Sonatype

Sonatype

OSS governance and security platform

Overview

Sonatype focuses on helping organizations manage and secure their use of open-source software. Its Nexus Platform automates DevOps workflows and governs open-source usage, covering the software supply chain from building and storing artifacts to checking for security defects across the SDLC. Its OSS Edition offers free artifact management, while paid offerings like Nexus Repository Manager Professional and Nexus Lifecycle add high-availability, security defect detection, and risk elimination features. The company differentiates itself by specializing in open-source governance and software security across the entire development lifecycle, serving IT leaders, developers, and industries such as healthcare. Its goal is to enable safe, efficient, and compliant use of open-source software to improve software quality and security.

About Sonatype

Simplify's Rating
Why Sonatype is rated
B
Rated A on Competitive Edge
Rated B on Growth Potential
Rated C on Differentiation

Industries

Enterprise Software

Cybersecurity

Company Size

501-1,000

Company Stage

Growth Equity (Venture Capital)

Total Funding

$154.7M

Headquarters

Fulton, Missouri

Founded

2008

Get referred to Sonatype

See people who can refer or advise you

Simplify Jobs

Simplify's Take

What believers are saying

  • August 18, 2026 Guide Agent P automates dependency fixes across human and AI workflows.
  • January 2026 research logged 1.233 million malicious packages, sharpening Sonatype's urgency story.
  • June 2026 leadership hires strengthen revenue, marketing, and people execution for AI growth.

What critics are saying

  • GPT-5 hallucinated 27.8% of component versions, weakening Sonatype's agentic-development promise.
  • Open-source malware reached 1.233 million packages; attackers bypass Sonatype customers before controls engage.
  • If hyperscalers bundle native guardrails, Guide becomes optional middleware and Sonatype loses pricing power.

What makes Sonatype unique

  • Maven Central stewardship gives Sonatype unmatched open-source telemetry and developer trust.
  • Nexus Repository Cloud, launched October 2025, adds managed SaaS artifact control at scale.
  • Guide embeds governance at selection time, unlike scanners that react after code lands.

Help us improve and share your feedback! Did you find this helpful?

Funding

Total Funding

$154.7M

Above

Industry Average

Funded Over

6 Rounds

Notable Investors:
Growth Equity VC funding comparison data is currently unavailable. We're working to provide this information soon!
Growth Equity VC Funding Comparison
Coming Soon

Benefits

Distributed Workforce - Walls don’t make a company great, people do — and we have the best. While we have offices in the US in Maryland and Virginia, and also in London and Sydney, our growing and talented team lives and works anywhere and everywhere.

Mission Driven - We’re helping software developers harness the power of open source, while making software safer. What does that mean for you? An opportunity to join a smart, mission-oriented team that is changing how software is made.

Competitive Salary & Benefits - We believe in taking care of our team. That means more than just interesting work — it's great benefits, competitive compensation packages, flexible schedules, and an endless opportunity to learn and grow.

Open, Transparent, Diverse - Our varied experiences, locations, ethnicities, genders, and sexual orientations, make us a better company. That's why we're committed to bringing different backgrounds and perspectives into our organization.

Growth & Insights and Company News

Headcount

6 month growth

-1%

1 year growth

-1%

2 year growth

1%
Associated Press
Aug 18th, 2026
Sonatype launches Agent P to automate software fixes as AI accelerates app development 5×

Sonatype has launched new capabilities for its Sonatype Guide platform, including Agent P for automated software maintenance and Security Events for real-time incident monitoring. The company aims to help enterprises manage software development accelerated by AI. A new report from Sonatype Research Labs analysing four years of enterprise development data found that application creation has accelerated nearly fivefold in the AI era. However, modern applications now carry over four times more critical and high-severity vulnerabilities. The platform enables developers to apply organisational policies at the point of component selection and automate dependency management. Agent P upgrades components, validates changes, and resolves compatibility issues before developer review. Sonatype Guide is available for free at guide.sonatype.com.

Business Upturn
Jul 29th, 2026
Sonatype and Forrester address the growing ai-era Software Supply Chain Risk facing Indian enterprises in the guru forum.

