CISO Tribune

Vendor comparison · 2 companies

Legit Security vs Sonatype

Legit Security sells a SaaS security solution and ASPM platform that automates security issue discovery. Sonatype sells software that guides component selection, blocks malicious components and automates dependency fixes in developer and agent workflows. CISO Tribune files both under Software supply chain security. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Legit Security
  • Sonatype
Legit Security vs Sonatype: Products, Customers and Funding Compared
Legit SecurityLegit Security sells a SaaS security solution and ASPM platform that automates security issue discovery.legitsecurity.comSonatypeSonatype sells software that guides component selection, blocks malicious components and automates dependency fixes in developer and agent workflows.sonatype.com
What it sells
  • ASPM platform[1][5]A SaaS security solution that automates security issue discovery and gives a unified view of application risk from code to cloud.
  • Nexus One Platform[4][9]A platform that helps developers and agents build with trusted components and automate governance.
  • Sonatype Nexus Repository[4][6][10]An enterprise artifact repository manager for packages, containers, models, and build artifacts.
  • Sonatype Lifecycle[2][4][11][13][16]Software composition analysis with policies for open source components and AI models.
  • Sonatype Guide[4][5][13][14]Includes the Sonatype Lifecycle capabilities and the software compliance capabilities of SBOM Manager.
Categories
Headquarters
Not stated on its pagesFulton, United States[3]
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesNot stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • June 18, 2026Legit Security announced it was named a Sample Vendor in the Gartner Hype Cycle for Secure Software Engineering 2026.[4]
  • April 27, 2026Legit Security announced new executive appointments to its leadership team.[3]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[7]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
In our reading, Legit Security addresses organisations that are building an AppSec program. Legit Security says it typically works with organisations above a minimum developer count. Legit Security delivers its ASPM platform as a SaaS security solution. Legit Security deploys without agents, using APIs and access tokens.From its own pages, Sonatype sells mainly to development, DevOps, platform engineering, and security teams that want to govern open source components and AI models. Sonatype describes Nexus One as the single source of truth for those teams. Sonatype also says it offers special pricing for government agencies. Teams that track work in Jira Cloud or Jira Data Center are among those its Lifecycle integration addresses.
Last verified
September 27, 2026September 27, 2026

Where they overlap

  • Legit Security and Sonatype are both filed under Software supply chain security.

Where they differ, field by field

  • Legit Security's primary category is Application security posture management; Sonatype's is Software composition analysis.
  • Legit Security is also filed under Secrets detection.
  • Legit Security lists ASPM platform. Sonatype lists Nexus One Platform, Sonatype Nexus Repository, Sonatype Lifecycle and Sonatype Guide.
  • Sonatype is headquartered in Fulton, United States.

What it sells: Sonatype

What Nexus One Platform does[4][9]
Nexus One platform helps developers and agents build with trusted components, automate governance, and increase visibility across the AI SDLC. Sonatype presents it as the single source of truth for development, DevOps, platform engineering, and security teams.
What Sonatype Nexus Repository does[4][6][10]
Sonatype Nexus Repository gives developers, pipelines, and agents one place to pull, publish, and manage the packages, containers, models, and build artifacts behind every release. It gives global teams secure access with TLS encryption, SAML, and SSO support. It also stores and manages container images.
What Sonatype Lifecycle does[2][4][11][13][16]
Sonatype Lifecycle offers 18 default policies and over 30 customizable constraints. It pushes component intelligence into GitHub so developers can respond to policy violations in pull requests. Its capabilities are now included in Sonatype Guide.
What Sonatype Guide does[4][5][13][14]
New customers purchase Sonatype Guide to get software composition analysis and open source governance functionality. Sonatype Guide integrates into CI/CD platforms like GitHub and Jenkins to scan containers for known vulnerabilities, policy violations, and license risks.

Questions about Legit Security and Sonatype

What do Legit Security and Sonatype sell?
Legit Security sells ASPM platform. Sonatype sells Nexus One Platform, Sonatype Nexus Repository, Sonatype Lifecycle and Sonatype Guide.
Are Legit Security and Sonatype in the same category?
They share Software supply chain security. Legit Security's primary category is Application security posture management and Sonatype's is Software composition analysis.
Where are Legit Security and Sonatype headquartered?
Sonatype is headquartered in Fulton, United States.
Who are Legit Security and Sonatype sold to?
In our reading, Legit Security addresses organisations that are building an AppSec program. From its own pages, Sonatype sells mainly to development, DevOps, platform engineering, and security teams that want to govern open source components and AI models.
What have Legit Security and Sonatype announced recently?
June 18, 2026: Legit Security announced it was named a Sample Vendor in the Gartner Hype Cycle for Secure Software Engineering 2026.

