Sonatype Nexus Lifecycle Pros and Cons

Sonatype Nexus Lifecycle Pros

EdwinKwan
Security Team Lead at Tyro Payments Limited
It scans and gives you a low false-positive count... The reason we picked Lifecycle over the other products is, while the other products were flagging stuff too, they were flagging things that were incorrect. Nexus has low false-positive results, which give us a high confidence factor.
What's really nice about that is it shows a graph of all the versions for that particular component, and it marks out the ones that have a vulnerability and the ones that don't have a vulnerability.
View full review »
ConfigManag73548
Configuration Manager at a health, wellness and fitness company with 5,001-10,000 employees
The grandfathering mode allows us to add legacy applications which we know we're not going to change or refactor for some time. New developments can be scanned separately and we can obviously resolve those vulnerabilities where there are new applications developed. The grandfathering is a good way to separate what can be factored now, versus long-term technical debt.
View full review »
Charles Chani
DevSecOps at a financial services firm with 10,001+ employees
When developers are consuming open-source libraries from the internet, it's able to automatically block the ones that are insecure. And it has the ability to make suggestions on the ones they should be using instead.
It's online, which means if a change is made to the Nexus database today, or within the hour, my developers will benefit instantly. The security features are discovered continuously. So if Nexus finds out that a library is no longer safe, they just have to flag it and, automatically, my developers will know.
There is a feature called Continuous Monitoring. As time goes on we'll be able to know whether a platform is still secure or not because of this feature.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: October 2019.
382,547 professionals have used our research since 2012.
Devin Duffy
Information Security Specialist at a financial services firm with 1,001-5,000 employees
It has given developers the tools they need to figure out what to build with. We implemented a Slack bot using their data and engineers can query it to find good components. It's been working out very well.
View full review »
Russell Webster
VP and Sr. Manager at a financial services firm with 1,001-5,000 employees
The data quality is really good. They've got some of the best in the industry as far as that is concerned. As a result, it helps us to resolve problems faster. The visibility of the data, as well as their features that allow us to query and search - and even use it in the development IDE - allow us to remediate and find things faster.
View full review »
SrLeadSo5b76
Sr Lead Solution Services at a financial services firm with 201-500 employees
The dashboard is usable and gives us clear visibility into what is happening. It also has a very cool feature, which allows us to see the clean version available to be downloaded. Therefore, it is very easy to go and trace which version of the component does not have any issues. The dashboard can be practical, as well. It can wave a particular version of a Java file or component. It can even grandfather certain components, because in a real world scenarios we cannot always take the time to go and update something because it's not backward compatible. Having these features make it a lot easier to use and more practical. It allows us to apply the security, without having an all or nothing approach.
View full review »
Axel Niering
Achitekt at SV Informatik GmbH
The most valuable feature is that I get a quick overview of the libraries that are included in the application, and the issues that are connected with them. I can quickly understand which problems there are from a security point of view or from a licensing point of view. It's quick and very exact.
It was very easy to integrate into our build pipeline, with Jenkins and Nexus Repository as the central product.
View full review »
JavaDevef0ca
Java Development Manager at a government with 10,001+ employees
The way we can define policies and apply those policies selectively across the different applications is valuable. We can define a separate policy for public-facing applications and a separate policy for the internal applications. That is cool.
View full review »
ManojKumar9
Systems Analyst at Thrivent Financial for Lutherans
Among its valuable features, it's easy to handle and easy configure, it's user-friendly, and it's easy to map and integrate.
View full review »
Gus Orologas
Lead IT Security Architect at a transportation company with 10,001+ employees
The application onboarding and policy grandfathering features are good and the solution integrates well with our existing DevOps tools.
View full review »

Sonatype Nexus Lifecycle Cons

EdwinKwan
Security Team Lead at Tyro Payments Limited
We created the Wiki page for each team showing an overview of their outstanding security issues because the Lifecycle reporting interface isn't as intuitive. It is good for people on my team who use it quite often. But for a tech engineer who doesn't interact with it regularly, it's quite confusing.
Another feature they could use is more languages. Sonatype has been mainly a Java shop because they look after Maven Central... But we've slowly been branching out to different languages. They don't cover all of them, and those that they do cover are not as in-depth as we would like them to be.
View full review »
ConfigManag73548
Configuration Manager at a health, wellness and fitness company with 5,001-10,000 employees
If they had a more comprehensive online tutorial base, both for admin and developers, that would help. It would be good if they actually ran through some scenarios, regarding what happens if I do pick up a vulnerability. How do I fork out into the various decisions? If the vulnerability is not of a severe nature, can I just go ahead with it until it becomes severe? This is important because, obviously, business demands certain deliverables to be ready at a certain time.
View full review »
Charles Chani
DevSecOps at a financial services firm with 10,001+ employees
They could do with making more plugins for the more common integration engines out there. Right now, it supports automation engine by Jenkins but it doesn't fully support something like TeamCity.
In terms of features, the reports natively come in as PDF or JSON. They should start thinking of another way to filter their reports. The reporting tool used by most enterprises, like Splunk and Elasticsearch, do not work as well with JSON.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: October 2019.
382,547 professionals have used our research since 2012.
Devin Duffy
Information Security Specialist at a financial services firm with 1,001-5,000 employees
Application onboarding is a little bit clunky... Onboarding an application through the GUI is intuitive but it's time-consuming... It's for large organizations with many enrollments that the GUI becomes unfeasible.
View full review »
Russell Webster
VP and Sr. Manager at a financial services firm with 1,001-5,000 employees
As far as the relationship of, and ease of finding the relationships between, libraries and applications across the whole enterprise goes, it still does that. They could make that a little smoother, although right now it's still pretty good.
View full review »
SrLeadSo5b76
Sr Lead Solution Services at a financial services firm with 201-500 employees
We use Griddle a lot for integrating into our local builds with the IDE, which is another built system. There is not a lot of support for it nor published modules that can be readily used. So, we had to create our own. No Griddle plugins have been released.
View full review »
Axel Niering
Achitekt at SV Informatik GmbH
If there is something which is not in Maven Central, sometimes it is difficult to get the right information because it's not found.
If you look at NPM-based applications, JavaScript, for example, these are only checkable via the build pipeline. You cannot upload the application itself and scan it, as is possible with Java, because a file could change significantly.
View full review »
JavaDevef0ca
Java Development Manager at a government with 10,001+ employees
Since Nexus Repository just keeps on adding the .jar artifacts whenever there is a build, whenever an application is going up, there is always a space issue on the server. That is one of the things that we are looking for Nexus to notify us about: if it is running out of space.
View full review »
ManojKumar9
Systems Analyst at Thrivent Financial for Lutherans
Sometimes we face difficulties with Maven Central... if I'm using the 1.0.0 version, after one or two years, the 1.0.0 version will be gone from Maven Central but our team will still be using that 1.0.0 version to build. When they do builds, it won't build completely because that version is gone from Maven Central. There is a difference in our Sonatype Maven Central.
View full review »
Gus Orologas
Lead IT Security Architect at a transportation company with 10,001+ employees
The biggest thing is getting it put uniformly across all the different teams. It's more of a process issue. The process needs to be thought out about how it's going to be used, what kind of training there will be, how it's going to be socialized, and how it's going to be rolled out and controlled, enterprise-wide. That's probably more of a challenge than the technology itself.
View full review »
Find out what your peers are saying about Sonatype Nexus Lifecycle vs. WhiteSource and other solutions. Updated: October 2019.
382,547 professionals have used our research since 2012.
Sign Up with Email