SonarQube

How does Fluid Attacks' solution compare to SonarQube's? The following comparison table enables you to discern the performance of both providers across various attributes essential for meeting your company’s cybersecurity needs. To better understand each attribute, read their descriptions in the dedicated page.

Organization

Attribute	Essential	Advanced	SonarQube
Focus	Native ASPM with Built-In Scanners	AI-Powered PTaaS on top of Native ASPM with Built-In Scanners	Real-time code quality analysis
Extras	None	None	SAST
Headcount	130	Same	712
Headcount distribution	Engineering 42%, TI 13%, sales 12%, marketing 2%, operations 4% and others 27%	Same	Engineering 30%, TI 8%, sales 19%, marketing 4%, operations 3% and others 36%
Headcount growth	-2%, -15%, +1%	Same	+14%, +32%, +47%
Headquarters	87% CO	Same	28% CH
Countries	CO and US	Same	CH, DE, FR, GB, SG and US
Reputation	9.84 from 109 reviews over 7 years on Gartner and Clutch	Same	8.80 from 424 reviews over 10 years on G2, Gartner, PeerSpot, Software Advice and TrustRadius
Followers	18K based on the following: Facebook, Instagram, LinkedIn, X and YouTube	Same	44K based on the following: Facebook, LinkedIn, X and YouTube
Research Firms	None	None	IDC, Info-Tech Research Group and Omdia
Founded	2001	Same	2008
Funding	Bootstrapped	Same	$457M USD in 2 rounds from 4 investors
Acquisitions	None	None	Acquired 0 times and made 2 acquisitions
Revenue	5M to 10M	Same	1M to 115.5M
CVE	257 CVEs reported to MITRE, ranked in the top 10 CVE labs worldwide	Same	Not applicable
Compliance	SOC 2 Type II and SOC 3	Same	ISO/IEC 27001, PCI DSS, SOC 2 Type II
Bug bounty	Yes	Yes	No
Visits	20K per month. Top 3: 21% CO, 16% US, 10% IN and others 53%	Same	553K per month. Top 3: 12% US, 9% IN, 6% FR and others 73%
Authority	32 out of 100	Same	54 out of 100
Vulnerability database	Discovered	Same	None
Content	Blog, documentation, e-books, reports, videos, webinars and white papers	Same	Blog, documentation, videos, webinars and white papers
Knowledge base	13 KB sections, 4 in common and 9 additional	Same	4 KB sections, all in common
Community	Forum	Same	Forum
Sync training	No	No	No
Async training	3 product use courses, all free	Same	No
Distribution	Direct or with any of its 14 partners	Same	Direct or with any of its 31 partners
Marketplaces	AWS	Same	AWS, Azure and GCP
Freemium	No	No	Yes
Free trial	21-day free trial	PoV	14-day free trial and PoV
Demo	Yes	Yes	Yes
Pricing	Contact sales, marketplace and public web	Contact sales and public web	Contact sales, marketplaces and public web
Pricing tiers	1 plan	1 plan	2 plans (team, enterprise). First transparent
Minimum commit	Monthly	Monthly	Monthly
Minimum payment period	Monthly	Monthly	Monthly
Minimum capabilities	API security testing, ASPM, binary SAST, containers, CSPM, DAST, IaC, SAST, SCA and secrets	Same plus: PTaaS, RE and SCR	Code quality, SAST and secrets
Minimum scope	1 group	1 author	100K LoCs
Pricing drivers	Groups	Authors	LoC
Minimum monthly payment	1.529 USD	1.529 + 429 USD	32 USD

