Your code can pass every quality check. But do you really understand the health of your software?
A technical finding is one piece of a larger decision.
Modern organisations use many tools to measure software quality and security. A scanner may find a vulnerable dependency. A quality platform may show duplication or rising complexity. Repository telemetry may reveal a fragile ownership pattern. Each is useful—and each sees only part of the system.
Technical assessment becomes broader when the question changes from “what issue exists?” to “what does this mean for supportability, ownership, investment or remediation?” That shift does not make specialist tools less important. It makes their evidence more useful in context.
Finding vulnerabilities, assessing maintainability and evaluating a technology investment are related activities—not interchangeable ones.
01 · UNDERSTANDING THE LANDSCAPE
Five lenses on software condition.
Categories overlap, but their centre of gravity determines the evidence they collect, the people they serve and the decisions they can support.
ASSESSMENT LENS
Code quality
- What it measures
- Defects, duplication, complexity, maintainability and adherence to engineering standards.
- Typical tools
- SonarQube, CodeScene, Qodana
- Primary users
- Developers, engineering leads and platform teams
- Question it answers
- Can we keep this code understandable and change it safely?
01Code quality
Defects, duplication, complexity, maintainability and adherence to engineering standards.
- Typical tools
- SonarQube, CodeScene, Qodana
- Primary users
- Developers, engineering leads and platform teams
- Question
- Can we keep this code understandable and change it safely?
Boundary: Code signals alone rarely explain architecture, operating context or investment risk.
02Application security
First-party code weaknesses, vulnerable dependencies, secrets and software-supply-chain exposure.
- Typical tools
- Snyk, Semgrep, Checkmarx, Veracode, GitHub
- Primary users
- Application security, product security and developers
- Question
- Where are exploitable weaknesses entering the software lifecycle?
Boundary: Coverage varies by language, scanner, deployment model and licensed edition.
03External security posture
Signals visible from public websites, endpoints, certificates and internet-facing infrastructure.
- Typical tools
- Compass Scan, HTTP Observatory, Security Headers, SSL Labs, Detectify
- Primary users
- Security teams, site owners, risk teams and consultants
- Question
- What does the deployed system expose from the outside?
Boundary: External observation cannot prove source-code quality or replace an authorised penetration test.
04Engineering intelligence
Change patterns, hotspots, code ownership, delivery flow and trends across teams or repositories.
- Typical tools
- CodeScene and portfolio features in several platforms
- Primary users
- Engineering leaders, architects and transformation teams
- Question
- Where is change becoming slower or organisationally fragile?
Boundary: Repository telemetry needs context; activity is not the same as business value or software fitness.
05Technical assessment & governance
Software condition, architecture, delivery controls and remediation implications in decision context.
- Typical tools
- Compass Assessment; Compass Code is in development
- Primary users
- CIOs, CTOs, investors, audit teams and software owners
- Question
- What does the evidence mean for ownership, investment, transition or remediation?
Boundary: Judgement-led assessment is scoped and contextual; it is not continuous developer feedback or certification.
02 · ORIGINAL EDITORIAL FIGURE
The Software Assessment Landscape
A categorical view of product orientation—not a ranking of quality, maturity or market leadership.
- Code quality
- Application security
- External assessment
- Governance
- Engineering intelligence
Focused engineering evidence
Specialised technical checks close to code, configuration or infrastructure.
Connected engineering platforms
Multiple technical signals, workflows or repositories brought into a broader engineering view.
Focused interpreted assessment
A bounded technical scope translated for stakeholders beyond the immediate engineering workflow.
Cross-domain decision support
Evidence considered across domains and interpreted in an ownership, investment or governance context.
Business-readable outside-in assessment
Compass Scan
Assesses supported public security, readiness, privacy, service and search signals without sign-in or source-code access.
Official sourceView accessible product list
SonarQube
Connected engineering platforms. Measures reliability, maintainability, security, coverage, complexity and duplication, with quality-gate controls.
CodeScene
Connected engineering platforms. Combines change hotspots with Code Health to prioritise maintainability work and follow trends.
Qodana
Focused engineering evidence. Brings JetBrains inspections, baselines and quality gates into developer workflows; some security and governance capabilities are edition-specific.
Snyk
Connected engineering platforms. Scans first-party code, open-source dependencies, containers and cloud configurations, with workflow integrations and policy controls.
Semgrep
Focused engineering evidence. Developer-oriented code, supply-chain and secret detection with configurable rules and CI or SCM workflows.
Checkmarx One
Connected engineering platforms. A multi-scanner platform spanning SAST, SCA, API, IaC, DAST and supply-chain capabilities, subject to package and add-on choices.
