CAST Highlight vs SonarQube comparison

CAST Highlight

Read 5 CAST Highlight reviews

447 Views
312 Comparison Views

100% willing to recommend

SonarQube

Read 112 SonarQube reviews

51,086 Views
40,709 Comparison Views

81% willing to recommend

CAST Highlight

SonarQube

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between CAST Highlight and SonarQube based on real PeerSpot user reviews.

Find out in this report how the two Software Composition Analysis (SCA) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed CAST Highlight vs. SonarQube Report (Updated: September 2022).

Buyer's Guide

CAST Highlight vs. SonarQube

September 2022

Download the complete report

Helped 787,104 peers since 2012

Categories and Ranking

CAST Highlight

Average Rating

7.8

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (13th)

SonarQube

Average Rating

8.0

Number of Reviews

112

Ranking in other categories

Application Security Tools (1st), Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)

Market share comparison

As of June 2024, in the Software Composition Analysis (SCA) category, the market share of CAST Highlight is 0.5% and it decreased by 35.9% compared to the previous year. The market share of SonarQube is 31.5% and it decreased by 26.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Unique Categories:

No other categories found

Application Security Tools

27.7%

Static Application Security Testing (SAST)

31.6%

Featured Reviews

reviewer1997040

Consultant/Software Engineer at EY-Parthenon

Oct 20, 2022

Easy to set up with optimized and automated insights

We get some code insights from CAST. We get insights as to if this or that function has way too many comments or things like that. We would like to backtrace, and understand how dependent that is as per the application. For example, when you are writing code in C Sharp versus writing code in C++, obviously, C++ has more complexities within that. What CAST does is CAST aggregates for different languages, and if they could provide us inputs for each of these languages separately, then that'd be great. When they classify code between their own code and third-party code, they classify it based on the number of files, and not really the number of lines. I'm not sure how extensive of a change this is on their end; however, it would be nice if they could tell us the number of lines of code that are not theirs. There's a bit of a learning curve at the outset. We have come across bugs occasionally. Technical support could be better.

Read full review

BudiSetiawan

IT Developer at PT Oto Multiartha

Dec 21, 2023

This solution is simple to use and can be quickly deployed

We use SonarQube to check for vulnerabilities and quality. The solution has helped us to find flaws in the Syntax and comply with requirements. I have found the most valuable features to be scanning for bugs or fixing the hotspot. These features have helped to improve the code quality. I…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"CAST Highlight is easy to use and has a good dashboard."

"It offers good performance."

"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."

"The most valuable features of CAST Highlight are automation and speed."

"The most valuable features of the CAST Highlight are the interface and there are three notations that are very simple to understand and communicate with."

"The good thing with SonarQube is it covers a lot of issues, it's a very robust framework."

"This solution has helped with the integration and building of our CICD pipeline."

"The most valuable function is its usability."

"The most valuable features are code scanning and Quality Gates."

"The solution has a plug-in that supports both C and C++ languages."

"SonarQube is designed well making it easy to use, simple to identify issues and find solutions to problems."

"The solution can verify vulnerabilities, code smells, and hotspots. It makes the software more secure and it helps make a junior or novice developer sharper."

"It's a great product. If you are in a hurry and just want to focus on the functional requirements of any kind of project, SonarQube is highly helpful. It enables the developers to code securely. SonarQube has a Community edition, which is open source and free. There are also three proprietary or paid versions: Enterprise edition, Data Center edition, and Developer edition."

More SonarQube pros

Cons

"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."

"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."

"The ease of configuration and customization could be improved in CAST Highlight."

"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."

"There's a bit of a learning curve at the outset."

"There could be better integration with other products."

"Ease of use/interface."

"Currently requires multiple tools, lacking one overall tool."

"New plug-ins should be integrated into SonarCloud to give more flexibility to the product."

"Code security could be better. They are already focusing on it, but I see a lot of improvement opportunities over there. I can see a lot of false positives in terms of security. They need to make the tests more accurate so that the false positives are not detected so frequently. It would also help if they provided us with an installer."