Service

Attribute	Essential	Advanced	SonarQube
PTaaS	No	Yes	No
Reverse engineering	No	Yes	No
Secure code review	No	Yes	No
Pivoting	No	Yes	No
Exploitation	No	Yes	No
Manual reattacks	Not applicable	Unlimited reattacks	Not applicable
Zero-day vulnerabilities	None	Continuous zero-day vulnerability research	None
SLA	Availability	Accuracy, availability and response	Availability
Min availability	>=99.95% per minute LTM	Same	>=99% unknown granularity by month
After-sale guarantees	No	Yes	No
Accreditations	CNA and Penetration Testing by CREST	Same	AWS DevOps ISV Competency
Hacker certifications	Not applicable	202 from 59 different types	Not applicable
Type of contract	Employee	Same	Employee
Endpoint control	Not aplicable	Total	Not aplicable
Channel control	Not aplicable	Total	Not aplicable
Standards	Some requirements from 65 standards, 10 in common and 55 additional	All requirements from the same standards	10 standards, all in common
Detection method	Automated tools	Automated tools, AI and human intelligence	Automated tools
False positives	1.27 times better	2 times better	46% F0.5 score per quantity
False negatives	3.17 times better	1.10 times better	24% F2.0 score per severity
Remediation	5, 3 in common and 2 additional	Same, plus 1	3, all in common
Outputs	5, 2 in common and 3 additional	Same, plus 2	5, 2 in common and 3 additional

Product

Attribute	Essential	Advanced	SonarQube
ASPM	Yes	Yes	No
API	GraphQL with JSON	Same	REST with JSON
IDE	5 functionalities, 2 in common and 3 additional	Same, plus 1 functionality	3 functionalities, 2 in common and 1 additional
CLI	Yes	Yes	Yes
CI/CD	Breaks the build	Same	Breaks the build
Vulnerability sources	14 sources	Same	No information available
Priority criteria	CVSS v4.0, CVSSF, EPSS and KEV	Same	No information available
Custom prioritization	Customizable priority score	Same	Assign severity to rules
Scanner origin	In-house	In-house	In-house
SCA	24 package managers	Same	No
SCA (AI models)	No	No	No
Reachability	12 languages	Same	No
Reachability type	Deterministic	Same	None
SBOM	22 package managers	Same	No
Malware detection	Yes	Yes	No
Autofix on components	No	No	No
Containers	4 distributions	Same	No
Source SAST (languages)	12, all in common	Same	26, 12 in common and 14 additional
Source SAST (frameworks)	22	Same	1, none in common
Custom rules	No	No	Custom rules for SAST
IaC	6, 3 in common and 3 additional	4, 3 in common and 1 additional	6, all in common
Binary SAST	1 type of binary	Same, plus 2 types of binaries	No
DAST	7 attack surface types	Same	No
API security testing	No	4 types of APIs	No
IAST	No	No	No
CSPM	Yes	Yes	No
Environments	Left & Right (included)	Same	Left only
ASM	No	No	No
Secrets	15 secrets types	Same, plus verify other attack vectors and secrets exploitability	Yes. No information available
AI	4 functions, 1 in common and 3 additional	Same	1 function, in common
Open source	MPL-2.0 license. Totally equivalent to the paid version	Not applicable	LGPL v3 license. Partially equivalent to the paid version
Provisioning as Code	Yes	Yes	Yes
Deployment	SaaS	Same	SaaS and on-premises
Regions	US	Same	US
Status	Yes	Yes	Yes
Incidents	6 per year	Same	2.8 per year

Integrations

Attribute	Essential	Advanced	SonarQube
SCM	4	Same	2, none in common
Binary repositories	None	None	None
Ticketing	3	Same	None
ChatOps	None	None	None
IDE	3, 2 in common and 1 additional	Same	12, 2 in common and 10 additional
CI/CD	32, 5 in common and 27 additional	Same	5, all in common
SCA	Native	Same	None
Container	Native	Same	None
SAST	Native	Same	Native
DAST	Native	Same	None
IAST	None	None	None
Cloud	3	Same	None
CSPM	Native	Same	None
Secrets	Native	Same	Native
Remediation	None	None	3
Bug bounty	None	None	None
Vulnerability management	None	None	None
Compliance	None	None	None

References were last checked on Jun 13, 2025.

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Comparison between Fluid Attacks and SonarQube | Fluid Attacks

SonarQube