Veracode
Connected engineering platforms. Combines static, composition, dynamic and manual testing options with analytics and programme reporting.
GitHub Advanced Security
Focused engineering evidence. Code scanning, dependency review and secret protection integrated into GitHub; availability depends on repository visibility and licensing.
HTTP Observatory
Focused engineering evidence. Checks defensive web standards, especially HTTP headers; it explicitly does not establish that a site is secure.
Security Headers
Focused engineering evidence. A focused, graded view of security-related HTTP response headers with implementation guidance.
SSL Labs
Focused engineering evidence. A non-intrusive assessment focused on effective SSL/TLS configuration, not server exploitation or broader application security.
Detectify
Connected engineering platforms. Discovers internet-facing assets and offers targeted web application testing; this is materially broader and more active than a configuration check.
Compass Scan
Focused interpreted assessment. Assesses supported public security, readiness, privacy, service and search signals without sign-in or source-code access.
Compass Code
Cross-domain decision support. A planned product for source code, dependencies, testing and engineering practices. Public availability has not been announced.
Compass Assessment
Cross-domain decision support. A scoped professional service connecting technical evidence across architecture, delivery and operations to decision and remediation context.
03 · PRODUCT COMPARISON
Compare like with like—and preserve the boundaries.
These views deliberately separate repository and code-analysis products from external website assessment. Statuses describe documented scope, not product quality.
Compass Code and adjacent code-analysis tools
Compass Code is shown as in development. SonarQube, CodeScene and Qodana are established products with meaningful trend, reporting and workflow capabilities.
| Dimension | Compass Code | SonarQube | CodeScene | Qodana |
|---|---|---|---|---|
| Primary purpose | In development Repository-condition assessment for technical and decision context. Source, Blue Top Compass, reviewed 2026-10-22 | Supported Continuous static analysis and quality gates. Source, Sonar, reviewed 2026-10-22 | Supported Prioritised maintainability using code health and change hotspots. Source, CodeScene, reviewed 2026-10-22 | Supported JetBrains inspections and quality control in CI and IDE workflows. Source, JetBrains, reviewed 2026-10-22 |
| Maintainability & technical debt | In development Planned repository observations and contextual findings; not publicly available. Source, Blue Top Compass, reviewed 2026-10-22 | Supported Maintainability issues, duplication and complexity metrics inform quality gates. Source, Sonar, reviewed 2026-10-22 | Supported Code Health, hotspots and trends are central product concepts. Source, CodeScene, reviewed 2026-10-22 | Supported Inspection findings, baselines and gates help teams constrain new debt. Source, JetBrains, reviewed 2026-10-22 |
| Historical trends | In development Internal preview work exists, but public availability is not announced. Source, Blue Top Compass, reviewed 2026-10-22 | Supported Project and portfolio measures distinguish new code and overall code. Source, Sonar, reviewed 2026-10-22 | Supported Historic Code Health trends and dashboards are documented. Source, CodeScene, reviewed 2026-10-22 | Edition-specific Cloud history retention and organisational insights vary by edition. Source, JetBrains, reviewed 2026-10-22 |
| Business & governance interpretation | In development The intended differentiator is contextual assessment; it must not be treated as released. Source, Blue Top Compass, reviewed 2026-10-22 | Partially supported Portfolio measures and governance controls are documented; the core model remains code quality. Source, Sonar, reviewed 2026-10-22 | Partially supported Leadership dashboards and organisational risk indicators extend beyond file-level findings. Source, CodeScene, reviewed 2026-10-22 | Edition-specific Organisation-level reporting and insights depend on edition. Source, JetBrains, reviewed 2026-10-22 |
| Availability | In development Coming soon; register interest only. Source, Blue Top Compass, reviewed 2026-10-22 | Supported Commercial and community deployment options exist; exact capabilities vary by edition. Source, Sonar, reviewed 2026-10-22 | Supported Commercial platform with plan-specific capabilities. Source, CodeScene, reviewed 2026-10-22 | Edition-specific Community, Ultimate and Ultimate Plus differ materially. Source, JetBrains, reviewed 2026-10-22 |
Compass Scan and external assessment tools
A header checker, a TLS analyser, an outside-in report and an active attack-surface platform should not be treated as substitutes.
