Global Benefits Manager

Carahsoft and Sonar expand partnership to deliver AI code verification and governance across all North American markets. Agreement extends access to Sonar's solutions through Carahsoft's trusted channel ecosystem, enabling governed, enterprise-scale AI adoption. RESTON, Va., Sept. 09, 2026 (GLOBE NEWSWIRE) - Carahsoft Technology Corp., The Trusted Government IT Solutions Provider(R), today announced that it has expanded its partnership with Sonar, a global leader in AI code verification and governance, to make Sonar's validation platform, SonarQube, available beyond the U.S. Public Sector to all North American markets. Through Carahsoft's partner ecosystem, resellers and services partners, organizations will gain access to the independent, enterprise-scale AI adoption solution trusted by 7m+ developers. Through this expanded agreement, Carahsoft will give Sonar broader reach with organizations that prefer a channel-based purchasing model, enabling streamlined procurement and more deployment processes. The need for solutions like SonarQube heightens as enterprises embed agentic workflows throughout their organizations. According to Sonar's 2026 State of Code Developer Survey, 72% of developers who have tried AI coding tools use them every day, underscoring the need to balance speed with safety and avoid introducing new security, complexity and reliability risks. Together, Carahsoft and Sonar are bringing zero-trust, multilayered verification to more teams across North America. "Enterprises require verifiable, governed adoption of agentic development. Through our expanded partnership with Carahsoft, we will enable more organizations to do just that," said Bill Sullivan, Vice President, North America Channel Sales, at Sonar. "By making our solutions available through Carahsoft's partners, we're empowering teams to contain risk, deploy confidently and ship higher-quality, more secure code in their agentic workflows." The expanded Carahsoft agreement helps organizations across North America apply Sonar to practical AI-development use cases: independently verifying code generated by AI agents before merge; identifying security vulnerabilities, reliability issues and maintainability concerns before they reach production; and establishing consistent code quality and governance standards across teams adopting AI-assisted development. Organizations can also use Sonar's AI-native code review capabilities, expanded through its recent acquisition of Gitar, to review and validate agentic-written code with greater confidence. "We are pleased to expand our partnership with Sonar to bring its zero-trust, multilayered verification solutions to commercial markets across North America, helping reduce outages, improve security and lower costs and risks associated with AI and agentic coding," said Natalie Gregory, Vice President managing DevSecOps Solutions at Carahsoft. "Together, with our network of reseller and services partners, we are uniquely positioned to deliver Sonar's solutions through the channels our customers trust most, enabling IT teams to more efficiently adopt tools that improve code quality, strengthen security and accelerate innovation." Sonar's solutions are available now through Carahsoft's reseller and services partners. For more information, contact the Carahsoft Team at (703) 581-6680 or [email protected]; or register for Sonar's event, SonarQube World Tour in New York on October 15, 2026. Explore Sonar's solutions here. About Carahsoft Carahsoft Technology Corp. is The Trusted Government IT Solutions Provider, supporting Public Sector organizations across Federal, State and Local Government agencies and Education and Healthcare markets. As the Master Government Aggregator(R) for our vendor partners, we deliver solutions for DevSecOps, Cybersecurity, MultiCloud, Artificial Intelligence, Customer Experience and Engagement, Open Source and more. Working with resellers, systems integrators and consultants, our sales and marketing teams provide industry leading IT products, services and training through hundreds of contract vehicles. Visit us at www.carahsoft.com. About Sonar Sonar, a global leader in AI code verification and governance, helps reduce outages, improve security, and lower costs and risks associated with AI and agentic coding. As a zero-trust, multilayered verification platform, Sonar enables organizations to securely develop at the speed of AI, and with the addition of Gitar's AI-native code review, offers the most comprehensive way to verify code in the agentic era. A Leader in the Gartner(R) Magic Quadrant(TM) for Technical Debt Management Tools, Sonar is the foundation for high-performance software engineering - analyzing over 750 billion lines of code daily to ensure applications are secure, reliable, and maintainable. Rooted in the open source community, Sonar is trusted by 7M+ developers globally, including teams at Nvidia, ServiceNow, Booking.com, Goldman Sachs, AstraZeneca, and Ford Motor Company. Cautionary note: Forward-looking statements This press release may contain forward-looking statements about future expectations, plans, and prospects. These statements are based on current beliefs and assumptions and are subject to risks and uncertainties. The information in this press release is provided as of this date, and we undertake no obligation to update any statements. [1]Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner's business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

