Only a few days out from KubeCon + CloudNativeCon North America. We hope to see you there! Stop by Booth #208 to meet the Sonatype team and see how to keep risky components out of your builds without slowing development down. Think you have what it takes to build fast and ship with confidence? Put your skills to the test at Activation Zone #108 with our Blind Build Challenge. See you at the show!
About us
The Sonatype journey started 15 years ago, just as the concept of “open source” software development was gaining steam. From our humble beginning as core contributors to Apache Maven, to supporting the world’s largest repository of open source components (Central), to distributing the world's most popular repository manager (Sonatype Nexus Repository), we’ve played a meaningful role in helping the world embrace the power of open innovation. Over time, we witnessed the staggering volume and variety of open source libraries that began flowing into every development environment in the world. We understood that when open source components are properly managed, they provide a tremendous energy for accelerating innovation. Conversely, when unmanaged, open source "gone wild" can lead directly to security vulnerabilities, licensing risks, enormous rework, and waste. Our vision today is simple. We are laser focused on helping organizations continuously harness all of the good that open source has to offer, without any of the risk. In order to do this, we have invested in knowing more about the quality of open source than anyone else in the world. This investment takes the form of machine learning, artificial intelligence, and human expertise, which in aggregate produces highly curated intelligence that is infused into every Sonatype product. Organizations equipped with Sonatype products make better decisions, innovate faster at scale, and rest comfortably knowing that their applications always consist of the highest quality open source components.
- Website
-
https://www.sonatype.com
External link for Sonatype
- Industry
- Software Development
- Company size
- 501-1,000 employees
- Headquarters
- Fulton, MD
- Type
- Privately Held
- Founded
- 2008
- Specialties
- Open Source, Open Source Governance, Management and Compliance, Repository Management, DevOps, DevSecOps, Software Supply Chain, Continuous Delivery, Continuous Integration, Open Source Security, Docker Private Registry, Software Component Analysis, Open source software, Application security, information security, artifact repository, SBOMs, and SaaS
Employees at Sonatype
View 589 employees at Sonatype
or
Locations
-
Primary
Get directions
8161 Maple Lawn Blvd, Suite 250
Fulton, MD 20759, US
-
Get directions
168 Shoreditch High Street
London, England E1 6HU, GB
-
Get directions
Auro Orbit, Tower 1, 4th Floor
HITEC City, Hyderabad, Telangana 500081, IN
Updates
-
Nearly 86% of open source vulnerabilities from last week weren't scored by the NVD. That's a number worth paying attention to. Between October 26 and November 2, Sonatype Research Labs tracked almost 1.6K open source vulnerabilities, and almost half were rated Critical or High severity by our research team. Developers and AI coding agents are making dependency decisions every day. Those decisions need to be informed by timely, accurate intelligence, not just what's available in public databases. Securing software at the source starts with knowing the risks before they reach your build.
-
-
A big congratulations to our very own Paul Horton on being elected to the FINOS Technical Oversight Committee (TOC)! 👏 Paul will join fellow committee members in shaping FINOS’s technical direction, advising its Governing Board, and supporting the governance and growth of open source projects across the financial services ecosystem. We're proud to see your expertise helping move open source forward.
