Sonar Acquires Gitar to Eliminate AI Code Review Gaps

Agentic AI , Application Security , Artificial Intelligence & Machine Learning Sonar Acquires Gitar to Eliminate AI Code Review Gaps Deal Adds LLM-Based Reasoning to Sonar's Algorithmic Code Verification Platform Michael Novinson (MichaelNovinson) • May 27, 2026     Share Post Share Credit Eligible Get Permission Tariq Shaukat, CEO, Sonar (Image: Sonar) Sonar purchased a code review platform founded by an Uber engineering leader to more effectively address the needs of artificial intelligence-driven software development environments. See Also: Agentic AI Demands a New Layer of Enterprise Security The buy of Silicon Valley-based Gitar will help the Austin, Texas-based code verification and governance vendor identify more nuanced issues such as logical inconsistencies, functional verification problems and design flaws that are tough to codify mathematically, said CEO Tariq Shaukat. While deterministic tools remain effective for identifying structured and repeatable issues, there's a need for AI-driven reasoning. "The techniques that we have used for this that are very fast, very cheap and very precise, but they don't cover the full gamut of verification needs," Shaukat told ISMG. Gitar, founded in 2023, employs nine people and emerged from stealth last month with $9 million in seed funding from Venrock. The company has been led since its inception by Ali-Reza Adl-Tabatabai, who previously spent seven years as Uber's senior director of engineering, four years as a site reliability engineering director at Google and 17 months as a software engineer at Facebook (see: How Deterministic Rules Keep AI-Generated Code Safe). How AI-Drive Code Review Systems Are Like Human Developers Sonar's engineering team evaluated Gitar's technology during due diligence by purchasing and using the product internally. The company found that Gitar integrated naturally into enterprise developer workflows and handled production-scale environments more effectively than many competing tools. He said the AI development ecosystem is evolving extremely quickly, making time-to-market increasingly important. "We're not just acquiring a technology," Shaukat said. "We're acquiring a team and a technology and a road map and a vision, and we really like that vision, and we saw an opportunity to accelerate - both from a talent standpoint, but also from a capability standpoint - the way things are moving." AI-driven code review systems reason more similarly to human developers, since rather than relying on predefined algorithms, LLM-based systems evaluate code from first principles, he said. AI-generated results are probabilistic rather than deterministic, meaning repeated analyses can produce different findings, which Shaukat said creates big concerns around auditability, compliance and trustworthiness. "They're not consistent," Shaukat said. "So, you can run the AI code review a dozen times and get a dozen different results. It's not auditable, so you can't actually guarantee that you've looked at everything there." Enterprises are deploying AI agents that operate as black boxes, meaning organizations need stronger automated verification mechanisms to validate whether the generated software actually satisfies business requirements. Tasks such as confirming user interfaces behave correctly, validating workflows and ensuring that generated functionality aligns with intended business logic require LLM-based systems. "The importance of it just goes up because you're dealing with black boxes that you really can't trust because you just don't know how the reasoning is working," Shaukat said. How Sonar Will Unify Deterministic Analysis, AI Processing Code quality, maintainability and governance are becoming more valuable because they directly affect AI efficiency and operational cost structures. Cleaner code bases can reduce token consumption by 7% to 10% because AI systems require less effort to understand the surrounding code context, with Shaukat finding that lower complexity also improves AI accuracy and speeds up software generation tasks. "A code base that has fewer maintainability issues, is more readable, less complex and has fewer quality issues consumes 7-to-10% fewer tokens to get that job done," Shaukat said. Sonar plans to intelligently sequence different types of analysis so lower-cost deterministic verification handles simpler issues first, while AI systems focus on more nuanced and difficult problems, Shaukat said. By using deterministic analysis first, Sonar hopes to reduce the amount of expensive AI processing required later in the workflow, Shaukat said. "Generative AI-based reasoning is basically almost every time looking from first principles to say, 'Does it look like this code is correct, or do you see issues?'" Shaukat said. "It's almost reasoning the way a human would start to reason through the code." The company intends to closely monitor false positive rates, user adoption and overall customer satisfaction as it integrates SonarQube and Gitar, Shaukat said. Verification systems must not only identify legitimate issues but do so consistently and efficiently enough that developers continue to depend on them as part of daily engineering operations, Shaukat said. "How do we actually make that experience seamless so it's not SonarQube and Gitar as two separate products that happen to be sold by the same company, but so it really comes together in one platform?" Shaukat said.