Westcon-Comstor has signed a multi-region distribution agreement with Sonar, making SonarQube, Sonar’s code verification platform, available to channel partners across Europe, the Middle East and Africa (EMEA) and Asia-Pacific (APAC).
The agreement gives partners another way to expand their DevSecOps offerings as customers adopt AI-assisted development, while also managing the security and governance risks that come with it.
SonarQube targets security risks in AI-generated code
Sonar, through its SonarQube offering, provides automated code verification designed to identify security vulnerabilities, exposed secrets, and other code issues before software reaches production.
As AI becomes more prevalent in software development workflows, development and security teams face growing pressure to maintain speed without introducing new risks into production environments.
According to Sonar research, SonarQube users are 44% less likely to report production outages caused by AI-generated code. The company also said that maintaining code quality with Sonar can reduce token usage by 7% to 8%, with further reductions possible when AI agents are given context under governance.
“Organisations are embracing AI to accelerate software development, but speed only creates value if teams can trust what gets shipped,” said Scott Musson, vice president of worldwide channel at Sonar.
“Together, we can help partners support organisations as they scale AI and agentic coding with stronger verification, clearer governance, and greater confidence in every line of code.”
AI-assisted development raises code governance concerns
Furthermore, Sonar is positioning its Agent Centric Development Cycle (AC/DC) methodology as a framework for managing AI-assisted development.
The approach follows what the company calls “Guide-Verify-Solve,” where teams provide AI agents with defined context and constraints, verify their output through multiple feedback loops, and address issues before they become a production risk.
Sonar has also expanded its AI development capabilities through its acquisition of Gitar, adding AI-powered code review alongside its existing code analysis and verification technology.
Partners can build services around AI code governance
For partners, the agreement is expected to create opportunities to add code verification and AI governance capabilities to existing DevSecOps and application security offerings.
Westcon-Comstor said it will support partners through technical enablement, market intelligence, data-driven lead generation, and assistance with customer adoption and renewals.
The distributor is also framing the partnership around the broader shift-left movement, which pushes security testing and remediation earlier into the software development lifecycle.
“The rapid adoption of AI-assisted software development, combined with the shift-left movement, is creating new openings for partners as software quality, governance and security become board-level priorities,” said Adam Davison, senior director of vendor acquisition at Westcon-Comstor.
Channel Insider recently spoke with Westcon-Comstor APAC executive vice president and chief marketing officer Patrick Aronson about the growing shift toward services-led business models. Read more about his insights on AI, cybersecurity, and where partners are finding opportunities across APAC.