Sonatype Guide

Sonatype Lifecycle is basically a central use case for scanning applications in the CI/CD for vulnerabilities or non-compliant open-source dependencies and enforces policy across the dev lifecycle. It is reactive, continuous monitoring of what's already in your application. This is the benefit of it.

The benefits or features that I appreciate about Sonatype Lifecycle are that it is reactive and it supports CI/CD. There is early detection, so it will flag the vulnerabilities in the open-source dependencies straight away. Also, if you have the policies, it will automate the enforcement for you. If you have severity thresholds or you define something, it enforces them automatically in the CI/CD builds.

There is also the remediation guidance. It will give you the best version to upgrade to. It will not just flag that there is a CVE, but it will also give you recommendations on what version you need to fix to. Continuous monitoring is another benefit.

The reporting, audit and reporting is also valuable. In the dashboard, you will see the application risks reports, and security teams will look at and see what's happening with certain applications. In a nutshell, it enables faster releases and lower security exposure.

If we add Sonatype Lifecycle for Azure, it works for pipelines, and it allows you to run pipelines in the environment. You will have CI/CD, continuous integration, continuous development. People will have faster results. Instead of having DevOps, we have DevSecOps because of this. It improves security and allows teams to have security shift left from the beginning, instead of just leaving it at the end to find out this open-source library is insecure or having to rewrite the code in other ways or reuse a different library.

Sometimes changing those libraries or open-source requires a rewrite. I remember one time we had a vulnerability of some Java, and the solution was to use another Java. Using that another Java forced the developer to rewrite many components because there was a huge difference. This helps identify issues fast instead of waiting until the end to find out it is vulnerable and having to make changes.

The areas for improvement in Sonatype Lifecycle could be the UI. There is way to improve it as it has many tabs and nested sections. Sometimes when you look for something, if you are new to this, it might take you a little to get your head around things. This is something I feel they can simplify.

Also, the policy configuration is powerful, but at the same time, there is a steep learning curve. You need to make sure that you configure it correctly. You do not want to configure it in a way that blocks things.

If they improve the reporting, the UI, and the user experience, it would be beneficial. The design could be improved. If they add certain features and make it simple for the security analyst and to the user as well, it would help. Sometimes you have to look for many things to find a button that does something specific. They can do a good job fixing this.

Also, in the waiver management, it currently does not send notification. If some developer raises a waiver or adds a waiver to some component, we will not be notified. I have to go to the system to find out. This can be improved.

I do not have specific information about how many years I have been aware of Sonatype Lifecycle. Probably since I am aware, maybe four or five years. I could be wrong, but this is as far as I remember.

It is very, very stable. I hardly had any issue with it going down or something.

I think it is scalable, but being costly will make you revise what you want to do. If you have an expensive tool, you want it to work the bare minimum to cover the environment. It covers all our environment. I do not see any problem with the scalability.

I would give the same support rating for Sonatype Lifecycle as previous products. They are the same people.

I have not used or compared Sonatype Lifecycle to any similar products. Maybe there were tools in the past, but I was not here. This is the only thing I know.

We did not run the installers ourselves for the installation and deployment process of Sonatype Lifecycle. We are two teams and we have another team who do the administration, the installation, and the patching. We are more from the security side. We are the policy administrators. Another team handles the installation and setup. I am not aware of any problems. We have the support from the vendor themselves, and sometimes if they need help, they get the help.

Some developers did integrate Sonatype Lifecycle with CI/CD tools, but I am not aware of the details. I know they tried something. We use Azure DevOps mainly.

I really do not know how to quantify time or money savings from using Sonatype Lifecycle. For me to answer this, I need to be aware of everything. There are some savings, but I do not know how much. I cannot state it.

It is expensive. It is one of the pricier SCA tools in the market. You license their developer application, and it can be expensive at scale. If you want to scale, you just need to pay more. For us, we have the IQ Server and we have the firewall, which is already another separate license. So to have all together, it is an expensive environment to run, honestly speaking. If they can do something about that, it would be beneficial.

