Compare Sonatype Nexus Firewall vs. Sonatype Nexus Lifecycle

Cancel
You must select at least 2 products to compare!
Most Helpful Review
Find out what your peers are saying about SonarSource, Veracode, Checkmarx and others in Application Security. Updated: April 2021.
476,892 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
"We are using the Veracode tools to expose the engineers to the security vulnerabilities that were introduced with the new features, i.e. a lot faster or sooner in the development life cycle.""The most valuable feature comes from the fact that it is cloud-based, and I can scale up without having to worry about any other infrastructure needs.""I have used this solution in multiple projects for vulnerability testing and finding security leaks within the code.""We used it for performing security checks. We have many Java applications and Android applications. Essentially it was used for checking the security validations for compliance purposes.""Veracode is a valuable tool in our secure SDLC process.""Integrations into our developer's IDE (Greenlight) and the DevOps Pipeline SAST / SourceClear Integrations has particularly increased our time to market and confidence.""The source composition analysis component is great because it gives our developers some comfort in using new libraries.""Veracode's cloud-based approach, coupled with the appliance that lets us use Veracode to scan internal-only web applications, has provided a seamless, always-up-to-date application security scanning solution."

More Veracode Pros »

"Another thing that I like about Sonatype is that if you download something today, and five days from today it becomes vulnerable, it will notify you."

More Sonatype Nexus Firewall Pros »

"The way we can define policies and apply those policies selectively across the different applications is valuable. We can define a separate policy for public-facing applications and a separate policy for the internal applications. That is cool.""The dashboard is usable and gives us clear visibility into what is happening. It also has a very cool feature, which allows us to see the clean version available to be downloaded. Therefore, it is very easy to go and trace which version of the component does not have any issues. The dashboard can be practical, as well. It can wave a particular version of a Java file or component. It can even grandfather certain components, because in a real world scenarios we cannot always take the time to go and update something because it's not backward compatible. Having these features make it a lot easier to use and more practical. It allows us to apply the security, without having an all or nothing approach.""The grandfathering mode allows us to add legacy applications which we know we're not going to change or refactor for some time. New developments can be scanned separately and we can obviously resolve those vulnerabilities where there are new applications developed. The grandfathering is a good way to separate what can be factored now, versus long-term technical debt.""The key feature for Nexus Lifecycle is the proprietary data they have on vulnerabilities. The way that they combine all the different sources and also their own research into one concise article that clearly explains what the problem is. Most of the time, and even if you do notice that you have a problem, the public information available is pretty weak. So, if we want to assess if a problem applies to our product, it's really hard. We need to invest a lot of time digging into the problem. This work is basically done by Sonatype for us. The data that it delivers helps us with fixing or understanding the issue a lot quicker than without it.""The integration of Lifecycle is really good with Jenkins and GitHub; those work very well. We've been able to get it to work seamlessly with them so that it runs on every build that we have.""For us, it's seeing not only the licensing and security vulnerabilities but also seeing the age of the open-sources included within our software. That allows us to take proactive steps to make sure we're updating the software to versions that are regularly maintained and that don't have any vulnerabilities.""The proxy repository is probably the most valuable feature to us because it allows us to be more proactive in our builds. We're no longer tied to saving components to our repository.""The REST API is the most useful for us because it allows us to drive it remotely and, ideally, to automate it."

More Sonatype Nexus Lifecycle Pros »

Cons
"Veracode should make it easier to navigate between the solutions that they offer, i.e. between dynamic, static, and the source code analysis.""I would like to see expanded coverage for supporting more platforms, frameworks, and languages.""Ideally, I would like better reporting that gives me a more concise and accurate description of what my pain points are, and how to get to them.""One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications.""It needs better controls to include/exclude specific sections when creating a report that can be shared externally with customers and prospects.""Improve Mobile Application Dynamic Scanning DAST - .ipa and .apk""I think for us the biggest improvement would be to have an indicator when there's something wrong with a scan.""One feature I would like would be more selectivity in email alerts. While I like getting these, I would like to be able to be more granular in which ones I receive."