"SonarQube needs to improve its support model. They do not work 24/7, and they do not provide weekend support in case things go wrong. They only have a standard 8:00 am to 5:00 pm support model in which you have to raise a support ticket and wait. The support model is not effective for premium customers."

"There are times that we have the database crash. However, this might be an issue with how we have configured it and not a software issue. Apart from this, I do not see any issues with the solution."

"I am not very pleased with the technical debt computation."

More SonarQube cons

Pricing and Cost Advice

"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."

"CAST Highlight is an expensive solution."

"It is a pretty costly tool. A lot of customers are resistant to using it."

"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."

"We have a license with 125,000 lines of code. We did not purchase a lot of lines but it is specific to our code environment."

"SonarQube is an open-source product that can be used free of charge."

"The licence is standard open source licensing"

"We are using the Developer Edition and the cost is based on the amount of code that is being processed."

"I do not know about the pricing as I am using the community edition, which is free. But I compared the pricing with Sigma, and it is higher than SonarQube."

"It is very expensive. Its price should be improved."

"The tool's pricing is reasonable."

"We are using the Community edition of SonarQube."

More SonarQube pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

787,104 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

19%

Computer Software Company

16%

Insurance Company

10%

Manufacturing Company

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

12%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

What do you like most about CAST Highlight?

The most valuable features of CAST Highlight are automation and speed.

See all answers

What is your experience regarding pricing and costs for CAST Highlight?

CAST Highlight is an expensive solution. On a scale from one to ten, where one is cheap, and ten is expensive, I rate the solution's pricing an eight or nine out of ten.

See all answers

What needs improvement with CAST Highlight?

The ease of configuration and customization could be improved in CAST Highlight.

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

Comparisons

Snyk vs CAST Highlight

Compared 5% of the time

Veracode vs CAST Highlight

Compared 5% of the time

Black Duck vs CAST Highlight

Compared 5% of the time

Checkmarx One vs CAST Highlight

Compared 5% of the time

Sonatype Lifecycle vs CAST Highlight

Compared 3% of the time

More CAST Highlight Competitors

Checkmarx One vs SonarQube

Compared 21% of the time

SonarCloud vs SonarQube

Compared 13% of the time

Coverity vs SonarQube

Compared 11% of the time

Veracode vs SonarQube

Compared 10% of the time

CodeSonar vs SonarQube

Compared 2% of the time

More SonarQube Competitors

Product Reports

Buyer's Guide

CAST Highlight

June 2024

Download CAST Highlight product report

Buyer's Guide

SonarQube

May 2024

Download SonarQube product report

Also Known As

No data available

Sonar

Learn More

CAST

Sonar

Interactive Demo

Demo not available

CAST

Sonar

Overview

CAST Highlight is a SaaS software intelligence product for performing rapid application portfolio analysis. It automatically analyzes source code of hundreds of applications in a week for Cloud Readiness, Software Composition Analysis (Open Source risks), Resiliency, and Technical Debt. Objective software insights from automated source code analysis combined with built-in qualitative surveys for business context enable more informed decision-making about application portfolios.

CAST is the software intelligence category leader. CAST technology can see inside custom applications with MRI-like precision, automatically generating intelligence about their inner workings - composition, architecture, transaction flows, cloud readiness, structural flaws, legal and security risks. It’s becoming essential for faster modernization for cloud, raising the speed and efficiency of Software Engineering, better open source risk control, and accurate technical due diligence. CAST operates globally with offices in North America, Europe, India, China. Visit www.castsoftware.com.

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF

Buyer's Guide

CAST Highlight vs. SonarQube

September 2022

Free Report: CAST Highlight vs. SonarQube

Find out what your peers are saying about CAST Highlight vs. SonarQube and other solutions. Updated: September 2022.

DOWNLOAD NOW

787,104 professionals have used our research since 2012.

See our CAST Highlight vs. SonarQube report.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.