| Dimension | Compass Scan | HTTP Observatory | Security Headers | SSL Labs | Detectify |
|---|---|---|---|---|---|
| Primary scope | Supported Publicly observable security, readiness, privacy, service and search signals. Source, Blue Top Compass, reviewed 2026-10-22 | Supported HTTP defensive configuration, principally headers and related web standards. Source, MDN, reviewed 2026-10-22 | Supported Security-related HTTP response headers and a grade. Source, Security Headers / Snyk, reviewed 2026-10-22 | Supported Effective public SSL/TLS and PKI configuration. Source, Qualys SSL Labs, reviewed 2026-10-22 | Supported Attack-surface discovery plus active web, API and internal testing products. Source, Detectify, reviewed 2026-10-22 |
| Active vulnerability testing | Not applicable Bounded outside-in checks; not a penetration test or authenticated vulnerability scan. Source, Blue Top Compass, reviewed 2026-10-22 | Not applicable A configuration-focused audit; an A+ does not mean a site is secure. Source, MDN, reviewed 2026-10-22 | Not applicable Focused on response-header analysis. Source, Security Headers / Snyk, reviewed 2026-10-22 | Not applicable Non-intrusive and explicitly does not test exploits. Source, Qualys SSL Labs, reviewed 2026-10-22 | Supported Web application testing crawls and fuzzes authorised targets. Source, Detectify, reviewed 2026-10-22 |
| TLS-specific depth | Partially supported Reports supported transport observations within a broader assessment. Source, Blue Top Compass, reviewed 2026-10-22 | Not applicable The current HTTP Observatory no longer provides specific TLS and certificate analysis. Source, MDN, reviewed 2026-10-22 | Partially supported HSTS is assessed, but this is not a full TLS configuration service. Source, Security Headers / Snyk, reviewed 2026-10-22 | Supported TLS and PKI configuration are the service's core scope. Source, Qualys SSL Labs, reviewed 2026-10-22 | Partially supported Certificate problems sit within a broader external attack-surface scope. Source, Detectify, reviewed 2026-10-22 |
| Business-readable interpretation | Supported Findings explain why an observation matters and what to address next. Source, Blue Top Compass, reviewed 2026-10-22 | Partially supported Scores, recommendations and linked implementation guidance are provided. Source, MDN, reviewed 2026-10-22 | Partially supported Grades and explanatory material aid interpretation but remain technically focused. Source, Security Headers / Snyk, reviewed 2026-10-22 | Partially supported A grade summarises detailed configuration evidence. Source, Qualys SSL Labs, reviewed 2026-10-22 | Partially supported Findings and integrations support remediation; executive-reporting depth was not evaluated hands-on. Source, Detectify, reviewed 2026-10-22 |
| Access model | Supported A public URL; no sign-in or source-code access for the assessment. Source, Blue Top Compass, reviewed 2026-10-22 | Supported Public website scan with public scan history. Source, MDN, reviewed 2026-10-22 | Supported Public website scan; API access requires authorisation. Source, Security Headers / Snyk, reviewed 2026-10-22 | Supported Public SSL website assessment. Source, Qualys SSL Labs, reviewed 2026-10-22 | Supported Ownership verification and authorisation are required for active testing. Source, Detectify, reviewed 2026-10-22 |
“Not applicable” marks a scope boundary; it is not a negative product judgement. Deployment, data residency and detailed licensing terms should be validated directly with each vendor for the edition under consideration.
04 · SELECTED PRODUCT PROFILES
What each product is designed to do well.
Concise profiles based on current official documentation, reviewed on 22 October 2026.
Static analysis and quality gates
SonarQube
- Particularly strong at
- Continuous code-quality controls embedded in delivery workflows.
- Typical use
- Teams enforcing maintainability, reliability and security standards across projects.
- Scope boundary
- It is not a substitute for organisational, architectural or transaction-specific technical assessment.
- Relationship to Compass
- It can supply detailed engineering evidence that a broader Compass Assessment interprets in context.
Behavioural code analysis
CodeScene
- Particularly strong at
- Prioritising technical debt by combining code health with how frequently code changes.
- Typical use
- Modernisation, refactoring prioritisation, knowledge risk and engineering improvement programmes.
- Scope boundary
- Its centre of gravity is repository behaviour and maintainability, rather than deployed external posture.
- Relationship to Compass
- It overlaps with Compass Code's intended maintainability perspective and can complement human-led assessment.
Developer security platform
Snyk
- Particularly strong at
- Broad developer-security coverage across code, open source, containers and cloud configuration.
- Typical use
- Finding and fixing security weaknesses early in developer and delivery workflows.
- Scope boundary
- Its primary purpose is application security, not independent software governance or due-diligence interpretation.
- Relationship to Compass
- Snyk findings can be valuable technical evidence; Compass is not positioned as a replacement for that AppSec depth.