About Legit Security

Legit Security sells a SaaS security solution and ASPM platform that automates security issue discovery. Legit Security gives a unified view of all application risk, from code to cloud, covering what affects an AppSec posture.

Legit Security gives context for prioritizing and acting on remediation of the issues that create the most business risk. Legit Security automates manual processes associated with triage and remediation.

Legit Security discovers, analyzes and secures an end-to-end software supply chain with a real-time SDLC inventory. Legit Security maps and visualizes an entire software supply chain. Customers quoted by Legit Security describe using the platform to inventory SDLC systems and security tools and to view developer activity. A customer quoted by Legit Security describes using the platform to secure CI/CD pipelines, track the security posture of different teams and address SDLC configuration drifts. A customer quoted by Legit Security describes using the platform for governance and for visualization across the SDLC.

Legit Security offers help to organisations as they build an AppSec program. Legit Security helps implement secrets detection and prevention. Legit Security helps identify use of GenAI in development. Legit Security helps align an AppSec program with key compliance standards and frameworks. Legit Security supports security frameworks used to validate and demonstrate compliance.

Legit Security needs no agents to install and uses APIs and access tokens. Legit Security typically works with organisations of 50+ developers. Legit Security was co-founded by Roni Fuchs as CEO, Liav Caspi as CTO and Lior Barak as COO.[1][2]

Legit Security on the record

Sources

Legit Security full record

  1. [1]legitsecurity.comLegit Security · legitsecurity.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]PlatformLegit Security · legitsecurity.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Legit Security Names New VP of Human Resources, Head of Engineering to Accelerate Next Phase of GrowthBusiness Wire · published April 27, 2026 · Tier A
  4. [4]Legit Security Named as a Sample Vendor in the Gartner® Hype Cycle™ for Secure Software Engineering 2026Business Wire · published June 18, 2026 · Tier A
  5. [5]Legit Security at Black Hat | Request a MeetingLegit Security · undated page, accessed November 10, 2026 · Tier A

Sonatype full record

  1. [1]sonatype.comSonatype · sonatype.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Sonatype Lifecycle | SCA Tools for Open Source SecuritySonatype · undated page, accessed September 27, 2026 · Tier A
  3. [3]Grand opening of india innovation hubSonatype · sonatype.com · undated page, accessed September 27, 2026 · Tier A
  4. [4]Sonatype | Secure Software Development with Open Source & AISonatype · undated page, accessed October 28, 2026 · Tier A
  5. [5]Container Security Solutions | Sonatypesonatype.com · undated page, accessed October 28, 2026 · Tier A
  6. [6]Sonatype Container SecuritySonatype · undated page, accessed October 28, 2026 · Tier A
  7. [7]Sonatype Nexus Repository Reviews & Product Details - G2G2 · undated page, accessed October 28, 2026 · Tier C
  8. [8]About Sonatype | Our Company & Mission | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  9. [9]Software Supply Chain Management | Sonatype Nexus One PlatformSonatype · undated page, accessed November 3, 2026 · Tier A
  10. [10]Sonatype Nexus Repository | A Leading Artifact RepositorySonatype · undated page, accessed November 3, 2026 · Tier A
  11. [11]Sonatype Lifecycle and Jira Integrations | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  12. [12]PyCharm and Sonatype IntegrationSonatype · undated page, accessed November 3, 2026 · Tier A
  13. [13]Sonatype Pricing & Nexus Repository Plans | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A
  14. [14]Using Guide Personal Access Tokens with OSS Index API IntegrationsSonatype · undated page, accessed November 3, 2026 · Tier A
  15. [15]Maven Central + Sonatype | Securing the Largest Java RepositorySonatype · undated page, accessed November 3, 2026 · Tier A
  16. [16]Customer Success Stories | SonatypeSonatype · undated page, accessed November 3, 2026 · Tier A

Spot a factual error? Request a correction.