CISO Tribune

Vendor comparison · 2 companies

Kiuwan vs Sonatype

Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). Sonatype sells software that guides component selection, blocks malicious components and automates dependency fixes in developer and agent workflows. CISO Tribune files both under Software composition analysis. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Kiuwan
  • Sonatype
Kiuwan vs Sonatype: Products, Customers and Funding Compared
KiuwanKiuwan sells static application security testing (SAST) and software composition analysis (SCA).kiuwan.comSonatypeSonatype sells software that guides component selection, blocks malicious components and automates dependency fixes in developer and agent workflows.sonatype.com
What it sells
  • Code Security[1][5][7]A static application security testing tool that finds and prioritizes vulnerabilities across a codebase.
  • Insights[1][6]Supports SBOM generation by providing the components and information needed.
  • Code Quality[1][7][8]Code quality in a cloud environment for security QA engineers and IT teams.
  • Nexus One Platform[4][9]A platform that helps developers and agents build with trusted components and automate governance.
  • Sonatype Nexus Repository[4][6][10]An enterprise artifact repository manager for packages, containers, models, and build artifacts.
  • Sonatype Lifecycle[2][4][11][13][16]Software composition analysis with policies for open source components and AI models.
  • Sonatype Guide[4][5][13][14]Includes the Sonatype Lifecycle capabilities and the software compliance capabilities of SBOM Manager.
Categories
Headquarters
Not stated on its pagesFulton, United States[3]
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Owned by Idera, Inc. since 2018[2][3]Not stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pagesNot stated on its pages
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI. Kiuwan Governance is aimed at stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan can be run in the cloud, as hybrid-cloud based solutions, or on-premise.From its own pages, Sonatype sells mainly to development, DevOps, platform engineering, and security teams that want to govern open source components and AI models. Sonatype describes Nexus One as the single source of truth for those teams. Sonatype also says it offers special pricing for government agencies. Teams that track work in Jira Cloud or Jira Data Center are among those its Lifecycle integration addresses.
Last verified
October 16, 2026September 27, 2026

Where they overlap

  • Kiuwan and Sonatype are both filed under Software composition analysis.

Where they differ, field by field

  • Kiuwan's primary category is Static application security testing; Sonatype's is Software composition analysis.
  • Sonatype is also filed under Software supply chain security.
  • Kiuwan lists Code Security, Insights and Code Quality. Sonatype lists Nexus One Platform, Sonatype Nexus Repository, Sonatype Lifecycle and Sonatype Guide.
  • Sonatype is headquartered in Fulton, United States.
  • Kiuwan is owned by Idera, Inc., since 2018.

What it sells: Kiuwan

What Code Security does[1][5][7]
Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. Kiuwan states that Kiuwan Code Security is compliant with security standards including CWE, OWASP, PCI, CERT, and SANS.
What Insights does[1][6]
Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications.

What it sells: Sonatype

What Nexus One Platform does[4][9]
Nexus One platform helps developers and agents build with trusted components, automate governance, and increase visibility across the AI SDLC. Sonatype presents it as the single source of truth for development, DevOps, platform engineering, and security teams.
What Sonatype Nexus Repository does[4][6][10]
Sonatype Nexus Repository gives developers, pipelines, and agents one place to pull, publish, and manage the packages, containers, models, and build artifacts behind every release. It gives global teams secure access with TLS encryption, SAML, and SSO support. It also stores and manages container images.
What Sonatype Lifecycle does[2][4][11][13][16]
Sonatype Lifecycle offers 18 default policies and over 30 customizable constraints. It pushes component intelligence into GitHub so developers can respond to policy violations in pull requests. Its capabilities are now included in Sonatype Guide.
What Sonatype Guide does[4][5][13][14]
New customers purchase Sonatype Guide to get software composition analysis and open source governance functionality. Sonatype Guide integrates into CI/CD platforms like GitHub and Jenkins to scan containers for known vulnerabilities, policy violations, and license risks.

Questions about Kiuwan and Sonatype

What do Kiuwan and Sonatype sell?
Kiuwan sells Code Security, Insights and Code Quality. Sonatype sells Nexus One Platform, Sonatype Nexus Repository, Sonatype Lifecycle and Sonatype Guide.
Are Kiuwan and Sonatype in the same category?
They share Software composition analysis. Kiuwan's primary category is Static application security testing and Sonatype's is Software composition analysis.
Where are Kiuwan and Sonatype headquartered?
Sonatype is headquartered in Fulton, United States.
Who owns Kiuwan and Sonatype?
Kiuwan is owned by Idera, Inc., since 2018.
Who are Kiuwan and Sonatype sold to?
Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI. From its own pages, Sonatype sells mainly to development, DevOps, platform engineering, and security teams that want to govern open source components and AI models.