More Veracode Cons »

"What I don't like is the lack of an option to pick up the phone and call someone for support. That is something they need to improve on. They need to have a professional services package, or they need to include that option with their services."

More Sonatype Nexus Firewall Cons »

"Since Nexus Repository just keeps on adding the .jar artifacts whenever there is a build, whenever an application is going up, there is always a space issue on the server. That is one of the things that we are looking for Nexus to notify us about: if it is running out of space.""We use Griddle a lot for integrating into our local builds with the IDE, which is another built system. There is not a lot of support for it nor published modules that can be readily used. So, we had to create our own. No Griddle plugins have been released.""If they had a more comprehensive online tutorial base, both for admin and developers, that would help. It would be good if they actually ran through some scenarios, regarding what happens if I do pick up a vulnerability. How do I fork out into the various decisions? If the vulnerability is not of a severe nature, can I just go ahead with it until it becomes severe? This is important because, obviously, business demands certain deliverables to be ready at a certain time.""The GUI is simple, so it's easy to use. It started as great to use, but for larger scale companies, it also comes with some limitations. This is why we tried to move to more of an API approach. So, the GUI could use some improvements potentially.""We had some issues, and I think we might still have some issues, where the Sonatype Nexus Repository has integrations with IQ and SonarQube. We're getting some errors on the UI, so we've had Sonatype look into that a little bit.""We use Azure DevOps as our application lifecycle management tool. It doesn't integrate with that as well as it does with other tools at the moment, but I think there's work being done to address that. In terms of IDEs, it integrates well. We would like to integrate it into our Azure cloud deployment but the integration with Azure Active Directory isn't quite as slick as we would like it to be. We have to do some workarounds for that at the moment.""It would be helpful if it had a more detailed view of what has been quarantined, for people who don't have Lifecycle licenses. Other than that, it's pretty good.""We do not use it for more because it is still too immature, not quite "finished." It is missing important features for making it a daily tool. It's not complete, from my point of view..."

More Sonatype Nexus Lifecycle Cons »

Pricing and Cost Advice
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works.""They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey.""For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization.""I don't really know about the pricing, but I'd say it's worth whatever Veracode is charging, because the solution is that good.""Veracode's price is high. I would like them to better optimize their pricing.""If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount.""Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive.""We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive."

More Veracode Pricing and Cost Advice »

"The pricing is reasonable if you're a large enterprise developing code. It's not super-expensive."

More Sonatype Nexus Firewall Pricing and Cost Advice »

"Pricing is comparable with some of the other products. We are happy with the pricing.""The price is good. We certainly get a lot more in return. However, it's also hard to get the funds to roll out such a product for the entire firm. Therefore, pricing has been a limiting factor for us. However, it's a fair price.""The license fee may be a bit harder for startups to justify. But it will save you a headache later as well as peace of mind. Additionally, it shows your own customers that you value security stuff and will protect yourselves from any licensing issues, which is good marketing too.""In addition to the license fee for IQ Server, you have to factor in some running costs. We use AWS, so we spun up an additional VM to run this. If the database is RDS that adds a little bit extra too. Of course someone could run it on a pre-existing VM or physical server to reduce costs. I should add that compared to the license fee, the running costs are so minimal they had no effect on our decision to use IQ Server.""Pricing is decent. It's not horrible. It's middle-of-the-road, as far as our ranking goes. They're a little bit more but that's also because they provide more.""Lifecycle, to the best of my recollection, had the best pricing compared with other solutions.""Cost is a drawback. It's somewhat costly.""It's expensive, but you get what you pay for. There were no problems with the base license and how they do it. It was transparent. You don't have to worry. You can scan to your heart's delight."