Automation of policy enforcement impacts my development process. You can build it in a way that stops the CI/CD itself if a library has a vulnerability or certain severity. You can be specific about things that stop the pipeline or if it has vulnerabilities or certain conditions. This helps a lot for creating security policies around applications.

Component health is very important. We can always see the health of the open-source component. It shows if it is vulnerable or not, what is the severity, is it banned, is it standard, is it not standard. The health is the same as when you say severity of something. Is it okay to be used or not?

I gave this product a review rating of 8 out of 10. Although Sonatype Lifecycle is one of the most expensive solutions at a rating of 10 for cost, it is worth the investment in certain areas. The time savings is significant because it allows the CI/CD to be more productive. Security adds complexity to development. If you develop alone, that would be different than developing with security in mind. This will ease the part of security because not everyone is aware of all security. Sometimes developers may know how to code, but they do not know how to code securely. This will save them time and provide hints and alarms. It speeds the process of adopting to security and adopting to DevSecOps. It also protects the environment because you sometimes pay for something that is valuable to secure it. In these areas, it is worth the buying, although it is costly.

I have used Sonatype Lifecycle for one year, primarily as a part of DevSecOps and software composition analysis initiatives focused on my application security project, which involves identifying and managing open-source dependencies risks within application environments.

For Sonatype Lifecycle, I actually use it for two purposes in application security: security composition analysis (SCA) and Static Application Security Testing (SAST), with the intention to identify code-level vulnerabilities when developers write any code, allowing me to scan the code, prioritize vulnerabilities, and fix those areas to reduce overall application risks.

Before using Sonatype Lifecycle, I used to get vulnerabilities in the deployment phase, also known as Dynamic Application Security Testing (DAST), but after implementing Sonatype Lifecycle, it adds an additional security layer by allowing me to conduct SAST and SCA scans early in the coding phase, enabling me to prioritize and remediate vulnerabilities as soon as possible, which reduces time and effort.

In my opinion, the strongest feature of Sonatype Lifecycle is its ability to provide continuous visibility and governance over open-source dependencies throughout the software development lifecycle, with the most standout aspect being its effective integration of security directly into DevSecOps workflows instead of treating security as a separate, post-development activity.

The policy-based governance and vulnerable component rejection capabilities are tremendously valuable for my team because they shifted security enforcement earlier in the lifecycle. For example, I configured policies to flag or block builds with open-source components with critical vulnerabilities, and that was impactful when Sonatype Lifecycle detected a high-severity vulnerability during a build process.

Overall, Sonatype Lifecycle has a very positive impact on the organization, particularly in improving software supply chain security and DevSecOps practices, with measurable improvements including earlier detection of vulnerabilities and faster remediation cycles.

I have definitely observed measurable operational improvements after integrating Sonatype Lifecycle into my workflows, highlighted by a noticeable reduction in vulnerable open-source components progressing to production stages, allowing me to remediate them before deployment.

While Sonatype Lifecycle provides strong value for software composition analysis and software supply chain security, one area for improvement is alert prioritization and noise reduction, especially in larger development environments.

The primary area for improvement I mentioned is alert prioritization and noise reduction, in addition to improving dashboard and reporting customization.

I have used Sonatype Lifecycle for one year.

Sonatype Lifecycle is pretty stable and works fine.

In my experience, Sonatype Lifecycle scales well for enterprise DevSecOps and software supply chain security use cases, particularly in environments with multiple development teams and a large number of applications and dependencies.

The customer support for Sonatype Lifecycle is very helpful, and they are technically sound, providing positive feedback.

Before Sonatype Lifecycle, I used a DAST solution called Qualys for application security, and this is my first tool for SAST and SCA scans.

From my point of view, once I introduce Sonatype Lifecycle with the DevSecOps pipeline, it offers automated vulnerability scanning, prioritization, and allows me to focus on risk assessment and remediation, saving me about 40% in time and effort.

If you are working in a DevSecOps or application security project and want to prioritize vulnerabilities early, implementing Sonatype Lifecycle in your project will be helpful in addressing risks before they escalate. I provided this review with a rating of 8.