Sonatype and Forrester address the growing ai-era Software Supply Chain Risk facing Indian enterprises in the guru forum. -Advertisement- Discover more Research from Sonatype and Forrester examines how AI is driving precision software supply chain attacks - and what this means for software governance, enterprise resilience, and responsible AI adoption across highly regulated industries. HYDERABAD, India, July 29, 2026 /PRNewswire/ - Sonatype(R), the company helping enterprises accelerate agentic software development with confidence, is bringing together technology, cybersecurity, and business leaders in India in association with Forrester to examine how artificial intelligence is reshaping software supply chain risk - and what enterprises must do to respond. The discussion is informed by Sonatype's latest research, The Trust Economy of Software: How AI is Reshaping Software Supply Chain Risk for Financial Services. Based on an analysis of 9,747 verified malicious package advisories between January 2020 and May 2026, along with enterprise telemetry from the financial services sector, the study reveals a fundamental change in attacker behaviour. Software supply chain attacks are no longer driven primarily by scale. Attackers are increasingly using precision campaigns designed to impersonate trusted software, target developers, and influence component-selection decisions before code reaches production. The implications are especially significant for India, one of the world's fastest-growing software development hubs and a global centre for financial technology, digital engineering, and Global Capability Centres. As Indian enterprises and GCCs expand their use of open-source software, third-party components, and AI-assisted development, the ability to govern what enters the software lifecycle is becoming a strategic business priority. "AI is helping development teams assemble software faster, but it is also accelerating the number of decisions they make about what software to trust. Attackers understand that shift. They are no longer relying only on scale; they are investing in precision attacks that look familiar, targeting developers directly, and executing before traditional controls have a chance to intervene. For Indian enterprises and GCCs, the priority is not to slow AI adoption. It is to establish trusted governance at the point where software enters development," said Abhishek Chauhan, Senior Director of Technology and India Country Head, Sonatype. Sonatype's research found: * Targeted malicious package advisories increased 75-fold in two years, rising from 28 in 2023 to 1,576 in 2025. * 47% of malicious packages now impersonate trusted software, using familiar names, integrations, and utilities to appear legitimate. * 53% of malicious packages analysed in 2025 targeted developers during installation, before traditional security controls could intervene. * More than one in four malicious package advisories now uses advanced techniques, including obfuscation, multi-stage droppers, and backdoors. The findings highlight the need for enterprises to move beyond reactive vulnerability management by ensuring security begins before a component enters the build, not after it reaches production. Speaking at the event was Ashutosh Sharma, VP, Principal Analyst, Forrester. Software development is entering a new phase as AI changes not only how code is written, but also how software components are discovered, selected, and integrated. As organizations accelerate AI adoption, governance must evolve alongside development practices. Understanding how software trust is established and how software supply chain risks are changing will become increasingly important for organizations seeking to balance innovation with resilience. For India's financial institutions, digital-native enterprises, and GCCs, the opportunity is clear: lead the next phase of AI-driven software development by governing software assembly with the same speed and discipline with which it is being created. As open-source and AI-assisted workflows become central to innovation, software confidence must move beyond compliance to become a source of competitive advantage - enabling faster delivery, stronger resilience, and more trustworthy AI adoption. About Sonatype: Sonatype is the company that accelerates agentic software development with confidence. Trusted by thousands of enterprises and millions of developers, Sonatype helps organizations govern the open-source, AI-generated, and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides unmatched visibility into how software is built, consumed, and secured - helping teams move faster, reduce risk, and ship software with confidence at AI scale. To learn more, visit www.sonatype.com About Forrester: Forrester (Nasdaq: FORR) is one of the most influential research and advisory firms in the world. We empower leaders in technology, customer experience, digital, marketing, sales, and product functions to be bold at work and accelerate growth through customer obsession. Our unique research and continuous guidance model help executives and their teams achieve their initiatives and outcomes faster and with confidence. To learn more, visit www.Forrester.com View original content to download multimedia:https://www.prnewswire.com/in/news-releases/sonatype-and-forrester-address-the-growing-ai-era-software-supply-chain-risk-facing-indian-enterprises-in-the-guru-forum-302837277.html Disclaimer: The above press release comes to you under an arrangement with PR Newswire. Business Upturn takes no editorial responsibility for the same. -Advertisement-

Associated Press
Jun 9th, 2026
Sonatype appoints three executives to scale AI-driven software development growth

Sonatype has appointed three executives to lead its expansion in AI-driven software development. Casey Watson joins as chief revenue officer, Jason McClelland as chief marketing officer, and Sherri Manning as chief human resources officer. Watson brings over 30 years of IT experience, most recently serving as SVP of Sales for North America at OneTrust, with previous roles at VMware Tanzu and Docker. McClelland arrives from positions at Salesforce, Adobe and DataStax, whilst Manning comes from Olo, where she served as chief people officer. The appointments support Sonatype's growth strategy as demand increases for secure, AI-driven software development. The company, which operates Maven Central and Nexus Repository, helps organisations manage open source, AI-generated and third-party software components.

Alabama Business Reporter
Jun 9th, 2026
Sonatype names three industry veterans to executive team to lead the next chapter of agentic development.