SAST, SCA and secrets
Semgrep
- Particularly strong at
- Configurable, developer-oriented SAST with adjacent supply-chain and secrets products.
- Typical use
- Fast feedback, custom security rules and guardrails in source-control and CI workflows.
- Scope boundary
- Product and plan selection matters; the platform is not an executive technical-assessment service.
- Relationship to Compass
- Semgrep answers detection questions that Compass should treat as complementary evidence.
Repository-native security
GitHub Advanced Security
- Particularly strong at
- Security feedback where developers already review and merge code.
- Typical use
- Code scanning, dependency review and secret protection in GitHub-hosted workflows.
- Scope boundary
- Availability varies by repository visibility and licence; it is focused on repository security controls.
- Relationship to Compass
- It complements, rather than duplicates, the contextual assessment Compass is pursuing.
Repository-condition assessment
Compass Code
- Particularly strong at
- The intended focus is a bounded repository assessment translated into technical and decision context.
- Typical use
- Legacy application baselines, vendor transitions and oversight where repository condition needs explanation.
- Scope boundary
- Compass Code is coming soon and must not be treated as generally available or as a full SAST replacement.
- Relationship to Compass
- Its future role is to connect repository evidence to assessment questions, alongside specialist developer tools.
Business-readable outside-in assessment
Compass Scan
- Particularly strong at
- A lightweight, business-readable view of supported signals visible from a public application.
- Typical use
- Production-facing baselines, periodic external checks and early discovery of configuration or readiness concerns.
- Scope boundary
- It is not authenticated scanning, penetration testing, comprehensive attack-surface management or source-code analysis.
- Relationship to Compass
- It overlaps with focused configuration checkers but covers a broader supported set of public application signals.
Additional AppSec platforms in this review
Checkmarx One
A multi-scanner platform spanning SAST, SCA, API, IaC, DAST and supply-chain capabilities, subject to package and add-on choices.
Checkmarx One product information, Checkmarx, reviewed 2026-10-22Veracode
Combines static, composition, dynamic and manual testing options with analytics and programme reporting.
Veracode product guide, Veracode, reviewed 2026-10-2205 · WHERE COMPASS FITS
Different tools. Different questions. A clearer picture.
Compass is best understood as an additional assessment perspective, not an automatic replacement for specialist engineering or security tooling.
Compass Scan
Compass Scan observes supported signals from publicly accessible applications across security, readiness, privacy, service behaviour and search visibility. It presents findings with evidence and business-readable guidance.
- No source-code or sign-in access for the assessment
- Lightweight, repeatable outside-in baseline
- Not penetration testing or comprehensive attack-surface management
Compass Code
Compass Code is intended to examine repository condition, dependencies, testing and engineering practices, with an emphasis on explaining findings in assessment context.
- Public availability has not been announced
- Not presented as a replacement for dedicated SAST or SCA
- Registering interest does not grant preview access
Conceptual workflow only. Compass does not currently advertise automatic ingestion from the third-party products discussed on this page.
06 · DECISION GUIDE
Which approach does your organisation actually need?
Start with the question and choose the evidence source that can answer it.
“We want to catch code quality issues before deployment.”
Start with static analysis and quality-gate tooling such as SonarQube or Qodana. Add CodeScene when change hotspots and maintainability prioritisation matter.
“We need to find security vulnerabilities in our applications.”
Use dedicated AppSec tooling. Snyk, Semgrep, Checkmarx, Veracode and GitHub provide different combinations of SAST, dependency, secret and governance controls.
“We want to understand our public website's security posture.”
Use an external assessment appropriate to the depth required. Focused tools cover headers or TLS; Compass Scan adds supported cross-domain observations; active testing platforms go further and require explicit authorisation.
“We've inherited a legacy application and don't know its condition.”
Combine repository analysis, dependency evidence and an architecture-aware technical assessment. No single scanner can establish supportability, remediation effort and business impact alone.
“We're changing development vendors.”
Establish a documented baseline, preserve evidence, agree remediation measures and repeat the assessment over time. Independent oversight can separate acceptance evidence from delivery incentives.
“Leadership needs to understand technology risk.”
Use portfolio evidence and contextual reporting. Technical metrics should be translated into consequences, uncertainty, ownership and feasible next actions—not reduced to one score.
07 · INDEPENDENT TECHNICAL OVERSIGHT
When software delivery is outsourced, independent visibility matters.
Outsourcing can be a sound delivery model. The governance challenge is that progress reporting, acceptance evidence and technical condition may all come from the same delivery relationship. During vendor transitions, remediation programmes or ownership changes, an additional technical perspective can help establish a shared baseline.
