nexus firewall

Your first line of defense against modern software supply chain attacks.

Book a Demo

Try It On Cloud

Integration_Cheque@2x

Integration_Cheque@2x

Press releases

Sonatype is the software supply chain management company. We empower developers and security professionals with intelligent tools to innovate more securely at scale. Our platform addresses every element of an organization’s entire software development life cycle, including third-party open source code, first-party source code and containerized code. Sonatype identifies critical security vulnerabilities and code quality issues and reports results directly to developers when they can most effectively fix them. This helps organizations develop consistently high-quality, secure software which fully meets their business needs and those of their end-customers and partners. More than 2,000 organizations, including 70% of the Fortune 100, and 15 million software developers already rely on our tools and guidance to help them deliver and maintain exceptional and secure software.

Press kit

Access some basic statistics, descriptions, and brand assets you may

find helpful when writing about Sonatype.

Download All

all the things

bio-1

Logos

Access our collection of approved corporate logos and brand guidelines for use.

Download

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

2008

year founded in Fulton, Maryland

Sonatype documentation & research

CRITICAL

CVE-2021-44228

Original log4j CVE that started it all. Impacts “org.apache.logging.log4j.log4j-core” versions 2.x only: <2.15.0 affected.

MODERATE

CVE-2021-4104

Less severe variant of CVE-2021-44228 impacting log4j 1.x only. Impacts all versions of a different group/artifact altogether: “log4j:log4j.” Not applicable to “log4j-core” (those are 2.x versions).

CRITICAL

CVE-2021-44228

Original log4j CVE that started it all. Impacts “org.apache.logging.log4j.log4j-core” versions 2.x only: <2.15.0 affected.

CRITICAL

CVE-2021-44228

Original log4j CVE that started it all. Impacts “org.apache.logging.log4j.log4j-core” versions 2.x only: <2.15.0 affected.

CRITICAL

CVE-2021-44228

Original log4j CVE that started it all. Impacts “org.apache.logging.log4j.log4j-core” versions 2.x only: <2.15.0 affected.

CRITICAL

CVE-2021-44228

Original log4j CVE that started it all. Impacts “org.apache.logging.log4j.log4j-core” versions 2.x only: <2.15.0 affected.

bio-1

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

123

testtest

TEST

Nexus Vunerability Scanner

Produce a Software Bill of Materials and catalog all of the components in your application.

testtest

bio-1

Get started right away.

Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

testtest

Quality code early and everywhere

Quality code early and everywhere

Quality components from the start
Receive detailed intelligence for healthier component choice early in development, directly in your IDE and source control. As easy as adding packages.
Avoid false positives and negatives
Get insights you can count on. Access data compiled from automation and careful human curation for quality your team can confidently act on right away.
Code with guardrails not gates
Minimize dependency jungle with stage-specific guardrails in your SDLC that automate compliance and protect against delays from unnecessary security “checkpoints".

integrated-hero-bg

Open source is here to stay

Software development is evolving. 90% of modern applications use open source code for good reason—speed. But when open source components go unmaintained, they become liabilities that leave organizations open to security and licensing risks. Software supply chain attacks are up 742% per year over the past 3 years and enterprises need a way to protect themselves without slowing innovation.

That’s why we invented software supply chain management.

Leaders in software supply chain

bio-1

E. Wayne Jackson III

Chief Executive Officer

bio-1

E. Wayne Jackson III

Chief Executive OfficerChief Executive Officer

bio-1

E. Wayne Jackson III

Chief Executive Officer

The path to secure innovation

1980s

2001

2006

2008

2008

2001

1980s

2008

2006

12345

The concept of “open source” emerges as a trend in the development space

2001

Sonatype humbly begins as a project by core contributors to Apache Maven, a platform for building Java-based projects

2006

A staggering volume and variety of open source libraries begin flowing into every development environment in the world, exposing weakness in the software supply chain

2008

Sonatype takes on running The Central Repository, then the worlds’ largest repository of Java open source components

2008

Sonatype takes on running The Central Repository, then the worlds’ largest repository of Java open source components

2001

Sonatype humbly begins as a project by core contributors to Apache Maven, a platform for building Java-based projects

12345

The concept of “open source” emerges as a trend in the development space

2008

Sonatype takes on running The Central Repository, then the worlds’ largest repository of Java open source components

2006

A staggering volume and variety of open source libraries begin flowing into every development environment in the world, exposing weakness in the software supply chain

1“Using Nexus Lifecycle, we’re able to identify risks earlier than ever before in the development process.”

Prem Ranganath

VP of Quality and Risk Management, Trilliant

See Case Study
2“Using Nexus Lifecycle, we’re able to identify risks earlier than ever before in the development process.”

Prem Ranganath

VP of Quality and Risk Management, Trilliant

See Case Study
3“Using Nexus Lifecycle, we’re able to identify risks earlier than ever before in the development process.”

Prem Ranganath

VP of Quality and Risk Management, Trilliant

See Case Study
4“Using Nexus Lifecycle, we’re able to identify risks earlier than ever before in the development process.”

Prem Ranganath

VP of Quality and Risk Management, Trilliant

See Case Study

WHY SONATYPE

Superior data is our lifeblood

97% of data is exclusive to Sonatype.

65 world class security researchers

Public databases like the National Vulnerability Database provide a relatively small and typically outdated view of open source security vulnerabilities. Sonatype delivers a more universal understanding of open source risk and does it 10x faster.

Protect against risk that your software can be Sonatype ingests and analyzes components from every GitHub commit to every open source project, advisory websites, Google search alerts, OSS Index, and a plethora of vulnerability sites. New vulnerabilities are also regularly discovered by our own researchers and added to our proprietary knowledge base. in ways that are harmful to your business or customers.

How are false positives avoided?

PyCharm

PyCharm

PyCharm

PyCharm

PyCharm

PyCharm

PyCharm

PyCharm

Security that never sleeps

80% reduction in remediation time

70% reduction in window of exploitability

Continuously monitor for new defects with an automated early warning system for newly discovered defects. Then know the exact root cause and component dependencies so your developers can remediate vulnerabilities quickly.

Application Security

integrated-hero-bg

Unite teams within mission control

6x faster release velocity

10x faster feedback loops

Security, quality, and compliance cannot be achieved in isolation. Sonatype is an integrated platform that brings the data and insights needed into every workflow, to achieve software supply chain management at scale.

Unite teams within mission control

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

testtest

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

testtest

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

testtest

Run products anywhere

Flexible deployment options let you run anywhere—without the operational hurdles. Deploy easily with world class support from our Technical Support team at no additional cost.

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

testing