Sonatype Lifecycle

I have used Sonatype Lifecycle  for one year, primarily as a part of DevSecOps  and software composition analysis initiatives focused on my application security project, which involves identifying and managing open-source dependencies risks within application environments.

For Sonatype Lifecycle , I actually use it for two purposes in application security: security composition analysis (SCA ) and Static Application Security Testing (SAST ), with the intention to identify code-level vulnerabilities when developers write any code, allowing me to scan the code, prioritize vulnerabilities, and fix those areas to reduce overall application risks.

Before using Sonatype Lifecycle, I used to get vulnerabilities in the deployment phase, also known as Dynamic Application Security Testing (DAST) , but after implementing Sonatype Lifecycle, it adds an additional security layer by allowing me to conduct SAST  and SCA  scans early in the coding phase, enabling me to prioritize and remediate vulnerabilities as soon as possible, which reduces time and effort.

In my opinion, the strongest feature of Sonatype Lifecycle is its ability to provide continuous visibility and governance over open-source dependencies throughout the software development lifecycle, with the most standout aspect being its effective integration of security directly into DevSecOps  workflows instead of treating security as a separate, post-development activity.

The policy-based governance and vulnerable component rejection capabilities are tremendously valuable for my team because they shifted security enforcement earlier in the lifecycle. For example, I configured policies to flag or block builds with open-source components with critical vulnerabilities, and that was impactful when Sonatype Lifecycle detected a high-severity vulnerability during a build process.

Overall, Sonatype Lifecycle has a very positive impact on the organization, particularly in improving software supply chain security and DevSecOps practices, with measurable improvements including earlier detection of vulnerabilities and faster remediation cycles.

I have definitely observed measurable operational improvements after integrating Sonatype Lifecycle into my workflows, highlighted by a noticeable reduction in vulnerable open-source components progressing to production stages, allowing me to remediate them before deployment.

While Sonatype Lifecycle provides strong value for software composition analysis and software supply chain security, one area for improvement is alert prioritization and noise reduction, especially in larger development environments.

The primary area for improvement I mentioned is alert prioritization and noise reduction, in addition to improving dashboard and reporting customization.

I have used Sonatype Lifecycle for one year.

Sonatype Lifecycle is pretty stable and works fine.

In my experience, Sonatype Lifecycle scales well for enterprise DevSecOps and software supply chain security use cases, particularly in environments with multiple development teams and a large number of applications and dependencies.

The customer support for Sonatype Lifecycle is very helpful, and they are technically sound, providing positive feedback.

Before Sonatype Lifecycle, I used a DAST solution called Qualys for application security, and this is my first tool for SAST and SCA scans.

From my point of view, once I introduce Sonatype Lifecycle with the DevSecOps pipeline, it offers automated vulnerability scanning, prioritization, and allows me to focus on risk assessment and remediation, saving me about 40% in time and effort.

If you are working in a DevSecOps or application security project and want to prioritize vulnerabilities early, implementing Sonatype Lifecycle in your project will be helpful in addressing risks before they escalate. I provided this review with a rating of 8.

Whenever we have builds, we upload our builds or artifacts to Sonatype Container . This is the basic purpose. Sonatype Container  makes cleanup and uploading artifacts easy with its clear UI for management.

Sonatype Container is a reliable artifact manager. Although I do not have a comparison at the moment, it has consistently been a good choice for our organization. Its management features are effective, and the UI is clear, making it easy to upload and manage artifacts. Additionally, the use of Sonatype Container ensures efficient cleanup and file handling.

Sonatype Container can accommodate bigger file sizes for artifacts and improve performance, especially when dealing with large files. Moreover, the RBAC controls could be more simplified in a more human-readable language.

I have been working with Sonatype Container for more than five years.

I would rate the stability as eight out of ten.

Technical support from Sonatype is not much needed. I had a problem once while creating a repository when the artifacts uploaded were not showing up, but this may have been due to configuration details.

We have been using Sonatype Container for a long stretch of time and have not tried anything else.

The setup is simple; however, if we consider RBAC, the roles we assign to users could be simplified. The response from the roles assigned to the artifacts should be more human-readable.

