new voice AI agent.

SonarQube vs Trellix IVX for Enterprise Applications comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Feb 8, 2026

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

SonarQube
Ranking in Application Security Tools
1st
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
139
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
Trellix IVX for Enterprise ...
Ranking in Application Security Tools
27th
Average Rating
8.0
Reviews Sentiment
5.3
Number of Reviews
4
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of November 2026, in the Application Security Tools category, the mindshare of SonarQube is 10.2%, down from 20.7% compared to the previous year. The mindshare of Trellix IVX for Enterprise Applications is 0.4%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
SonarQube10.2%
Trellix IVX for Enterprise Applications0.4%
Other89.4%
Application Security Tools
 

Featured Reviews

Vitthal Gole - PeerSpot reviewer
Devops Engineer at AIQOD
Automated code checks have improved quality gates and prevent weak code from reaching production
SonarQube could improve by reducing false positives in its static code analysis; while its detection capabilities are strong, some findings require manual verification, increasing developers' workload. More accurate analysis would enhance productivity, and SonarQube would benefit from enhanced AI-powered recommendations for fixing issues. For instance, in our pipeline, if it fails during SonarQube stage, we could check the dashboard for identified issues involving code smells, bugs, or duplicacy. An AI feature should be integrated into SonarQube to resolve issues quickly; optimizing scanning performance for very large repositories and providing faster analysis times would enhance the developer experience, especially in large code bases with frequent commits. For anyone planning to implement SonarQube, I advise starting by defining coding standards first and integrating Quality Gates into the pipeline. You can customize quality profiles to match project requirements; rather than relying entirely on default rules, you can adjust settings for stronger detection and enforcement. Organizations with advanced security, branch analysis, and governance features might consider commercial editions based on their needs.
HA
General Manager at CyberTech Computer
Long-term endpoint security has protected our organization from ransomware and data loss
Trellix IVX for Enterprise Applications Collaboration is not something we are currently using. We are not using FireEye Email Security right now. We are not using the cloud version of this product. It is not difficult to manage because our team is very well trained and aware of Trellix IVX for Enterprise Applications endpoint security because we have been using it for more than 20 years. Our team is very well trained on the endpoint security. However, because we have a very distributed architecture of our organization, it is very difficult to change or replace on laptop or desktop computers. At most, only two or three engineers are involved. Trellix IVX for Enterprise Applications is very robust and easy to handle data loss protection, which are very good features. We are also using Fortinet products. The vendor team is also monitoring and does proactive measures to protect from ransomware and other security threats. We have a service level agreement with the local vendor to maintain the solution and solve other issues. The overall review rating for this product is 8 out of 10.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"SonarQube Cloud (formerly SonarCloud) has had a positive impact on my organization by giving the best impact for code checking and code structuring, making the code more usable and better."
"This solution is simple to use and can be quickly deployed."
"We've configured it to run on each commit, providing feedback on our software quality. ]"
"The most valuable features of SonarCloud are the ability to discover vulnerabilities, security weak points, security hotspots, and all the feedback that comes into the feature branch. You can deploy the code with the security, you can eliminate the problem at the developer level rather than identifying the problem in the productions."
"We were trying to serve two purposes; work quality and code security, with one tool."
"All the features of the solution are quite good."
"It is a good deal compared to all other tools on the market."
"The static code analysis is very good, and in the banking sector, we have found several vulnerabilities and many issues in the source code."
"Trellix IVX for Enterprise Applications is very robust and easy to handle data loss protection, which are very good features."
"We actually saw reduced incidents with Trellix IVX for Enterprise Applications, and it has reduced the response time for us because if there is a detection of high severity, Trellix IVX for Enterprise Applications detects it quickly and we are able to respond to it promptly."
"Trellix IVX for Enterprise Applications has positively impacted my organization over the past four years, serving as one of the best security tools I have used."
"Trellix IVX for Enterprise Applications positively impacts my organization by increasing security and reducing time, especially by using threat intelligence to validate signatures across all platforms, thus minimizing manual work."
 

Cons

"Response to queries directly to SonarSource haven't always been particularly successful, but the community forum is pretty good."
"We also use Fortify, which is another tool to find security errors. Fortify is a better security tool. It is better than SonarQube in finding errors. Sometimes, SonarQube doesn't find some of the errors that Fortify is able to find. Fortify also has a community, which SonarQube doesn't have. Its installation is a little bit complex. We need to install a database, install the product, and specify the version of the database and the product. They can simplify the installation and make it easier. We use docker for the installation because it is easier to use. Its dashboard needs to be improved. It is not intuitive. It is hard to understand the interface, and it can be improved to provide a better user experience."
"It requires advanced heuristics to recognize more complex constructs that could be disregarded as issues."
"The product's pricing could be lower."
"SonarQube Server (formerly SonarQube) could be improved on the reporting front. Instead of grouping, I would prefer to scan the code as part of development and then generate a report on a daily basis among different units or projects, which is currently complicated."
"It does not provide deeper scanning of vulnerabilities in an application, on a live session. This is something we are not happy about. Maybe the reason for that is we are running the community edition currently, but other editions may improve on that aspect."
"I think the code security can be improved."
"Fortify is a better security tool; it is better than SonarQube in finding errors, and sometimes SonarQube doesn't find some of the errors that Fortify is able to find."
"I think Trellix IVX for Enterprise Applications can be improved by adding more involvement of artificial intelligence."
"Customer support for Trellix IVX for Enterprise Applications is very good in theory. However, you must follow up with them for weeks and weeks for a single issue."
"The weak side is that it sometimes slows down the desktop computer or laptop computer."
"Overall I find the platform useful; however, there should be ease of navigation and more actionable reporting to make investigations faster and the overall experience more efficient."
 

Pricing and Cost Advice

"SonarQube is a fairly affordable solution for a larger scale if you have a specific role or specific department for secure code."
"The price of this solution is more expensive than competitors. However, it works better than competitors."
"This solution is free."
"The free version of SonarQube does everything that we need it to."
"SonarQube price is a little bit higher than Kiuwan's. Kiuwan also gives a little bit of flexibility in terms of pricing."
"I am satisfied with the pricing."
"SonarQube is an open-source product that can be used free of charge."
"The solution has a free version and a license version. The license is priced reasonably, the cost of hiring one programmer is more expensive than the solution."
Information not available
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
920,574 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Manufacturing Company
13%
Financial Services Firm
12%
Computer Software Company
10%
Comms Service Provider
7%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business45
Midsize Enterprise25
Large Enterprise81
No data available
 

Questions from the Community

Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
What needs improvement with Trellix IVX for Enterprise Applications?
Endpoint services in Trellix IVX for Enterprise Applications can occasionally stop and require manual intervention. Content updates such as DAT and AMCore require troubleshooting in some environmen...
What is your primary use case for Trellix IVX for Enterprise Applications?
We have been using Trellix IVX for Enterprise Applications for one of our clients, and the console is quite intuitive. Day-to-day operations such as reviewing detection, managing endpoints, and cre...
What advice do you have for others considering Trellix IVX for Enterprise Applications?
We actually saw reduced incidents with Trellix IVX for Enterprise Applications. It has reduced the response time for us. If there is a detection of high severity, Trellix IVX for Enterprise Applica...
 

Also Known As

Sonar, SonarQube Cloud
No data available
 

Interactive Demo

Demo not available
 

Overview

 

Sample Customers

Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.
Information Not Available
Find out what your peers are saying about SonarQube vs. Trellix IVX for Enterprise Applications and other solutions. Updated: November 2026.
920,574 professionals have used our research since 2012.