Acunetix vs Veracode

• Fast.
• Easy-to-use.
• Great customer support.
• Reporting features.
• Supports importing state files from other popular application testing tools.
• Has other features built-in beyond just scanning for vulnerabilities.

Read full review

• The tool seems to have been build for automation.
• As a security engineer, I prefer the types of findings discovered through DAST or IAST since I can easily verify findings, but the SAST findings may be easier for the developers since it points to the area of code.
• While it's hard to get developers to take advantage of the consultation calls, I like the fact we can get a highly technical person to walk us through any type of Veracode question.

Read full review

• Does not support multiple endpoints well (e.g. apps and services that do not reside at the same URL).
• Has authentication problems with modern enterprise apps which involve a lot of redirects to unrelated endpoints, federated IDs, SSO, etc. This is related to the first point.
• The vulnerability detection capability is not as robust as Burp Suite Pro + extensions, Metasploit + auxiliary modules, Nmap + scripts, etc.

Read full review

• Some members at Mathematica Policy Research program Python-based websites. The Python Static Analysis has not yet come out in Veracode. We have been waiting for over one year for Python.
• Speed is a problem with us and Veracode. It can take over two hours at times to get a very simple, single HTML page "website" scanned. This is becoming non-maintainable.
• Documentation on the XML out files should be provided. I was able to process the XML files but I am sure there are parts that I either did not see or misinterpreted. I t would be nice if the XML was documented.
• Cut the price or come up with multiple pricing models. We do a lot of small applications that only run for a few months. To make us pay a $7000.00 fee for each website is overly costly. Because of the price we cannot use Veracode on all of the applications we would like to use it on

Read full review

• Saved money compared to other commercial scanners, especially over the long run.
• Scan speed seems to be pretty good compared to some of the bulkier commercial products out there. However, that largely has to do with proper configuration.
• A downside is that is requires a bit of extra work just to get it set up to scan APIs, web services, etc.

Read full review

• Wasting a lot of time trying to get useful information from the user interface
• SSO is so cumbersome that I have to explain to people how to get in from OKTA as there isn't a decent login page.
• Some customers force us to get the security reports from Veracode by contract, which is the only reason why we haven't ditched it yet.
• We had to hire a Security Architect to deal with the tool as for developers it's so unusable that it wastes a lot of their time.

Read full review