About Kiuwan

Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). Kiuwan was founded in 2003 in Spain. Idera, Inc. acquired Kiuwan in 2018. Kiuwan is now part of Sembi. Kiuwan works with all common programming languages and dev environments. Kiuwan describes its tool set as designed for dev teams across the SDLC.[1][4][7]

Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Kiuwan describes SAST as analysis of source code to detect security vulnerabilities before an application is executed. Kiuwan Code Security scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security analyzes code in the IDE with real-time feedback on every save. Kiuwan Code Security supports local pre-commit analysis and automated scans in a CI/CD pipeline. Kiuwan Code Security can detect injection attacks, cross-site scripting, cross-site request forgery, broken authentication, insecure cryptography, access control flaws, and security misconfigurations.[1][5]

Kiuwan Code Security covers 30+ languages, including Java, Python, JavaScript, C#, Go, and Swift. Kiuwan Code Security offers IDE plugins for Visual Studio, VS Code, Eclipse, and JetBrains. Kiuwan has native plugins for Jenkins and Azure DevOps that add scans to the build process. GitLab CI integrates with Kiuwan via the local analyzer. Kiuwan offers integration with popular IDEs, version control systems, issue trackers, and CI/CD pipelines.[5][6]

Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. The Kiuwan local analyzer (KLA) runs entirely on the user infrastructure for air-tight environments or data residency requirements. Kiuwan offers source code analysis and vulnerability tracking solutions either on-premise or in the cloud. Kiuwan can be run as hybrid-cloud based solutions or with a local analyzer for integration with development environments.[5][6][7]

Kiuwan describes its SCA as addressing third-party components, to remediate vulnerabilities and ensure license compliance. Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications. Kiuwan Governance groups the results of code analyses into separate portfolios. Kiuwan Governance serves stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan identifies risky software applications with decision quadrants. Kiuwan tracks dev team and vendor activity across projects and change requests. Kiuwan forecasts the evolution of an application portfolio with predictive analytics. Kiuwan provides measurement of software quality, prioritization of key issues, and remediation plans from findings.[1][5][6][7]

Kiuwan sells plans ranging from focused SAST coverage to full SAST, SCA, Code Quality, Governance, and enterprise support. Kiuwan pricing scales by number of users and applications, and lines of code pricing is available. Kiuwan provides reports used to review vulnerabilities and identify app and code quality issues requiring remediation. Kiuwan aligns with industry regulations such as OWASP, CISA, NTIA, SBOM, GDPR, HIPAA, and PCI DSS. Kiuwan describes its SAST as compliant with financial security standards like NYDFS, GLBA, and PCI. Kiuwan describes its SAST as compliant with banking security standards such as ISO/IEC, NIST, and PCI.[1][4][5][6][7][8][9][10]

Kiuwan on the record

Sources

Kiuwan full record

  1. [1]kiuwan.comKiuwan · kiuwan.com · undated page, accessed October 16, 2026 · Tier A
  2. [2]Idera acquires kiuwanKiuwan · kiuwan.com · published May 26, 2021 · Tier A
  3. [3]About Us | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  4. [4]Why US Organizations Need Kiuwan | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  6. [6]SBOM Software Bill Of Materials | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  7. [7]Code Security | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  8. [8]Pricing | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  9. [9]Why Finance Organizations Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  10. [10]Why Banks Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A

Sonatype full record

  1. [1]sonatype.comSonatype · sonatype.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Sonatype Lifecycle | SCA Tools for Open Source SecuritySonatype · undated page, accessed September 27, 2026 · Tier A
  3. [3]Grand opening of india innovation hubSonatype · sonatype.com · undated page, accessed September 27, 2026 · Tier A
  4. [4]Sonatype | Secure Software Development with Open Source & AISonatype · undated page, accessed October 28, 2026 · Tier A
  5. [5]Container Security Solutions | Sonatypesonatype.com · undated page, accessed October 28, 2026 · Tier A
  6. [6]Sonatype Container SecuritySonatype · undated page, accessed October 28, 2026 · Tier A
  7. [7]Sonatype Nexus Repository Reviews & Product Details - G2G2 · undated page, accessed October 28, 2026 · Tier C
  8. [8]About Sonatype | Our Company & Mission | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  9. [9]Software Supply Chain Management | Sonatype Nexus One PlatformSonatype · undated page, accessed November 3, 2026 · Tier A
  10. [10]Sonatype Nexus Repository | A Leading Artifact RepositorySonatype · undated page, accessed November 3, 2026 · Tier A
  11. [11]Sonatype Lifecycle and Jira Integrations | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  12. [12]PyCharm and Sonatype IntegrationSonatype · undated page, accessed November 3, 2026 · Tier A
  13. [13]Sonatype Pricing & Nexus Repository Plans | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  14. [14]Using Guide Personal Access Tokens with OSS Index API IntegrationsSonatype · undated page, accessed November 3, 2026 · Tier A
  15. [15]Maven Central + Sonatype | Securing the Largest Java RepositorySonatype · undated page, accessed November 3, 2026 · Tier A
  16. [16]Customer Success Stories | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A

Spot a factual error? Request a correction.