Cloud Cybersecurity & Infrastructure Resilience · B2B SaaS Provider
Sonar
Code quality and security software for engineering teams.
Available information varies by company and source.
Profile record updated:
Company facts
- Official name
- SonarSource S.A.
- Entity type
- COMPANY
- Founded
- 2008
- Headquarters
- Switzerland
- Company size
- 201–500
- Market cluster / sector
- Cloud Cybersecurity & Infrastructure Resilience
- Market role
- B2B SaaS Provider
- Official website
- sonarsource.com
What Sonar does
Sonar operates a B2B software platform model centred on recurring developer tooling. It provides a suite of proprietary code analysis, security testing and remediation products embedded across the software development lifecycle, from IDEs to CI/CD and enterprise governance. Value is created by reducing defects, improving code maintainability, enforcing policy controls and lowering security risk before software reaches production. The model combines self-serve product adoption with enterprise expansion into larger deployments, security modules and AI-assisted workflows.
Category differentiation
Sonar is a B2B developer tooling and code security company, not an audio hardware brand or a general-purpose cybersecurity consultancy. It sells software for code analysis, security testing and remediation inside engineering workflows.
Strategic context
AI-supported assessment from the existing company research; distinguish interpretation from sourced facts.
SonarSource S.A., trading as Sonar, is a private Swiss software company that sells developer-focused code quality and code security products to engineering organisations. Its core platform spans cloud-hosted and self-managed static analysis, IDE-based issue detection, advanced security testing, AI-assisted code review, automated remediation and verification for AI-generated code. The company serves developers, DevOps teams, platform engineering teams, application security teams and enterprise software organisations that need continuous inspection of code in development and CI/CD workflows. Sonar generates revenue primarily from recurring software subscriptions and enterprise licensing. SonarQube Cloud uses a subscription model tied to organisation plans and code volume, while enterprise capabilities such as Advanced Security and AI-focused products are sold as higher-tier packages or add-ons. The company is expanding from core code quality into broader DevSecOps and AI code governance, supported by acquisitions including RIPS Technologies, Structure101 and Gitar.
Company news briefing
Briefing updated:
SonarSource’s recent State of Code survey reveals significant developer scepticism towards AI-generated code, with 96% of respondents reporting a lack of full trust and fewer than half consistently reviewing AI-produced commits. Concurrently, industry critique has surfaced regarding Sonar’s 'Solve' stage, which integrates automated remediation directly into the validation process. Critics argue this approach may obscure audit trails and authorship, suggesting a need to decouple verdict-based validation from proposed fixes to maintain robust security postures and accountability within the developer toolchain.
Business model & monetisation
Sonar monetises through recurring software subscriptions, commercial licensing and premium add-ons. SonarQube Cloud is sold as a subscription per organisation, with pricing structured by plan and code volume. SonarQube Server is monetised through commercial self-managed licensing and enterprise sales for larger controlled deployments. Additional modules such as Advanced Security and AI-driven review and remediation capabilities expand account value through higher-tier packaging and add-on sales. A limited free or open-source entry point supports product-led adoption and conversion into paid team and enterprise plans.
- SonarQube Cloud subscriptions
- Software Subscription
- Self-managed enterprise licensing for SonarQube Server
- Software Subscription
- Advanced Security add-ons
- Software Subscription
- AI review and remediation modules
- Software Subscription
Products & capabilities
No products with linked sources are available in this view.
Unlock Full Intelligence Profile for Sonar
Get unlimited access to corporate ownership, historical M&A transactions, verified tech stack telemetry, and live market signals in the interactive Knowledge Graph.
Verified Ownership & Corporate Hierarchy
Complete corporate hierarchy traversal, shareholder cap table history, and parent holding links sourced from regulatory filings.
360° Tech Stack & Vendor Telemetry
Technical header bidding configurations, sellers.json registry nodes, CMP disclosures, and direct programmatic supply chains.
Live Market Signals & Executive Briefings
Continuous 24/7 monitoring of material M&A deals, executive shifts, product rollouts, and hiring trends across peer entities.
Competitors & alternatives
Track competitor shifts
Receive automated telemetry on strategic moves, acquisitions, and market share shifts across Sonar's competitive landscape.
Enterprise SaaS platform for application risk management and code security.
Subscription software for developers, engineering teams and DevOps workflows.
AI-native QA platform for bug tracking and test management.
Developer observability, error tracking and AI debugging software.
Developer platform for code collaboration, automation and AI coding.
Side-by-side comparisons
Recent recorded signals
Dates refer to the source publication. Older entries are historical context, not evidence of a new event.
Sonar Extends Agentic Code Governance and Verification to Self-Managed Infrastructure
Recorded impact score: 2/5
New press release dated September 29, 2026: Sonar Extends Agentic Code Governance and Verification to Self-Managed Infrastructure.
Sonar DNS Field Command Injection Fixed by Developer
Security · Recorded impact score: 2/5
A developer discovered a command injection vulnerability in the DNS custom resolver field of Sonar, a macOS network scanning tool. The field, which accepts user input for custom DNS servers like Pi-hole or NextDNS, was passed to a privileged command without proper validation, potentially allowing arbitrary code execution as root. The fix involved allowlisting input to only accept valid IP addresses, passing arguments as an array instead of a shell string, and narrowing the privileged interface. The article also details three other security fixes made during a full pass: moving API tokens from a plist to the Keychain, preventing CSV export formula injection, and implementing atomic writes to avoid data corruption.
- Sonar had a command injection vulnerability in its DNS resolver field.
- The vulnerability could allow running commands as root.
Explore company relationships
Questions about Sonar
What is Sonar?
Sonar is a private B2B software company that provides code quality, code security and AI code verification tools for software engineering teams.
Who uses Sonar?
Sonar is used by developers, DevOps teams, platform engineering teams, application security teams and enterprise software organisations running CI/CD workflows.
How does Sonar make money?
Sonar makes money through recurring software subscriptions, enterprise licensing and paid add-ons for advanced security, AI review and automated remediation.
Sources & coverage
This profile uses public, official and technically observable information. Missing information does not prove that a product or relationship does not exist. The list below does not imply that every profile statement has been verified.
21 publicly documented primary sources and citations linked across the market graph.
Continue your research on Sonar
Open additional company details, personal Watchlists and your Strategic Intelligence Agent in Polaris7. It monitors your market daily and delivers tailored briefings with clear strategic context whenever relevant news occurs.
Daily intelligent monitoring · Verified primary sources.
Unlock full intelligence profile, ownership & live market signals