Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

CodeSonar review

#7 of 30 in Application Security TestingStatic Application Security Testing SoftwareStatic Application Security Testing SastSAST Tools

Whole-program static analysis for teams prioritizing code defects, vulnerabilities, and standards checks.

8.6/10Editor score
Visit AdaCore
CodeSonar8.6 Visit AdaCore

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

CodeSonar is a static analysis and application security testing tool for C/C++ and other languages. AdaCore positions it for enterprise, embedded, safety-critical, and high-integrity software projects. Its whole-program analysis uses abstract interpretation and symbolic execution to examine execution paths for bugs, vulnerabilities, and compliance issues. That emphasis makes it a fit for teams that need deep code analysis and standards checks, rather than a general-purpose suite spanning many AppSec testing approaches.

Analysis capabilities include memory modeling, code-defect detection, and taint analysis that tracks flows of untrusted data. Security coverage includes OWASP Top 10, CWE, CERT, and DISA STIG, while coding-standard support includes MISRA C/C++, CERT, AUTOSAR C++, and JSF++. CodeSonar also analyzes compiled binaries and mixed-language code. These features suit complex or safety-sensitive codebases where teams need to inspect execution paths and align reviews with defined standards. Teams seeking broader testing coverage should compare tools focused on other AppSec testing types.

The centralized hub keeps analysis history and supports warning review, assignment, and comparison across projects. Integrations include Visual Studio, VS Code, Eclipse, GitLab, GitHub, Jira, and Jenkins; an HTTP API supports interaction with the hub. Deployment is available as self-hosted or cloud. According to AdaCore's pricing approach, prospects request pricing or contact sales rather than selecting a published list-price plan. Documentation is the listed support channel. CodeSonar is best suited to mid-market and enterprise teams that value depth in static analysis and a managed review workflow; teams wanting a wider AppSec suite or a published self-service price may prefer an alternative.

CodeSonar pros and cons

  • Where it wins
    • Analyzes execution paths with abstract interpretation and symbolic execution
    • Tracks tainted data and detects memory defects across whole programs
    • Supports coding standards and compiled-binary, mixed-language analysis
  • Where it doesn't
    • Focused on static analysis rather than a broad range of AppSec testing types
    • Pricing requires contacting sales
    • Documentation is the listed support channel

CodeSonar fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update