Sold by: Sonar
Enterprise SAST and SCA add-on for SonarQube - catch CVEs, malicious packages, and license risk in first-party and open-source code.
Overview
Requires SonarQube Server Enterprise edition or SonarQube Cloud Team/Enterprise plan; not sold as a standalone deployment.
SonarQube Advanced Security is an Enterprise add-on that extends SonarQube's core code analysis with Software Composition Analysis (SCA) and Advanced SAST. It gives teams a single platform to verify first-party code, AI-generated code, and open-source dependencies against the same quality and security bar.
SCA identifies known vulnerabilities (CVE) in direct and transitive dependencies, prioritized by severity (CVSS) and exploitability (EPSS, CISA KEV); detects malicious and compromised packages before they reach a build; enforces license compliance policies; and generates SBOMs (CycloneDX and SPDX) for every project. Advanced SAST extends deep taint analysis across the boundary into third-party libraries, uncovering vulnerabilities that arise specifically from how first-party code interacts with open-source dependencies - coverage that first-party-only SAST tools miss.
Built-in compliance reporting covers OWASP Top 10, OWASP ASVS, PCI DSS, STIG, CASA, and CWE Top 25, and results surface directly in existing PR and CI/CD workflows (GitHub, GitLab, Bitbucket, Azure DevOps), so security findings reach developers where they already work, not in a separate console.
Key capabilities:
- Dependency CVE detection, prioritized by CVSS severity and EPSS/KEV exploitability
- Malicious/compromised package detection in CI/CD
- License detection, policy enforcement, and compatibility checks
- SBOM generation (CycloneDX, SPDX)
- Advanced SAST - dependency-aware taint analysis (Java, C#/.NET, JavaScript/TypeScript)
- Dependency analysis coverage: JS/TS, Java/Kotlin/Scala, Python, C#/.NET, Go, Ruby, Rust, PHP
- Compliance reports: OWASP Top 10, OWASP ASVS, PCI DSS, STIG, CASA, CWE Top 25
- Native CI/CD and PR workflow integration (GitHub, GitLab, Bitbucket, Azure DevOps)
Highlights
- Extends security coverage from first-party code into open-source dependencies - CVEs, malicious packages, and license risk in one platform
- Advanced SAST traces data flow across the boundary into third-party libraries, catching vulnerabilities first-party-only scanners miss
- Built-in compliance reporting (OWASP, PCI DSS, STIG, CWE Top 25) plus SBOM export, no separate tooling required
Details
Sold by
Delivery method
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Trust Center
Access real-time vendor security and compliance information through their Trust Center powered by Drata or Vanta. Review certifications and security standards before purchase.
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
1M LOC-SQS | SQAS for SQS - 1M Lines of Code | $17,600.00 |
5M LOC-SQS | SQAS for SQS - 5M Lines of Code | $65,000.00 |
10M LOC-SQS | SQAS for SQS - 10M Lines of Code | $96,500.00 |
20M LOC-SQS | SQAS for SQS - 20M Lines of Code | $186,000.00 |
30M LOC-SQS | SQAS for SQS - 30M Lines of Code | $276,000.00 |
50M LOC-SQS | SQAS for SQS - 50M Lines of Code | $425,000.00 |
75M LOC-SQS | SQAS for SQS - 75M Lines of Code | $617,500.00 |
100M LOC-SQS | SQAS for SQS - 100M Lines of Code | $797,500.00 |
150M LOC-SQS | SQAS for SQS - 150M Lines of Code | $1,333,500.00 |
250M LOC-SQS | SQAS for SQS - 250M Lines of Code | $2,152,500.00 |
Dimensions summary
You buy SonarQube Advanced Security as a yearly contract priced by lines of code (LOC) analyzed. Options split into three product groups: SQS, SQCE, and SCT. Within each group, you pick a LOC tier that matches your codebase size. SQS tiers run from 1M up to 1B LOC. SQCE tiers run from 1M up to 500M LOC. SCT tiers run from 100K up to 1.9M LOC, in finer steps. You pick one tier per group. Larger LOC tiers cover bigger codebases. Choose the group and size that fit your projects.
Top-of-mind questions for buyers
LOC counts sum the lines across each private project you analyze. If a project has branches, only the largest branch counts. Analysis frequency does not change the count. A project with 6K LOC analyzed 100 times still counts as 6K toward your tier.
You pick a tier that covers your maximum private LOC upfront. As you near the threshold, you are notified to move to a larger LOC tier or reduce the lines in your projects. The change is not automatic; you select the tier that fits.
All groups deliver Advanced Security features: software composition analysis for open source dependencies, malicious package detection, license management, SBOM export, and dependency-aware taint analysis. The groups differ by which SonarQube deployment they attach to and the LOC ranges offered, not by the security features included.
www.sonarsource.com+1
Helpful?
Vendor refund policy
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Software as a Service (SaaS)
SaaS delivers cloud-based software applications directly to customers over the internet. You can access these applications through a subscription model. You will pay recurring monthly usage fees through your AWS bill, while AWS handles deployment and infrastructure management, ensuring scalability, reliability, and seamless integration with other AWS services.
Resources
Vendor resources
Support
Vendor support
If you need help with our solutions, you can seek support from our Community and our Commercial Support. Community Support is a collaborative forum where SonarSourcers and community users post every day. It contains detailed articles and technical discussions that cover the most common usages. Community Support: community@sonarsource.com and cloud-partnerships@sonarsource.com Commercial Support is a private communication channel between you and our Services team. It can be used to solve advanced issues and get the guidance you need for the implementation of our products in complex corporate environments. The privacy of this channel also eases the resolution of problems that require sharing sensitive information. Commercial Support:Sales Support Squad sales.support@sonarsource.com and cloud-partnerships@sonarsource.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
SonarQube Server is the self-managed edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates directly with DevOps platforms and AI coding tools in CI/CD pipelines to automatically verify developer-written, third-party, and AI-generated code, helping teams reduce outages, improve security, and lower risk.
For questions about private offers, pricing, plans and options, or other products such as SonarQube Cloud, please contact your Sonar representative at www.sonarsource.com/company/contact.
SonarQube Cloud is the fully managed, cloud-based edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates easily with popular DevOps platforms, delivering real-time security and quality verification to help teams reduce outages, improve security, and lower risk.
SonarQube Cloud is the fully managed, cloud-based edition of the SonarQube platform, the industry standard for code verification and automated code review. It integrates easily with popular DevOps platforms, delivering real-time security and quality verification to help teams reduce outages, improve security, and lower risk.
This product includes SonarQube CE an open-source platform for continuous inspection of code quality. With SonarQube you can perform automatic reviews with static analysis of code to detect bugs, coding standards violations, unit test coverage, code complexity, comments, etc.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.