Hello FINOS Community, the TOC ( Gábor Lipták, ⚙️ Eddie Knight, Matthew Bain, Elspeth Minty, John Arroyo, Flamur Gogolli, Andrew Aitken, Maria McParland, Ganesh Harke, Erick Bourgeois, Boris Litvin), and the Board! We’re delighted to share the results of the latest FINOS Technical Oversight Committee (TOC) election, welcoming two new members and two returning members to the committee. The TOC helps shape FINOS’s technical direction, advises the Governing Board, and supports the governance, health, and growth of our projects. That work depends on people willing to contribute their time, experience, and judgment to the community. Before introducing our elected members, we want to express a heartfelt 𝗧𝗵𝗮𝗻𝗸 𝗬𝗼𝘂 𝘁𝗼 𝗝𝗼𝗻 𝗔𝗿𝗿𝗼𝘆𝗼 (𝘾𝙞𝙩𝙞) 𝗮𝗻𝗱 𝗔𝗻𝗱𝗿𝗲𝘄 𝗔𝗶𝘁𝗸𝗲𝗻 (𝙄𝙣𝙙𝙚𝙥𝙚𝙣𝙙𝙚𝙣𝙩), who are stepping down from the committee. Thank you both for your leadership, thoughtful insights, and commitment to FINOS. We are deeply grateful for your contributions and look forward to continuing to work with you across the community! Please join us in welcoming and congratulating: • James Gough (𝙈𝙤𝙧𝙜𝙖𝙣 𝙎𝙩𝙖𝙣𝙡𝙚𝙮, 𝗻𝗲𝘄𝗹𝘆 𝗲𝗹𝗲𝗰𝘁𝗲𝗱). Jim is a lead maintainer of FINOS CALM and leads Morgan Stanley’s firmwide API Program. His contributions span the CALM schema, CALM Hub, and the tooling and documentation that help teams put architecture as code into practice. A Java Champion and co-author of 𝘔𝘢𝘴𝘵𝘦𝘳𝘪𝘯𝘨 𝘈𝘗𝘐 𝘈𝘳𝘤𝘩𝘪𝘵𝘦𝘤𝘵𝘶𝘳𝘦, Jim brings hands-on experience connecting open-source development with enterprise adoption. Welcome, Jim - we’re looking forward to working with you! • Paul Horton (𝙎𝙤𝙣𝙖𝙩𝙮𝙥𝙚, 𝗻𝗲𝘄𝗹𝘆 𝗲𝗹𝗲𝗰𝘁𝗲𝗱). Paul leads Sonatype’s Open Source Program Office, is a Core Maintainer of OWASP CycloneDX, and maintains FINOS OSERA Remediation Standards. He brings extensive experience in financial services, open-source governance, and software supply chain security, with a focus on practical approaches to transparency, vulnerability remediation, and sustainable maintenance. Welcome, Paul - we’re excited to have your perspective on the committee! • Elspeth Minty (𝙍𝘽𝘾 𝘾𝙖𝙥𝙞𝙩𝙖𝙡 𝙈𝙖𝙧𝙠𝙚𝙩𝙨, 𝗿𝗲𝘁𝘂𝗿𝗻𝗶𝗻𝗴). Elspeth has served on the TOC since its early days and previously chaired the InnerSource and Open-Source Readiness SIGs. She has helped firms navigate open-source contributions, supported projects throughout their lifecycle (including CDM’s graduation) and championed collaboration across financial services. We’re delighted to continue benefiting from her experience, institutional knowledge, and commitment to helping projects thrive! • Flamur Gogolli (𝘼𝙢𝙖𝙯𝙤𝙣 𝙒𝙚𝙗 𝙎𝙚𝙧𝙫𝙞𝙘𝙚𝙨, 𝗿𝗲𝘁𝘂𝗿𝗻𝗶𝗻𝗴). Flamur maintains HTC-Grid and Open Resource Broker and helped organize the FINOS HPC initiative. His contributions span project onboarding, technical collaboration, community hackathons, and advocacy at OSFF and beyond. He brings practical experience from both banking and cloud infrastructure, with a focus on interoperability, adoption, and healthy maintainer communities. We’re delighted to have him continue for a second term! The strength of FINOS comes from people who step up: not only to build technology, but also to do the governance and community work that helps it succeed. Please join us in congratulating 𝗝𝗶𝗺, 𝗣𝗮𝘂𝗹, 𝗘𝗹𝘀𝗽𝗲𝘁𝗵, 𝗮𝗻𝗱 𝗙𝗹𝗮𝗺𝘂𝗿, and in thanking 𝗝𝗼𝗻 𝗮𝗻𝗱 𝗔𝗻𝗱𝗿𝗲𝘄 once again for everything they have contributed. 𝙈̲𝙖̲𝙠̲𝙚̲ 𝙨̲𝙪̲𝙧̲𝙚̲ 𝙩̲𝙤̲ 𝙘̲𝙤̲𝙢̲𝙚̲ 𝙩̲𝙤̲ 𝙊̲𝙎̲𝙁̲𝙁̲ 𝙉̲𝙔̲𝘾̲ 𝙩̲𝙤̲ 𝙢̲𝙚̲𝙚̲𝙩̲ 𝙩̲𝙝̲𝙚̲ 𝙏̲𝙊̲𝘾̲ -̲ 𝙣̲𝙚̲𝙬̲ 𝙖̲𝙣̲𝙙̲ 𝙤̲𝙡̲𝙙̲ -̲ 𝙞̲𝙣̲ 𝙥̲𝙚̲𝙧̲𝙨̲𝙤̲𝙣̲!̲ Thank you, 𝘗𝘦𝘵𝘦𝘳 & 𝘔𝘢𝘳𝘪𝘢
