Sonar Expands to Third-Party Code Security with Tidelift Buy

Sonar plans to purchase a startup led by a former Red Hat executive to maintain and secure third-party open-source code libraries.

See Also: OnDemand | How to Build Cyber Resilience with Proactive Incident Response Strategies

The Geneva-based code security vendor said human-verified intelligence from Boston-based Tidelift’s unique network of open-source maintainers will enhance both code quality and security, according to Vice President of Growth and New Ventures Harry Wang. He said the acquisition complements Sonar’s existing capabilities in first-party and AI-generated code, and will help enhance AI code verification.

“This is getting back to the mission of Sonar,” Wang told Information Security Media Group. “We’re in the business of helping developers and their organizations really build better software. We do so by surfacing the quality and security issues in the code and also giving them suggestions on how to remediate those.”

Tidelift was founded in 2017, employs 64 people and has raised $73.5 million of outside funding, most recently completing a $33.5 million Series C funding round led by Dorilton Ventures. The company has been led since inception by Donald Fischer, who previously spent five years at Red Hat, five years at Greylock Partners and four years at General Catalyst Partners (see: Sonar Adds Code Architecture Insights With Structure101 Buy).

What Sets Tidelift’s Approach to Third-Party Code Apart

The Tidelift acquisition marks a significant step forward for Sonar in addressing third-party open-source libraries, which Wang said make up the majority of modern software codebases. With more than 400 maintainers monitoring and maintaining open-source libraries, Wang said Tidelift brings human-verified intelligence to Sonar’s ecosystem, addressing gaps in third-party library security.

“Today, our focus has been mostly the code these developers write by themselves, or the code introduced by the AI systems,” Wang said. “With the acquisition of Tidelift, the combined capability really extends our quality issue, security issue detection and remediation into third-party code.”

Unlike other solutions that rely on databases of known vulnerabilities, Wang said Tidelift engages the developers of the libraries themselves, creating a direct pipeline of accurate, real-time information about vulnerabilities, patches and updates. Sonar will incorporate this human-verified intelligence into its existing software development and security tools to provide end-to-end code analysis and protection.

“When we actually bring the capabilities over and tie it together, we’re able to not only have comprehensive human-verified intelligence about third-party code, there’s actually a level of assurance because of the human maintainer in the loop,” Wang said.

Third-party code security presents distinct challenges because organizations often rely on open-source libraries without direct access or control over their codebases, Wang said. Unlike first-party code, third-party libraries are maintained externally, making it tough to proactively detect and address issues. Most existing solutions rely on scanning and cross-referencing vulnerability databases, which can be outdated.

“By and large, what’s been missing is really a direct approach about monitoring what’s going on in these third-party libraries,” Wang said.

The integration will involve connecting Tidelift’s human-verified intelligence with SonarQube through APIs, which Wang said will allow customers to analyze third-party libraries and access Tidelift’s insights directly within the SonarQube interface. This will involve collaboration between engineering teams from both firms to determine how the integration will function, whether via APIs or shared infrastructure.

“From an API standpoint, we may not be actually one monolithic infrastructure behind the scenes,” Wang said. “We could be actually two separate infrastructure back-ends, but then we bring the product together through the API.”

How Tidelift Can Help Secure AI-Generated Code

Open-source maintainers are the backbone of Tidelift’s offering, Wang said, with these folks overseeing the health and security of widely used open-source libraries, addressing vulnerabilities and ensuring compatibility with evolving software ecosystems. For Sonar, this network represents a direct pipeline to high-quality, human-verified intelligence, which can be integrated into SonarQube to enhance security.

“That information is being incorporated into Tidelift’s offering in the realm of both surfacing that information to the Tidelift user and customers, but also using the attestation that Tidelift is sending as part of that software supply chain,” Wang said.

Wang said developers can get more assurance that AI-generated code is both functional and secure by leveraging Tidelift’s human-in-the-loop approach. While specific plans are still in development, Wang said the vision is to use Tidelift’s network to create a feedback loop for verifying and improving AI outputs.

“How do we know we can trust AI in our space?” Wang said. “How do you know the code generated by the AI is correct functionally, and it is a safe from security standpoint?”

With Tidelift, Wang said Sonar can offer a comprehensive solution for securing the software supply chain, ensuring the security of first-party, AI-generated, and third-party libraries used in applications. For industries like finance and government, where compliance is critical, Wang said Tidelift’s maintainers provide added assurance that open-source components are secure and reliable.

By providing accurate, actionable insights and remediation suggestions, Wang said the joint Sonar-Tidelift platform reduces friction between these groups, allowing for faster development without compromising security. Sonar wants to optimize the developer experience by surfacing only the most relevant issues and providing clear remediation paths, making it easier to address security concerns.

“We have always been focusing on what’s good for the developers, and that means bringing accurate information, surfacing precise issues, and not just randomly prioritizing a long list of issues,” Wang said. “We hear complaints all the time that developers are overloaded, so we are very much actually optimizing for developers.”

The software development industry is undergoing rapid consolidation and innovation, and Wang said Sonar plans to stay active in exploring strategic acquisition opportunities. Sonar in October bought code structure analysis pioneer Structure101, and Wang said the company is in a strong financial position to pursue additional tuck-in acquisitions.

“This entire industry is going through consolidation, so we are very much keeping our eyes open and clear,” Wang said.