Item: Sonatype Platform
Rating: 9
Author: Verified User

Overall Satisfaction with Sonatype Platform

Use Cases and Deployment Scope

Sonatype Nexus Lifecycle, we are able to identify issues with the 3rd party controls/components in our software very early into the development stage. Sonatype Lifecycle works very well within our DevOps practice, it helps us to implement continuous monitoring on 3rd party controls/components. It provides detailed reporting that helps us to understand the associated Vulnerabilities with the components and its dependencies.

Pros and Cons

Pros

Scan Speed/time
Detailed reports
Their own analysis

Cons

Provision to see the historical reporting/analysis with 3rd party components.

Most Important Features

Return on Investment

Early identifying & fixing the issues into SDLC

Usability

Overall experience is great with the Platform; however, I see some opportunity with upgrading the platform as it is missing with data of historical scans to allow reviewer to get view of trend how the application/product development team is considering fixing the issues.

Alternatives Considered

Veracode

Well both have their own procs and cons, As a user of Sonatype Nexus Lifecycle, I have found the overall experience highly satisfactory.

Key Insights

Do you think Sonatype Platform delivers good value for the price?

Yes

Are you happy with Sonatype Platform's feature set?

Yes

Did Sonatype Platform live up to sales and marketing promises?

I wasn't involved with the selection/purchase process

Did implementation of Sonatype Platform go as expected?

I wasn't involved with the implementation phase

Would you buy Sonatype Platform again?

Yes

Other Software Used

Veracode, Security Compass SD Elements

Likelihood to Recommend

Using SCA tool in development stage helps development teams to identify issues with the Open-Source Software/3rd party components early into the development stage. that overall helps organization to fix the issues with lesser cost compared while making a plan to fix after the product is fully developed. For all the new development we prefer to use SCA platform like Sonatype from the beginning.

Early detection of vulnerable 3rd party or open-source components
Shift-left
Improve software quality and reduce attack surface

Innovative Uses

Sonatype scans needs to be part of policies that has to scan during any PR

Future Planned Uses

IDE Scans

Likelihood to Renew

Evaluating Sonatype Platform and Competitors

Products Replaced

Key Differentiators

Cloud Solutions
Scalability
Integration with Other Systems
Ease of Use

Evaluation Lessons Learned

I'll consider reviewing the reporting capabilities along with the analysis capabilities.

Sonatype Platform Implementation

Implementation Rating

easy to implement and performing the scans via automations as well

Implementation Details / Implementation Partner

Implemented in-house

Implementation Phases

Yes - Recently we performed migration from On-prem to SaaS and it was conducted in various phases.

Sonatype Platform Training

Training Types Used

No Training

Sonatype Platform Support

Support Rating

Support team is very pro-active and functioning very well.

Sonatype Platform Customer Support Pros and Cons

Pros	Cons
Quick Resolution Good followup Knowledgeable team Kept well informed No escalation required Immediate help available Support understands my problem Support cares about my success Quick Initial Response	None

Using Sonatype Platform

Usability Pros and Cons

Pros	Cons
Like to use Relatively simple Easy to use Technical support not required Well integrated Consistent Quick to learn Convenient Feel confident using Familiar	None