Sonatype IQ Server 202 and 202.1: Why this release matters for enterprise software supply chain governance
Enterprise software delivery now depends on proving that security controls are applied consistently across every build, container image, and release gate. Security leaders are no longer asking whether software supply chain controls exist. They are asking whether those controls are measurable, repeatable, and visible across the organization.
Sonatype IQ Server focuses on that exact operating model. The release improves container scanning consistency, centralizes CI evaluation settings, and expands enterprise reporting. These changes matter because software supply chain risk is managed through operational discipline, not isolated scans.
Organizations can review broader platform context through Sonatype Lifecycle official documentation and software supply chain best practices from NIST Secure Software Development Framework.
Container scanning becomes the operational baseline
Container security is now part of every enterprise application release. When different scanners produce different findings, policy enforcement becomes inconsistent and security teams lose trust in the process.
Sonatype IQ Server now defaults to the Sonatype Container Scanner. This aligns container scanning with Sonatype’s own vulnerability intelligence, which improves consistency across pipelines and developer workflows.
For enterprise programs, this creates measurable benefits:
- Standardized container findings across business units
- Consistent policy enforcement across application portfolios
- Better scan performance for high-volume CI/CD environments
- Reduced policy exceptions caused by scanner discrepancies
