Sold by: Sonar
Enterprise SAST and SCA add-on for SonarQube - catch CVEs, malicious packages, and license risk in first-party and open-source code.
Overview
Requires SonarQube Server Enterprise edition or SonarQube Cloud Team/Enterprise plan; not sold as a standalone deployment.
SonarQube Advanced Security is an Enterprise add-on that extends SonarQube's core code analysis with Software Composition Analysis (SCA) and Advanced SAST. It gives teams a single platform to verify first-party code, AI-generated code, and open-source dependencies against the same quality and security bar.
SCA identifies known vulnerabilities (CVE) in direct and transitive dependencies, prioritized by severity (CVSS) and exploitability (EPSS, CISA KEV); detects malicious and compromised packages before they reach a build; enforces license compliance policies; and generates SBOMs (CycloneDX and SPDX) for every project. Advanced SAST extends deep taint analysis across the boundary into third-party libraries, uncovering vulnerabilities that arise specifically from how first-party code interacts with open-source dependencies - coverage that first-party-only SAST tools miss.
Built-in compliance reporting covers OWASP Top 10, OWASP ASVS, PCI DSS, STIG, CASA, and CWE Top 25, and results surface directly in existing PR and CI/CD workflows (GitHub, GitLab, Bitbucket, Azure DevOps), so security findings reach developers where they already work, not in a separate console.
Key capabilities:
- Dependency CVE detection, prioritized by CVSS severity and EPSS/KEV exploitability
- Malicious/compromised package detection in CI/CD
- License detection, policy enforcement, and compatibility checks
- SBOM generation (CycloneDX, SPDX)
- Advanced SAST - dependency-aware taint analysis (Java, C#/.NET, JavaScript/TypeScript)
- Dependency analysis coverage: JS/TS, Java/Kotlin/Scala, Python, C#/.NET, Go, Ruby, Rust, PHP
- Compliance reports: OWASP Top 10, OWASP ASVS, PCI DSS, STIG, CASA, CWE Top 25
- Native CI/CD and PR workflow integration (GitHub, GitLab, Bitbucket, Azure DevOps)
Highlights
- Extends security coverage from first-party code into open-source dependencies - CVEs, malicious packages, and license risk in one platform
- Advanced SAST traces data flow across the boundary into third-party libraries, catching vulnerabilities first-party-only scanners miss
- Built-in compliance reporting (OWASP, PCI DSS, STIG, CWE Top 25) plus SBOM export, no separate tooling required
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
1M LOC-SQS | SQAS for SQS - 1M Lines of Code | $17,600.00 |
5M LOC-SQS | SQAS for SQS - 5M Lines of Code | $65,000.00 |
10M LOC-SQS | SQAS for SQS - 10M Lines of Code | $96,500.00 |
20M LOC-SQS | SQAS for SQS - 20M Lines of Code | $186,000.00 |
30M LOC-SQS | SQAS for SQS - 30M Lines of Code | $276,000.00 |
50M LOC-SQS | SQAS for SQS - 50M Lines of Code | $425,000.00 |
75M LOC-SQS | SQAS for SQS - 75M Lines of Code | $617,500.00 |
100M LOC-SQS | SQAS for SQS - 100M Lines of Code | $797,500.00 |
150M LOC-SQS | SQAS for SQS - 150M Lines of Code | $1,333,500.00 |
250M LOC-SQS | SQAS for SQS - 250M Lines of Code | $2,152,500.00 |
Dimensions summary
You buy SonarQube Advanced Security as a contract priced by lines of code (LOC) analyzed. The 12 dimensions form a single scale, from 1 million LOC up to 1 billion LOC. Each dimension covers a set LOC capacity for your private projects. You pick the tier that matches the size of your codebase. As your code volume grows, you move to a higher LOC tier. All tiers deliver the same software composition analysis and advanced SAST capabilities; only the covered code volume changes.
Top-of-mind questions for buyers
LOC counts the sum of lines across the private projects you analyze. Only your largest branch counts per project. The count does not depend on how often you scan; a project of one size counts the same whether analyzed once or many times monthly.
You move up to a higher LOC tier that covers your larger volume. Sonar notifies you as you approach your threshold so you can select the tier matching your code size. Each tier covers a set capacity, so the change is a manual move to the next level.
Every tier includes software composition analysis and advanced SAST. You get CVE detection in open source dependencies, malicious package detection, license policy management, software bill of materials export, and dependency-aware taint analysis that traces data flow into third-party libraries. Only the covered code volume changes across tiers.
www.sonarsource.com+1
Helpful?
Vendor refund policy
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
If you need help with our solutions, you can seek support from our Community and our Commercial Support. Community Support is a collaborative forum where SonarSourcers and community users post every day. It contains detailed articles and technical discussions that cover the most common usages. Community Support: community@sonarsource.com and cloud-partnerships@sonarsource.com Commercial Support is a private communication channel between you and our Services team. It can be used to solve advanced issues and get the guidance you need for the implementation of our products in complex corporate environments. The privacy of this channel also eases the resolution of problems that require sharing sensitive information. Commercial Support:Sales Support Squad sales.support@sonarsource.com and cloud-partnerships@sonarsource.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
SonarQube Cloud is the fully managed, cloud-based edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates easily with popular DevOps platforms, delivering real-time security and quality verification to help teams reduce outages, improve security, and lower risk.
SonarQube Server is the self-managed edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates directly with DevOps platforms and AI coding tools in CI/CD pipelines to automatically verify developer-written, third-party, and AI-generated code, helping teams reduce outages, improve security, and lower risk.
For questions about private offers, pricing, plans and options, or other products such as SonarQube Cloud, please contact your Sonar representative at www.sonarsource.com/company/contact.
This product has charges associated with it for seller support. Simple, Secure and Supported deployment with the Hossted CLI, for easy self-maintenance.
SonarQube Cloud is the fully managed, cloud-based edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates easily with popular DevOps platforms, delivering real-time security and quality verification to help teams reduce outages, improve security, and lower risk.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.