Sonatype names three industry veterans to executive team to lead the next chapter of agentic development. New leaders bring deep expertise in scaling organizations and strengthening market leadership growth amid accelerating demand for secure, AI-driven software development. Fulton, Md., June 09, 2026 (GLOBE NEWSWIRE) - Sonatype(R), the company that accelerates agentic software development with confidence, today announced the appointments of Casey Watson as Chief Revenue Officer (CRO), Jason McClelland as Chief Marketing Officer (CMO), and Sherri Manning as Chief Human Resources Officer (CHRO). These appointments come at a pivotal moment for Sonatype as the company scales its go-to-market, revenue, and people strategies to meet growing enterprise demand for secure, AI-driven software development. "Sonatype is operating at the intersection of three of the most important forces in technology today: AI, open source, and cybersecurity," said Bhagwat Swaroop, CEO of Sonatype. "Casey, Jason, and Sherri bring the experience and leadership we need to scale growth, lead our marketing initiatives, and continue building a high-performance culture that matches the pace of AI." Watson brings more than three decades of IT experience across software engineering and senior sales leadership, with a track record of building high-performing teams in complex, high-growth technology organizations. Most recently SVP of Sales for North America at OneTrust, he previously held leadership roles at VMware Tanzu, R3, Siemplify, and Docker. As CRO, Watson will lead Sonatype's global revenue strategy and go-to-market execution, aligning pre- and post-sales efforts to create a more cohesive customer journey. "Organizations today are under increasing pressure to innovate faster while maintaining trust and security across the software supply chain," said Casey Watson, CRO at Sonatype. "Sonatype is uniquely positioned to help customers meet that challenge, and I'm energized by the opportunity to work alongside this talented team to strengthen our customer partnerships, align our go-to-market efforts, and help organizations innovate securely at scale." McClelland joins Sonatype with a track record of creating new categories and leading growth at global enterprise companies, including Salesforce, Adobe, Heroku, and DataStax, with extensive experience in scaling both emerging and legacy technologies to achieve strategic goals. As CMO, he will focus on advancing Sonatype's AI and agentic initiatives to meet evolving customer needs in a dynamic landscape. "I came to Sonatype because I believe this organization holds the critical intelligence required for developers to code quickly and safely with AI," said Jason McClelland, CMO at Sonatype. "Software developers are at the forefront of a dynamic, progressively opaque development ecosystem that is in the midst of upheaval. I'm excited to help build on the legacy of Nexus Repository and Maven Central and support Sonatype by ushering in a new era of developer enablement that starts with foundational control." Manning brings nearly three decades of experience building strong, trusting, and empathetic cultures while scaling global teams at high-growth organizations. Manning comes to Sonatype from Olo, where she was the Chief People Officer, leading HR strategy, focused on employee growth and engagement, after roles at BigCommerce, Q2ebanking. At Sonatype, Manning seeks to deepen the organization's culture to ensure employees are supported and rewarded, enabling them to see the direct impact of their efforts. "I'm excited to be part of a company that puts its people and culture first, creating an environment where employees can thrive and innovate to help keep the world's software safe," said Sherri Manning, CHRO at Sonatype. "Sonatype already has great people doing important work. My mission is to ensure that employees can see the impact they are making in their day-to-day work." The need for secure AI development has never been clearer. With McClelland, Watson and Manning, Sonatype is strengthening its leadership to accelerate strategic growth, drive market leadership, and ensure the company remains the trusted authority in AI-driven DevSecOps, building on the critical foundation of Nexus Repository. To learn more about how Sonatype is advancing safe, compliant AI development with the Nexus One Platform, visit https://www.sonatype.com/products/nexus-one-platform. About Sonatype Sonatype is the company that accelerates agentic software development with confidence. Trusted by thousands of enterprises and millions of developers, Sonatype helps organizations build with confidence by governing the open source, AI-generated, and third-party components that power modern software. As the steward of Maven Central and the company behind Nexus Repository, Sonatype provides unmatched visibility into how software is built, consumed, and secured - helping teams move faster, reduce risk, and ship software with confidence at AI scale. To learn more about Sonatype, please visit www.sonatype.com. Megan Schmidt Sonatype [email protected] Legal Disclaimer: EIN Presswire provides this news content "as is" without warranty of any kind. Alabama Business Reporter do not accept any responsibility or liability for the accuracy, content, images, videos, licenses, completeness, legality, or reliability of the information contained in this article. If you have any complaints or copyright issues related to this article, kindly contact the author above.

Spring
Mar 18th, 2026
Spring Batch 6.0.3 and 5.2.5 available now.

Spring Batch 6.0.3 and 5.2.5 available now. On behalf of the team and all contributors, I am pleased to announce that Spring Batch 6.0.3 and 5.2.5 are available from Maven Central now. These releases come with a number of bug fixes, improvements and documentation updates. The release notes can be found on GitHub: 6.0.3, 5.2.5. These versions will be available respectively through Spring Boot 4.0.4 and 3.5.12. Get ahead. VMware offers training and certification to turbo-charge your progress. Get support. Tanzu Spring offers support and binaries for OpenJDK(TM), Spring, and Apache Tomcat(R) in one simple subscription.

Recently Posted Jobs

Sign up to get curated job recommendations

Sonatype is Hiring for 28 Jobs on Simplify!

Find jobs on Simplify and start your career today

Don't see your dream role? Check out thousands of other roles on Simplify. Browse all jobs →