Sonatype Nexus Lifecycle Pros and Cons

Sonatype Nexus Lifecycle Pros

EdwinKwan
Security Team Lead at Tyro Payments Limited
It scans and gives you a low false-positive count... The reason we picked Lifecycle over the other products is, while the other products were flagging stuff too, they were flagging things that were incorrect. Nexus has low false-positive results, which give us a high confidence factor.
What's really nice about that is it shows a graph of all the versions for that particular component, and it marks out the ones that have a vulnerability and the ones that don't have a vulnerability.
View full review »
Charles Chani
DevSecOps at a financial services firm with 10,001+ employees
When developers are consuming open-source libraries from the internet, it's able to automatically block the ones that are insecure. And it has the ability to make suggestions on the ones they should be using instead.
It's online, which means if a change is made to the Nexus database today, or within the hour, my developers will benefit instantly. The security features are discovered continuously. So if Nexus finds out that a library is no longer safe, they just have to flag it and, automatically, my developers will know.
There is a feature called Continuous Monitoring. As time goes on we'll be able to know whether a platform is still secure or not because of this feature.
View full review »
Devin Duffy
Information Security Specialist at a financial services firm with 1,001-5,000 employees
It has given developers the tools they need to figure out what to build with. We implemented a Slack bot using their data and engineers can query it to find good components. It's been working out very well.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: July 2019.
353,345 professionals have used our research since 2012.
Russell Webster
VP and Sr. Manager at a financial services firm with 1,001-5,000 employees
The data quality is really good. They've got some of the best in the industry as far as that is concerned. As a result, it helps us to resolve problems faster. The visibility of the data, as well as their features that allow us to query and search - and even use it in the development IDE - allow us to remediate and find things faster.
View full review »
Axel Niering
Achitekt at SV Informatik GmbH
The most valuable feature is that I get a quick overview of the libraries that are included in the application, and the issues that are connected with them. I can quickly understand which problems there are from a security point of view or from a licensing point of view. It's quick and very exact.
It was very easy to integrate into our build pipeline, with Jenkins and Nexus Repository as the central product.
View full review »
JavaDevef0ca
Java Development Manager at a government with 10,001+ employees
The way we can define policies and apply those policies selectively across the different applications is valuable. We can define a separate policy for public-facing applications and a separate policy for the internal applications. That is cool.
View full review »
ManojKumar9
Systems Analyst at Thrivent Financial for Lutherans
Among its valuable features, it's easy to handle and easy configure, it's user-friendly, and it's easy to map and integrate.
View full review »
Gus Orologas
Lead IT Security Architect at a transportation company with 10,001+ employees
The application onboarding and policy grandfathering features are good and the solution integrates well with our existing DevOps tools.
View full review »

Sonatype Nexus Lifecycle Cons

EdwinKwan
Security Team Lead at Tyro Payments Limited
We created the Wiki page for each team showing an overview of their outstanding security issues because the Lifecycle reporting interface isn't as intuitive. It is good for people on my team who use it quite often. But for a tech engineer who doesn't interact with it regularly, it's quite confusing.
Another feature they could use is more languages. Sonatype has been mainly a Java shop because they look after Maven Central... But we've slowly been branching out to different languages. They don't cover all of them, and those that they do cover are not as in-depth as we would like them to be.
View full review »
Charles Chani
DevSecOps at a financial services firm with 10,001+ employees
They could do with making more plugins for the more common integration engines out there. Right now, it supports automation engine by Jenkins but it doesn't fully support something like TeamCity.
In terms of features, the reports natively come in as PDF or JSON. They should start thinking of another way to filter their reports. The reporting tool used by most enterprises, like Splunk and Elasticsearch, do not work as well with JSON.
View full review »
Devin Duffy
Information Security Specialist at a financial services firm with 1,001-5,000 employees
Application onboarding is a little bit clunky... Onboarding an application through the GUI is intuitive but it's time-consuming... It's for large organizations with many enrollments that the GUI becomes unfeasible.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: July 2019.
353,345 professionals have used our research since 2012.
Russell Webster
VP and Sr. Manager at a financial services firm with 1,001-5,000 employees
As far as the relationship of, and ease of finding the relationships between, libraries and applications across the whole enterprise goes, it still does that. They could make that a little smoother, although right now it's still pretty good.
View full review »
Axel Niering
Achitekt at SV Informatik GmbH
If there is something which is not in Maven Central, sometimes it is difficult to get the right information because it's not found.
If you look at NPM-based applications, JavaScript, for example, these are only checkable via the build pipeline. You cannot upload the application itself and scan it, as is possible with Java, because a file could change significantly.
View full review »
JavaDevef0ca
Java Development Manager at a government with 10,001+ employees
Since Nexus Repository just keeps on adding the .jar artifacts whenever there is a build, whenever an application is going up, there is always a space issue on the server. That is one of the things that we are looking for Nexus to notify us about: if it is running out of space.
View full review »
ManojKumar9
Systems Analyst at Thrivent Financial for Lutherans
Sometimes we face difficulties with Maven Central... if I'm using the 1.0.0 version, after one or two years, the 1.0.0 version will be gone from Maven Central but our team will still be using that 1.0.0 version to build. When they do builds, it won't build completely because that version is gone from Maven Central. There is a difference in our Sonatype Maven Central.
View full review »
Gus Orologas
Lead IT Security Architect at a transportation company with 10,001+ employees
The biggest thing is getting it put uniformly across all the different teams. It's more of a process issue. The process needs to be thought out about how it's going to be used, what kind of training there will be, how it's going to be socialized, and how it's going to be rolled out and controlled, enterprise-wide. That's probably more of a challenge than the technology itself.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: July 2019.
353,345 professionals have used our research since 2012.
Sign Up with Email