Sonatype provides tools to manage and secure open source components and AI models in software development.
- Categories
- Software supply chain and SBOM, Vulnerability management, Application security testing, Cloud security (CNAPP and CSPM)
- Based in
- Fulton, United States
- Ownership
- Private
About Sonatype
Sonatype provides software supply chain security for engineering teams. It helps control what developers and AI agents bring into production, covering open source components, containers, models and SBOMs. The company sells to demanding engineering teams, including many Fortune 500 firms. Its platform combines a repository with a public registry, turning intelligence from Maven Central and Nexus Repository into data that teams use to decide what is safe at the source. The Nexus One platform gives repository control, protection and governance at each decision point. Sonatype says it is the only company operating both a major repository and a public registry. Its tools integrate with more than 50 languages, formats and integrations, and work with common DevOps tools. The company also offers consumption-based pricing for cloud and self-hosted deployments, with annual billing and special pricing for government agencies.
Products
- Nexus RepositoryAn artifact repository that acts as a control point for artifacts and models.
- Repository FirewallBlocks malicious packages and suspicious components before they enter development.
- GuideProvides dependency management and governance for agentic development.
- Sonatype LifecycleAutomates open source governance and security with real-time insights.
- SBOM ManagerManages software bills of materials across applications and vendors.
- Advanced Legal PackAn add-on that helps streamline legal compliance for Lifecycle users.
Ownership and deals
- Sonatype acquired MuseDevReport on Sonatype buying MuseDev (opens in a new tab)
Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Amounts are in US dollars.