SonarQube Hunter Agent vs SAST and Penetration Testing
On this page
Quick answer
Use SAST/SCA, Hunter Agent, and penetration testing as separate evidence layers:
- SAST/SCA finds known patterns, unsafe data flows, secrets, and dependency risks consistently as code changes.
- Hunter Agent uses playbook-based full-codebase reasoning to look for broken access control, business-logic flaws, and authentication or session gaps.
- Penetration testing examines a deployed target, including configuration, identity, infrastructure, integrations, runtime state, and chained attack paths.
No layer proves complete security. The useful decision is which blind spot each covers, how often it runs, and who resolves conflicting or overlapping evidence.
Layer comparison
| Layer | Primary evidence | Strong fit | Important blind spot |
|---|---|---|---|
| SAST | Source and data-flow patterns | Injection, insecure patterns, secrets, deterministic rules | Business intent may not be encoded in a detectable pattern |
| SCA | Dependency inventory and advisories | Known vulnerable components, licenses, supply-chain facts | Custom application authorization and workflow logic |
| Hunter Agent | Full-codebase playbooks and reasoning | Access-control, workflow-abuse, auth and session hypotheses | Deployed configuration and external attack surface may be absent |
| Manual code review | Architecture, code, domain context | Novel logic, design assumptions, sensitive changes | Time, consistency, and reviewer coverage |
| Penetration test | Running application and reachable environment | Exploit chains, deployment drift, identity, infrastructure, runtime behavior | Point-in-time scope and limited source visibility |
| Security tests | Executable expected behavior | Regression and release gating for known requirements | Only scenarios the team designed and maintained |
Sonar’s product page calls the Hunter result confirmed, but confirmation within one product’s method is not the final organizational risk decision. Reproduce or otherwise validate the path, determine whether it is reachable in the deployed asset, and apply your severity method.
Build a layered operating loop
Every change
Run deterministic checks, unit and security tests, dependency analysis, secret scanning, and policy gates. Require code-owner review for sensitive authorization, payment, account-recovery, or session changes.
On risk-based schedule or demand
Run Hunter Agent on important projects and after changes to identity, access, workflows, data isolation, recovery, rate limits, or session behavior. Record the scanned commit and excluded scope so the result has a clear freshness boundary.
On a deployed target
Use targeted security testing during development and independent penetration testing by asset risk, material release, architecture change, and compliance need. Include APIs, user roles, tenant isolation, network controls, cloud configuration, third-party integrations, and business workflows.
After every valid finding
Assign one root cause and owner. Capture affected assets and versions, exploit preconditions, impact, severity, fix, tests, deployment, verification, residual risk, and closure approval. Feed logic flaws into deterministic regression tests even when the initial discovery came from an agent or pentester.
Evaluate Hunter Agent’s incremental value
Use a fixed corpus containing known positives, negative controls, previously fixed issues, and representative code. Measure:
- unique valid findings not found by current layers;
- overlap and root-cause deduplication;
- false positives, false negatives, and ambiguous results;
- reviewer effort and time to verified remediation;
- recurrence after fix and quality of regression tests;
- scan freshness, failure rate, access, and cost.
Avoid vendor performance numbers unless the test population, definition, date, and method match your environment. Your own accepted evidence should drive adoption.
Continue with the Hunter Agent GA guide for availability, the logic-vulnerability guide for test cases, and the readiness check for a local layer review.
Frequently asked questions
Does Hunter Agent replace SAST?
No. Sonar explicitly positions it as a complement to existing SAST.
Does Hunter Agent replace penetration testing?
No. A penetration test can examine deployed configuration, identity, infrastructure, integrations, and chained runtime behavior from an attacker’s perspective.
Which layer should run most often?
Run deterministic checks with code changes, invoke Hunter Agent by risk and change, and use targeted plus periodic manual testing for deployed paths.
How should overlapping findings be handled?
Deduplicate by root cause and affected asset while retaining provenance. Use one accountable remediation and closure decision.
Official sources
- Sonar: Hunter Agent GA and layered positioning
- Sonar: SAST, SCA, and Hunter Agent product comparison
Source check: August 29, 2026. This comparison is an evaluation framework, not a claim that any tool or test establishes complete coverage.