Pricing is out of my context as a developer. This is known by the project managers.

I would rate the overall solution as eight out of ten.

We use Sonatype Lifecycle  primarily as a binary repository management solution for managing software artifacts. Our company has a large stack of tools for software development, and Sonatype Lifecycle  is part of these tools. We use it solely for managing software artifacts without utilizing the software composition analysis or the vulnerability checking capabilities. We are expanding our clients and services as part of Digital Service of Brazil.

The most valuable feature for us is Sonatype Lifecycle's capability in identifying vulnerabilities. It has a large portfolio for vulnerability analysis, making it a leader in vulnerability checking. In comparison, the performance of other products, like JFrog's, does not reach the same level in identifying vulnerabilities. Additionally, Sonatype Lifecycle is very stable, especially in managing binary artifacts for over fifteen years with minimal problems, even with more than 700 developers working on a single node.

Both JFrog and Sonatype should redesign their products to separate the binary repository management solution from the software composition analysis solutions. We prefer to purchase the binary repository management solution independently, but they offer both together, which increases costs. This integration is good but raises the price, being a significant issue for us. We also noticed a lack of detailed information for configuring Sonatype Lifecycle for high availability and data recovery.

I have used Sonatype Lifecycle for over fifteen years.

Sonatype Lifecycle is very stable, especially in the binary repository management use case for managing binary artifacts. We have not experienced any significant issues over the fifteen years of use.

Both Sonatype and JFrog have solutions for high availability and data recovery, but Sonatype is more complex to configure. JFrog is easier to configure for high availability as it does not require extra components. It handles high availability at the database level, such as synchronizing JFrog repository servers without complicated configurations.

We use Sonatype Lifecycle in its open-source software edition, so we do not have experience with their customer service or technical support.

According to my calculations, if you are working with up to 200 developers, Sonatype is cheaper than JFrog. However, for larger numbers like our case with 1,000 user licenses, JFrog becomes much more cost-effective, roughly ten times cheaper than Sonatype. Their licensing models are different, impacting the price depending on the number of developers.

I compared Sonatype Lifecycle with JFrog Artifactory  and Xray.

Overall, I would rate Sonatype Lifecycle a nine out of ten.

We use Sonatype Lifecycle  for scanning our SCA  product, software composition analysis. It is a category of product we use to scan third-party packages imported into the source code like Java, Node.js, or Python.

It reports back as an enterprise product with UI reports and is very useful. We integrate it into our pipelines, generate reports, and our developers engage with it to fix issues and ensure the software supply chain is secure.

The solution provides a comprehensive overview of dependencies and their security status. The onboarding process is straightforward, and the UI is very clear. The integration into our CICD pipeline enables us to continuously monitor code changes and identify new vulnerabilities. This ensures we can address issues proactively. Lifecycle effectively manages dependencies and highlights unsecure packages. It does what it does better, with integration into other Sonatype products. This integrated ecosystem is advantageous for us.

It is a bit narrow, and we are expecting more features, especially with respect to SBOM and other detections. It is specific to only one category, and we would like them to add more diverse application security features. We expect products to do multiple things. It only does one thing, and we want it to expand its capabilities.

We have been working with Sonatype Lifecycle  for four years.

The product is stable and works as expected. There are no performance or reliability issues.

I find the solution scalable.

The technical support is good. I would rate them as eight out of ten. They are helpful when we raise any tickets.

We did not use another solution before this one.

The initial setup is not straightforward as it includes databases, yet the documentation is good, and we did not face any issues. The support is good, and the setup went smoothly.

It is a security product, so we installed it in our automation environment without tweaking anything. We brought users in, provided an overview of how developers should use it, and integrated it into a few applications before rolling it out to all.

We have seen cost savings and efficiency improvements as we now know what happens in what was previously a black box. The ROI is around two years, however, security improvements are hard to quantify.

We didn't evaluate other options since the product aligns with our ecosystem, enabling it to work well with other solutions we use.

I recommend it because it integrates well with other Sonatype products and does its job effectively.

Overall, I would rate Sonatype Lifecycle as seven out of ten.