More Sonatype Nexus Lifecycle Pricing and Cost Advice »

report
Use our free recommendation engine to learn which Application Security solutions are best for your needs.
476,892 professionals have used our research since 2012.
Questions from the Community
Top Answer: My experience with Veracode across the board every time, in all products, the technology, the product, the service, and… more »
Top Answer: Veracode has offered a dynamic analysis testing solution for several years, having launched our first offering in 2015… more »
Top Answer: I would recommend them. They have the ability to cover multiple languages and come with all the features you would… more »
Top Answer: Another thing that I like about Sonatype is that if you download something today, and five days from today it becomes… more »
Top Answer: The pricing is reasonable if you're a large enterprise developing code. It's not super-expensive. There are no costs in… more »
Top Answer: With the security concerns around open source, the management and vulnerability scanning, it's relatively new. In… more »
Top Answer: The component piece, where you can analyze the component, is the most valuable. You can pull the component up and you… more »
Top Answer: I'm not familiar with the pricing in detail, but I believe it was pretty reasonably priced, compared to the market.
Top Answer: One thing that it is lacking, one thing I don't like, is that when you label something or add a status to it, you do it… more »
Popular Comparisons
Also Known As
Nexus Firewall
Nexus Lifecycle
Learn More
Overview

Veracode covers all your Application Security needs in one solution through a combination of five analysis types; static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline, and empowers developers to find and fix security defects.

Nexus Firewall is a perimeter quality control for software development. Similar to a network firewall, it leverages rules you define that automatically shield you from unacceptable software components entering and another set for stopping them from exiting your application development.

Nexus Lifecycle gives you full control over your software supply chain and allows you to define rules, actions, and policies that work best for your organization and teams.

Offer
Learn more about Veracode
Learn more about Sonatype Nexus Firewall
Learn more about Sonatype Nexus Lifecycle
Sample Customers
State of Missouri, Rekner
EDF, Tomitribe, Crosskey, Blackboard, Travel audience
Genome.One, Blackboard, Crediterform, Crosskey, Intuit, Progress Software, Qualys, Liberty Mutual Insurance
Top Industries
REVIEWERS
Financial Services Firm30%
Insurance Company10%
Computer Software Company10%
Healthcare Company8%
VISITORS READING REVIEWS
Computer Software Company32%
Comms Service Provider16%
Financial Services Firm10%
Manufacturing Company6%
VISITORS READING REVIEWS
Computer Software Company23%
Comms Service Provider20%
Financial Services Firm10%
Insurance Company9%
REVIEWERS
Financial Services Firm33%
Insurance Company19%
Manufacturing Company10%
Computer Software Company10%
VISITORS READING REVIEWS
Computer Software Company28%
Financial Services Firm16%
Comms Service Provider12%
Insurance Company7%
Company Size
REVIEWERS
Small Business23%
Midsize Enterprise26%
Large Enterprise51%
VISITORS READING REVIEWS
Small Business22%
Midsize Enterprise29%
Large Enterprise48%
No Data Available
REVIEWERS
Small Business26%
Midsize Enterprise19%
Large Enterprise56%
VISITORS READING REVIEWS
Small Business34%
Midsize Enterprise16%
Large Enterprise51%
Find out what your peers are saying about SonarSource, Veracode, Checkmarx and others in Application Security. Updated: April 2021.
476,892 professionals have used our research since 2012.

Sonatype Nexus Firewall is ranked 19th in Application Security with 1 review while Sonatype Nexus Lifecycle is ranked 4th in Application Security with 18 reviews. Sonatype Nexus Firewall is rated 8.0, while Sonatype Nexus Lifecycle is rated 8.6. The top reviewer of Sonatype Nexus Firewall writes "Significantly decreases our time to market for secure apps by automating open source approval". On the other hand, the top reviewer of Sonatype Nexus Lifecycle writes "Checks our libraries for security and licensing issues". Sonatype Nexus Firewall is most compared with JFrog Xray, Black Duck, Snyk, Checkmarx and HCL AppScan, whereas Sonatype Nexus Lifecycle is most compared with SonarQube, Black Duck, WhiteSource, JFrog Xray and Snyk.

See our list of best Application Security vendors and best Software Composition Analysis (SCA) vendors.

We monitor all Application Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.