Integrate Sonatype Nexus IQ with Vulnetix. Use the Nexus IQ CLI to scan components and export findings in SARIF or CycloneDX format for upload to Vulnetix.
Run Sonatype Nexus IQ in CI
Scan on every push and upload the report as a workflow artifact:
- name: Setup Java
uses: actions/setup-java@v4
with:
java-version: '17'
distribution: 'temurin'
- name: Download Nexus IQ CLI
run: curl -L https://download.sonatype.com/clm/scanner/nexus-iq-cli.jar -o nexus-iq-cli.jar
- name: Run Nexus IQ scan
run: |
java -jar nexus-iq-cli.jar -s "$IQ_SERVER_URL" -a "$APP_ID" .
env:
IQ_SERVER_URL: ${{ secrets.IQ_SERVER_URL }}
APP_ID: ${{ secrets.NEXUS_APP_ID }}
How Vulnetix compares: better together
Vulnetix does not replace Sonatype Nexus IQ. Keep running it. Vulnetix sits on top of Sonatype Nexus IQ (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Sonatype Nexus IQ is strongest at its core category and also carries features in License Compliance, SBOM Generation, Container & Image Scanning, just as Vulnetix spans categories.
| Capability | Vulnetix | Sonatype Nexus IQ |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ Core: enterprise SCA with Sonatype curated data + OSS Index, transitive deps |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ~ Container image scanning; can limit to OS components via env var |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✓ License compliance/policy is a first-class Lifecycle capability |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ SBOM Manager generates/ingests CycloneDX and SPDX |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✓ Repository Firewall blocks Zscaler-verified malware at download time |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ~ EPSS score and CISA KEV status policy constraints (Firewall, IQ Server 199) |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ~ Reachability analysis marks vulnerable methods reachable/not-reachable |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ~ VEX workflow support in SBOM Manager; not described as immutable-versioned |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ Automated remediation pull requests / upgrade recommendations |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ~ Component end-of-life / age tracking |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Sonatype Nexus IQ does well
- Deep component intelligence backed by Sonatype's curated vulnerability data (beyond raw NVD) and the 185M+ OSS Index, with best-in-class Java/Maven depth
- Repository Firewall blocks malicious/policy-violating components at proxy download time (Zscaler-verified malware), stopping supply-chain risk before it enters the build
- Mature, granular policy engine enforceable across every SDLC stage with waivers, plus automated remediation pull requests
- Reachability analysis labels reachable vs not-reachable violations, and SBOM Manager (CycloneDX + SPDX) supports compliance
Where Vulnetix adds to it: Vulnetix layers on top of Nexus IQ rather than replacing its component intelligence: it ingests Sonatype findings alongside SAST, ingested DAST, container, IaC, secrets and cloud scanners and dedupes them into one prioritised queue. Where Nexus IQ is SCA-centric, Vulnetix natively adds SAST (built-in + Semgrep), IaC, cloud/CSPM and secrets, and adds richer exploit-intel (EPSS, KEV, Coalition ESS, CWSS, Vulnetix LEV), immutable versioned VEX with audit, SSVC policy, and Safe Harbour autofix across the full finding set, not just open-source components. Vulnetix does not run its own DAST/pentest; it consolidates those results.
No migration, no rip-and-replace. Sonatype Nexus IQ keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Sonatype Nexus IQ results in Vulnetix
Upload Sonatype Nexus IQ SARIF, CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.