Consistent measurement makes discussions more concrete: what was examined, what changed, what remains uncertain and what evidence supports acceptance. Independence here means a perspective separate from the delivery team being assessed. It does not mean statutory audit independence, certification or a guarantee that every defect has been found.
- Define scope and authority before examination
- Record evidence and limitations, not only conclusions
- Keep baseline criteria stable across reassessments
- Separate remediation ownership from validation
08 · METHODOLOGY & SOURCES
Transparent about authorship, evidence and limits.
This analysis is prepared by Compass, a product developed by Blue Top Consulting. It is intended to help readers understand the different categories of software assessment tools. Product descriptions are based on publicly available information and may change over time.
Method
- Define categories and axis bands before placing products.
- Review official product documentation and current Compass materials.
- Separate documented capability from Compass editorial interpretation.
- Use edition-specific or not-verified states where evidence is conditional.
- Avoid universal scores, inferred absence and feature-count rankings.
Limitations
- No comparative hands-on product testing was performed.
- Plan entitlements and product names can change.
- The review is selective, not an exhaustive market directory.
- Matrix placement describes primary orientation, not quality or maturity.
- Compass authored the analysis and is an interested vendor.
Official sources consulted
- Compass Scan product pageBlue Top Compass · reviewed 22 Oct 2026
- Compass Code product statusBlue Top Compass · reviewed 22 Oct 2026
- Compass Assessment serviceBlue Top Compass · reviewed 22 Oct 2026
- Understanding measures and metricsSonar · reviewed 22 Oct 2026
- CodeHealth metricCodeScene · reviewed 22 Oct 2026
- About QodanaJetBrains · reviewed 22 Oct 2026
- Snyk user documentationSnyk · reviewed 22 Oct 2026
- Semgrep product and plan capabilitiesSemgrep · reviewed 22 Oct 2026
- Checkmarx One product informationCheckmarx · reviewed 22 Oct 2026
- Veracode product guideVeracode · reviewed 22 Oct 2026
- GitHub security featuresGitHub · reviewed 22 Oct 2026
- HTTP Observatory FAQMDN · reviewed 22 Oct 2026
- About Security HeadersSecurity Headers / Snyk · reviewed 22 Oct 2026
- SSL Labs assessment activitiesQualys SSL Labs · reviewed 22 Oct 2026
- Detectify product scopeDetectify · reviewed 22 Oct 2026
09 · FREQUENTLY ASKED QUESTIONS
Questions teams ask when tools overlap.
Is Compass an alternative to SonarQube?
Not as a direct replacement. SonarQube is built for continuous static analysis and quality gates. Compass Code is still in development, while Compass Assessment provides a scoped, human-led interpretation of software condition and decision risk.
Does Compass replace Snyk or Semgrep?
No. Snyk and Semgrep provide specialist application-security capabilities. Compass does not claim equivalent SAST, SCA or secret-detection breadth.
What's the difference between Compass Scan and Compass Code?
Compass Scan observes supported signals from a publicly accessible application without source access. Compass Code is a coming-soon repository assessment focused on source, dependencies, testing and engineering practices.
Can multiple assessment tools be used together?
Yes. Code quality, AppSec, external posture and human assessment often produce complementary evidence. Compass does not currently advertise automatic third-party finding ingestion; the workflow shown here is conceptual.
How does technical assessment differ from static code analysis?
Static analysis applies repeatable rules to code. Technical assessment can also consider architecture, operating context, delivery practices, uncertainty and the decision an organisation needs to make.
Do we need to give Compass access to our source code?
Not for Compass Scan, which uses public outside-in observations. A future Compass Code assessment will require authorised read access to a supported repository. Human-led Compass Assessment access is agreed in the engagement scope.
Can Compass help with legacy applications?
Blue Top can scope a Compass Assessment around maintainability, architecture, dependencies, delivery and remediation concerns. Compass Code is not yet publicly available.
How can organisations monitor technical debt over time?
Define a baseline, keep measurement criteria stable, track both new and resolved concerns, and connect trends to change activity and remediation decisions. Established tools already provide several forms of trend analysis.
What should businesses consider during a software vendor transition?
Clarify ownership and access, baseline the software and environments, record unresolved risks, verify operational knowledge transfer, and agree evidence for remediation and acceptance.
What should an effective technical assessment report contain?
Scope, methods, observed evidence, limitations, findings, severity rationale, business context, prioritised actions, ownership, and enough provenance for another reviewer to understand the conclusion.
