A new tool in the SonarSource portfolio: Advanced Security

A new tool in the SonarSource portfolio: SonarQube Enterprise Advanced Security

2025.12.04

In enterprise software development it is no longer in question that code quality and security go hand in hand. The vast majority of vulnerabilities still appear in in-house source code and in defects of open source components — while development teams deliver features at an ever faster pace in CI/CD pipelines using agile methodologies. In this environment a “classic” static code analyser is no longer enough: an integrated security solution is needed.

This is the role filled by SonarQube Enterprise Advanced Security, which can be positioned as a new, premium, specialised product for customers who require high code quality, developer-friendly operation and strict security compliance at the same time.

What is SonarQube Enterprise Advanced Security?

SonarQube is already a comprehensive code quality and code security platform out of the box, supporting more than 30 programming languages and integrating into CI/CD processes in an automated way.

The Advanced Security module extends this core solution with deeper security analysis, specifically for Enterprise Edition 2025 R3 and later server releases. It tightly integrates advanced SAST (Static Application Security Testing) and Software Composition Analysis (SCA) capabilities, so protection extends not only to in-house code but to the entire software supply chain — including open source components.

In short: the Advanced Security module is the extra layer that turns a “plain” SonarQube Enterprise into a comprehensive, developer-first application security solution.

Main capabilities

1. Advanced SAST and taint analysis

SonarQube’s security engine has already included SAST, which analyses source code and identifies potential vulnerabilities, security weak points and security hotspots.

Building on this is Advanced SAST, which, as part of the Advanced Security module:

• uses taint analysis to trace the path of user input through the code, even across multiple files and layers;
• detects typical injection attacks, for example:
  • SQL injection (CWE-89),
  • cross-site scripting (XSS, CWE-79),
  • code injection (CWE-94), etc.

One of the key points of Advanced Security is that taint analysis examines not only the data flow within in-house code, but also how the code interacts with third-party libraries and components, so hidden defects that traditional SAST tools typically miss can also come to light.

2. Secrets detection — preventing leaks of passwords and keys

The module’s built-in secrets detection capability automatically searches code, configuration files and repositories for:

• API keys,
• passwords,
• certificates, tokens and other sensitive credentials.

This is particularly important in environments where developers, DevOps teams or AI tools generate and commit code quickly: a few mishandled secrets are enough to seriously compromise a system.

3. IaC scanning — cloud and infrastructure code security

Advanced Security targets modern, cloud-based architectures by also analysing Infrastructure as Code (IaC) definitions.

It can:

• detect incorrect permission settings,
• poorly sized or overly permissive security rules,
• potentially vulnerable network and storage configurations, for example in Terraform, Kubernetes and CloudFormation definitions.

4. Software Composition Analysis (SCA) — full visibility of open source risks

One of the biggest new features of Advanced Security is the SCA module, which handles the security and licence risks of open source components and third-party libraries.

The module:

• identifies vulnerable component versions based on CVE databases;
• helps prioritise the defects to be fixed using metrics such as CVSS, EPSS and KEV;
• automatically maps the licence terms of components and flags any legal conflicts;
• makes the software supply chain transparent by generating an SBOM (Software Bill of Materials).

This capability adds particular value for organisations where supply chain transparency, licence compatibility and software supply chain protection are regulatory expectations.

5. Reports, standards and compliance

In a SonarQube Enterprise environment, Advanced Security extends the range of security reports and supports compliance with frameworks such as:

• OWASP Top 10,
• OWASP ASVS,
• CWE Top 25,
• PCI DSS, STIG and other industry standards.

These reports support the CISO, audit teams and management in ensuring that code and application security is not only “technically in order” but also demonstrable with documentation.

The product is therefore not merely “a new licence”, but a complex, value-adding solution: platform + expertise + implementation + operational support.

Typical use cases

• Banks, insurers, financial service providers — high security and compliance expectations, complex layered architectures, a heavily regulated environment.
• Public sector and critical infrastructure providers — compliance with cybersecurity laws and NIS2-type requirements, auditability, transparent risk management.
• Enterprise development centres — hundreds of projects, many languages, microservice architecture, heavy dependence on open source.
• Development teams using AI — automatic security checking of AI-generated code, integrated into the familiar Sonar workflow.

Business value — why is it worth it for the customer?

1. Lower cyber risk, fewer incidents

   By filtering out injection flaws, hardcoded secrets, IaC defects and vulnerable open source libraries early, the likelihood and expected cost of a successful attack can be significantly reduced.

2. Faster development, less “firefighting”

   If developers receive feedback already at commit or merge request level, fixing defects is orders of magnitude cheaper and less painful than if the problem only came to light during a production incident.

3. Compliance and auditability

   Standards-based reports (OWASP, CWE, PCI DSS, etc.) can easily be fitted into internal and external audit processes, supporting the demonstration of compliance.

4. Developer-first approach

   SonarQube is fundamentally a developer tool, used daily by millions worldwide. The Advanced Security module extends this familiar environment, so there is no separate “security tool pain”: developers receive quality and security feedback in the same tool.