Sonatype Platform

Score8.4 out of 10

20 Reviews and Ratings

What is Sonatype Platform?

Sonatype secures the software supply chain and protects organizations' vital software development lifecycle(SDLC). The platform unites security teams and developers to accelerate digital innovation without sacrificing security or quality across the SDLC. With users among more than 2,000 organizations and 15 million software developers, Sonatype tools and guidance help users to deliver and maintain exceptional and secure software. C ore product offerings include :

Sonatype Nexus Repository helps manage components, binaries and build artifacts across the entire software supply chain, serving billions of components to developers weekly so they can build more quickly and reliably.
Sonatype Repository Firewall the first line of defense against against software supply chain attacks. It blocks malicious and suspicious packages, prevents known vulnerabilities and harmful open source releases from downloading into the repository, and automatically releases cleared components back into the development pipeline.
Sonatype Lifecycle enables continuous monitoring of business critical applications that have been released or deployed to determine risk level and remediate vulnerabilities faster, with precise component intelligence. This helps to prevent unplanned work, security breaches, and maintainability issues with early detection and remediation.

Categories & Use Cases

Media

Screenshot of Sonatype Lifecycle - Chrome extension

Screenshot of Sonatype Advanced Legal Pack

Screenshot of Sonatype Nexus Repository Manager

Screenshot of Remediation of vulnerabilities

Screenshot of Sonatype Lifecycle Integrations

Screenshot of Sonatype Repository Firewall

1 / 8

Screenshot of Sonatype Lifecycle

#1 most frequent

Professional, Scientific, and Technical Services

29.3%

1,301 installations of 4,437

#2 most frequent

Finance and Insurance

16.3%

724 installations of 4,437

#3 most frequent

Information

15.8%

703 installations of 4,437

Navneet Mittal

Senior Manager in Product Management at HSBC (10,001+ employees employees)

Use Cases and Deployment Scope

We at HTI use Sonatype products extensively. Specially Nexus repository manager, IQ & Firewall. We have a massive scale of our users almost 40k who are using our platform (Artefcats Management). We have many complex use cases, one of them being hosting docker on Nexus. We have millions of public, private & hosted images on our platform & lot of tier0 services depend on us for their build & deployments. Any outage or slowness on docker nexus instance impacts them heavily & its huge impact on our reputation as well as business. Sonatype team is regularly helping us tune our Nexus repository manager in such a way that our service is not only highly available but optimized enough to ensure our business continues as usual. Nexus repository manager as a tool has come long way & Sonatype team ensures we as a customer get the required features & service.

Pros

Improved repo manager
High Availability
Great Support
Continuously improving Lifecycle

Cons

Reporting in repository manager
Easy remediation process in IQ
Optimize resource utilization for Nexus & IQ

Return on Investment

Our usage has grown from 3k users in 2011 to 40k today
We use almost all features on nexus very extensively like logging, tasks, clean up, etc.

Usability

Alternatives Considered

APF Software Firewall

Other Software Used

Jenkins, GitHub

Sebastian Schmidt

Senior Application Manager in Information Technology at WERTGARANTIE SE (501-1000 employees employees)

Use Cases and Deployment Scope

We use the Sonatype Platform in the Software-Development-Process to make sure we a) are better informed on what goes live and what not and b) research what problems can be fixed how and when. Theese 2 tools help to make sure we also can add Quality-Gates to our CI/CD pipelines.

Pros

Inform about vulnerabilities and how to fix them
Make sure we load safe packages via a secure proxy
Create an inventory of apps with SBOMs to understand our products and the risks better
Host our own private packages
Integrations in IDE and Browsers
Awesome support
Fresh information every month at the "Office Hours"

Cons

Not all of the programming languages on the Top20 of TIOBE Index are covered - PHP is third party and breaks Upgrade-Paths to an external database currently
JetBrains IDE support is "only on Java", but shows for "all products" as enabled, which it isnt, this creates confusion on a daily/weekly basis
New feature Sonatype Developer is hidden behind "Tile Designs", you have to constantly switch between setups/environments/apps??? You always have to look for how to get back to the other apps. Very confusing on the developer side. Devs commonly want to use tools that are easy and help the workflow, not complicate it by beeing sort of hidden
Nexus Repos Log viewer is missing a "Date" selector, viewing the "last 25/50/100kb" in an active environment isnt that helpful
Nexus IQ is missing a system where i can setup footer-links for Legal-Purposes and also a tool that shows me my users, like Nexus Repo has built in

