SonaType: cybersecurity software

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes.

What SonaType is

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes. The vendor site is www.sonatype.com. This profile is an entry in the oneNorma directory, not a vendor landing page.

What SonaType covers

SonaType is in the catalog for these capabilities. Categories: SCA and SAST.

How to evaluate SonaType in a security program

Use SonaType as a stack candidate, not as diligence evidence. The oneNorma score for SonaType is 4.3/10 (percentile 21). If the real gap is in SCA and SAST, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what www.sonatype.com publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

SCASAST

Capabilities by category

SAST

Enterprise

Frequently asked questions

What is SonaType?

SonaType was one of the first organizations doing SDLC tooling; however, until recently, they did not have a cloud platform. Their platform is still catching up to the intuitiveness of the SaaS competition, but their product checks all the boxes. Site: www.sonatype.com.

Which categories does SonaType fall into?

SonaType appears in the oneNorma directory under SCA and SAST. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement SonaType?

No. The SonaType profile (www.sonatype.com) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.