SECURITY ATLAS / EVALUATION BRIEF
SonarQube Advanced Security
Research reviewed: 2026-10-18
https://atlasofsecurity.com/landscape/vendors/sonarqube-advanced-security/

THE ATLAS TAKE
SonarQube Advanced Security is an add-on to SonarQube Server, extending an established code-analysis workflow with deeper security and software-composition capabilities. That positioning matters: it is not a feature implied by every Sonar installation. Atlas analysis: the strongest fit is an organization already using SonarQube gates and ownership that wants security findings in the same engineering rhythm. Validate dependency discovery and security analysis on representative applications before relying on a shared gate. A passing quality gate can only speak for the checks, languages, artifacts, and policy actually configured.

SCOPE
The Advanced Security add-on requires an eligible Server edition and entitlement. Verify documented cloud-analysis and local-parsing data flows before enabling either mode; local parsing is not an air-gap guarantee. Compare its results with existing SCA coverage.

WORTH A LOOK WHEN
Organizations operating SonarQube Server Enterprise that want source and dependency security integrated with existing engineering gates.

THINK TWICE WHEN
The requirement assumes Community Edition, cloud service, and Advanced Security have identical availability or feature scope.

IMPLEMENTATION
1. Confirm the deployed edition
Record server version, add-on entitlement, scanner versions, and supported languages.

2. Pilot a real project
Include a known vulnerable transitive dependency and a source defect with a clear data flow.

3. Align gate and backlog policy
Make new-code enforcement, legacy findings, exceptions, and owner responsibility explicit.

OPERATING REALITY
Server upgrades, scanner configuration, build context, quality profiles, and security triage remain operational responsibilities. Atlas analysis: review how new-code policy interacts with existing vulnerability debt. A gate that intentionally ignores old findings can be useful for delivery, but should not be presented as an absence of application risk.

COMMERCIAL CONSIDERATIONS
Price the required Server edition and Advanced Security add-on alongside hosting, upgrades, and scanner operations.
- Required Server edition and add-on
- Licensed code footprint and commercial counting rules
- Hosting, upgrades, and build integration

EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS
1. Inspect dependency inventory
Acceptance evidence: Match known direct and transitive packages to the application build and dependency view.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

2. Verify the security gate
Acceptance evidence: Seed a supported source defect and show the configured policy changes the expected result.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

3. Test an exception lifecycle
Acceptance evidence: Document a justified temporary exception and prove a new unrelated issue still blocks when required.
Owner: __________  Pass criterion: __________
Observed result: __________  Evidence location: __________

QUESTIONS FOR THE VENDOR
- Is the Advanced Security add-on entitled (Enterprise-and-above on SonarQube Server), or is the team looking at a Server or Community install without that add-on?
- Does the documented data flow for cloud analysis or local parsing leave the organization's residency boundary?
- How do Sonar dependency findings overlap with an existing SCA product, including license policy?

EVIDENCE GAPS
- No independent security-detection or server-sizing test was performed.
- Exact language, dependency, and version support must be checked for the installed release.

SOURCES
Advanced Security introduction (Documentation)
https://docs.sonarsource.com/sonarqube-server/advanced-security/introduction
Analyzing projects for dependencies (Documentation)
https://docs.sonarsource.com/sonarqube-server/advanced-security/analyzing-projects-for-dependencies
Viewing dependencies (Documentation)
https://docs.sonarsource.com/sonarqube-server/advanced-security/viewing-dependencies

Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement.
Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.