Westcon-Comstor and Sonar sign multi-region deal to accelerate partners' AI adoption with trusted code verification. Sarah Weston 1 September, 2026 Westcon-Comstor, a global technology distributor specialising in cybersecurity, networking and hybrid cloud solutions, has announced a multi-region distribution agreement with Sonar, a global leader in AI code verification and governance. The partnership provides high-value growth opportunities for channel partners across Europe, the Middle East and Africa (EMEA) and Asia-Pacific (APAC) to help customers securely adopt AI into their software development workflows. The agreement makes Sonar's core platform, SonarQube, available to Westcon-Comstor partners, enabling them to extend their DevSecOps offerings with automated code verification that helps development and security teams identify and remediate security vulnerabilities, exposed secrets and other code issues before software reaches production. According to Sonar research, SonarQube users are 44% less likely to report AI-derived production outages. Additionally, by maintaining code quality with Sonar, users can reduce token usage by 7-8%, with further reductions possible when agents are guided with governed context. As AI agents become more deeply embedded in development workflows, organisations need to maintain the speed benefits of AI without introducing new security risks. Sonar's Agent Centric Development Cycle (AC/DC) methodology gives partners a clear framework for helping customers do so: guide AI agents with the right context and constraints, verify their output through fast, multi-layered feedback loops and resolve issues before they become a production risk. Through this Guide-Verify-Solve approach, partners can help customers build security and governance into AI-assisted development from the outset. Sonar provides automated code analysis that embeds verification directly into AI-driven workflows to reduce outages, improve security and lower costs and risks associated with AI and agentic coding. This gives security and development teams a shared, actionable view of code risk, while supporting faster remediation and stronger governance as software environments become more complex. The company's recent acquisition of Gitar expands its offering with AI code review, giving organisations the benefits of AI-native code review and comprehensive code verification for the highest level of assurance no matter the AI tool. With strong upsell and cross-sell potential, short sales cycles, fast time to revenue and attractive margins, Sonar enables partners to broaden customer relationships and create new recurring revenue streams. Partners will benefit from Westcon-Comstor's value-added distribution model, which supports market entry and growth through technical enablement, market intelligence and data-driven lead generation, alongside support for customer adoption, expansion and renewals. "Sonar is a recognised leader in its field, and this collaboration represents both a compelling commercial opportunity and a strategic technology play for the channel." "The rapid adoption of AI-assisted software development, combined with the shift-left movement, is creating new openings for partners as software quality, governance and security become board-level priorities. At the same time, many organisations are looking to consolidate fragmented development and security toolsets onto a single platform. "By combining Sonar's market-leading solutions with our enablement capabilities, technical expertise and international reach, we're empowering partners across EMEA and APAC to win new customers, expand existing relationships and drive sustainable revenue growth," said Adam Davison, Senior Director, Vendor Acquisition at Westcon-Comstor. "Organisations are embracing AI to accelerate software development, but speed only creates value if teams can trust what gets shipped," said Scott Musson, VP of Worldwide Channel at Sonar. "Westcon-Comstor's global reach, channel expertise and value-added approach make it an ideal distribution partner for expanding Sonar's platform to more customers. Together, we can help partners support organisations as they scale AI and agentic coding with stronger verification, clearer governance and greater confidence in every line of code."

Sonar has launched SonarQube Hunter Agent, an AI-powered security tool designed to detect logic-based vulnerabilities that traditional pattern-based scanning cannot identify. The agent finds broken access control, business-logic flaws, and authentication issues by analysing entire codebases and reasoning through how code, data, and identity flow through systems. Unlike conventional scanning tools that catch coding errors, Hunter Agent identifies vulnerabilities where code functions as written but permits unintended actions, such as unauthorised data access or bypassed checkout flows. These issues traditionally required manual security reviews or penetration testing. The agent operates on a scheduled basis without blocking pull requests or disrupting CI/CD pipelines. Verified findings appear directly in SonarQube's existing workflow, allowing teams to triage issues without switching tools. It complements rather than replaces Sonar's existing static application security testing capabilities.