-
Ethereum as a dead drop; npm as the delivery vehicle. Sonatype Research Labs is tracking six submitted releases that hid a loader that queried transaction data to find its next JavaScript stage, then launched it through Node. A blockchain lookup tucked inside otherwise ordinary packages. Review the code that actually runs in your environment, and investigate unexpected behavior in dependencies, even if the package seems routine. Details in Sonatype Guide: https://lnkd.in/gHX8mGTt
-
87% fix rate. 6.8 days to remediate. And a whole lot less time spent cleaning up vulnerable code. For Mühlbauer ID Services, securing software that supports critical government identity systems isn't optional. But manually reviewing thousands of components and chasing a growing vulnerability backlog wasn't sustainable either. So they changed the approach: stop insecure components before they enter development, automate security decisions, and give developers more time to actually develop. The results speak for themselves. And they reinforce something we've been saying for a while: the best way to fix security debt is to stop accumulating it in the first place. Swipe through to see how Mühlbauer made the shift. 👇 Full customer story: https://lnkd.in/gYT8-f5E
-
In his latest Fast Company piece, Sonatype CEO Bhagwat Swaroop explains why confidence – not code generation – is becoming the next AI bottleneck. AI is producing more software than ever, but measuring how much code gets created tells only part of the story. Leaders also need a clear view of what happens to that output before it reaches production: how much rework it requires, what risks emerge, and how much human oversight is needed. Read Bhagwat’s perspective on how organizations should rethink software productivity for the AI era: https://lnkd.in/geYXFbJe
-
Heading to KubeCon + CloudNativeCon North America? So are we. Stop by Booth #208 to meet the Sonatype team and see how to keep risky components out of your builds without slowing development down. Then put your skills to the test at Activation Zone #108 with our Blind Build Challenge. Think you have what it takes to build fast and ship with confidence? See you there!
-
-
Government agencies have AI policies, but do they actually know what AI is running in their environments? That's the problem with shadow AI. And it's bigger than employees using unapproved chatbots. Sonatype Research Labs analyzed 9,658 Hugging Face requests across a set of customers in H1 2026. Nearly 7% were blocked or rejected by policy, which says models are raising governance questions traditional policies were not built for. Read more: https://lnkd.in/gNhKuiJY
-
Our Co-founder and CTO Brian Fox will be taking the stage twice at the FINOS Open Source in Finance Forum (OSFF) next week! Don't miss his talk and keynote panel, covering software supply chain security in the age of AI, both on November 5. Want to learn more? Sonatype will be at Booth T6.
-
-
Malicious packages. Quick reflexes. Bragging rights. The Sonatype team is in Nuremberg for it-sa Expo & Congress, and we're putting your threat-spotting skills to the test. Stop by booth 7-547 over the next two days to play Catch the Threat. Spot malicious and vulnerable packages, beat the clock, and climb the leaderboard. 🏆 Top scorers have a shot at personalised luggage tags and a LEGO gift set.
-