Return on Investment

Helps to be pro-active and informed
Helps to get started fast and reduces CVEs, IF the language support is there
Helps to get an overview of SBOMs, on what you have in development to production environments

Usability

Verified User

Advisor in Professional Services (1001-5000 employees employees)

Use Cases and Deployment Scope

Sonatype Nexus Lifecycle, we are able to identify issues with the 3rd party controls/components in our software very early into the development stage. Sonatype Lifecycle works very well within our DevOps practice, it helps us to implement continuous monitoring on 3rd party controls/components. It provides detailed reporting that helps us to understand the associated Vulnerabilities with the components and its dependencies.

Pros

Scan Speed/time
Detailed reports
Their own analysis

Cons

Provision to see the historical reporting/analysis with 3rd party components.

Most Important Features

Return on Investment

Early identifying & fixing the issues into SDLC

Usability

Alternatives Considered

Veracode

Other Software Used

Veracode, Security Compass SD Elements

Frederick Farber

Enterprise Architect in Information Technology at BMW of North America (10,001+ employees employees)

Use Cases and Deployment Scope

Top tier platform for identifying, remediating and managing known source code vulnerabilities across a large portfolio of applications. We incorporated Nexus Lifecycle scanning into our end to end pipelines with great success.

Pros

Vulnerability identification and best path to remediation.
Very well supported platform - exceptional customer service.
Ongoing monitoring of last released BOM per application and alerting of new vulnerabilities.

Cons

Recommendations for best Energy Consumption options based on existing BOM - e.g. replace component X with component Y to reduce CPU cycles.
More specific recommendations regarding Open Source Licensing - not just saying "Copyleft" but the next level of analysis (it's difficult - but would save a lot of time)
Provide specific component replacement options where no "next version" resolves a high severity vulnerability.

Most Important Features

Vulnerability Identification / Remediation Guidance
Relatively simple ingest/onboarding process per application
Outstanding support

Return on Investment

Enabled us to be more proactive on vulnerability remediation
Significant reduction in legacy technical debt
Being proactive with monthly touchpoints to keep our progress moving forward

Alternatives Considered

Black Duck Software Composition Analysis (SCA)

Other Software Used

AWS Batch, Jenkins, GitHub

Verified User

Contributor in Information Technology (5001-10,000 employees employees)

Use Cases and Deployment Scope

In our organization we use Sonatype's Nexus Platform to manage repositories, artifacts like docker images and libraries and to distribute/share artifacts amongst different teams. Integrates well with gitlab/github repositories making it a good choice as repository manager. It has web browser to browse different artifacts and manage the artifacts (deprecate the ones not required)
Some teams use Nexus Lifecycle to identify vulnerabilities in build components and has been great help!

Pros

Store and share artifacts likes java libraries and docker images
Find vulnerabilities and malicious code in the builds using LifeCycle
Integrates quite well with Gitlab ci/cd and provides
Managing/browsing different artifacts in the repo

Cons

UI can be improved. The error messages can be made clearer.
Repository mirroring between Nexus and Artifactory breaks from time to time
We have run into issues with Nexus and various plug-ins specifically maven from time to time.

Most Important Features

Management of artifact's using Sonatype Repository manager
Checking for Vulnerabilities using Sonatype's LifeCycle
Sharing of artifacts using Nexus Repository
Integration with Gitlab for CI/CD operations

Return on Investment

Sonatype Nexus has a positive ROI my organization. It has saved cost of hardware and network bandwidth by acting as repository manager
It has eliminated vulnerability threats by checking the components for security risk and vulnerabilities
It has allowed the management of the artifacts thus saving on the disk space on servers

Alternatives Considered

Apache Archiva and JFrog Artifactory

Other Software Used

Google Kubernetes Engine, AWS CodeArtifact, IntelliJ IDEA

Sonatype Platform

What is Sonatype Platform?

Categories & Use Cases

Media

Most Frequent Users

Professional, Scientific, and Technical Services

Finance and Insurance

Information

Reviews

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Usability

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Return on Investment

Usability

Use Cases and Deployment Scope

Pros

Cons

Most Important Features

Return on Investment

Usability

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Most Important Features

Return on Investment

Alternatives Considered

Other Software Used

Use Cases and Deployment Scope

Pros

Cons

Most Important Features

Return on Investment

Alternatives Considered

Other Software Used

Related Products