Checkmarx vs. PyCharm vs. Veracode

If you are going with SAST process or want to improve overall security posture then go for it like integrating it with post deployment steps. If you are more concerned about proactive controls better choose other options such as pee-commit hooks and CI security. Also choose other tools for DAST and API scans.

Incentivized

PyCharm is well suited to developing and deploying Python applications in the cloud using Kubernetes or serverless pipelines. The integration with GitLab is great; merges and rebates are easily done and help the developer move quickly. The search engine that allows you to search inside your code is also great. It is less appropriate for other languages.

Incentivized

Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.

Incentivized

• Detects security vulnerabilities in source code with accuracy and detail.
• Integrates seamlessly with CI/CD pipelines, IDEs, and repositories.
• Provides clear reports and actionable fix recommendations for developers.

Incentivized

• Git integration is really essential as it allows anyone to visually see the local and remote changes, compare revisions without the need for complex commands.
• Complex debugging tools are basked into the IDE. Controls like break on exception are sometimes very helpful to identify errors quickly.
• Multiple runtimes - Python, Flask, Django, Docker are native the to IDE. This makes development and debugging and even more seamless.
• Integrates with Jupyter and Markdown files as well. Side by side rendering and editing makes it simple to develop such files.

Incentivized

• Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
• Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
• Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.

Incentivized

• Scan duration
• False positives
• Integration with other tools like Jenkins comes with some inconveniences.

Incentivized

• The biggest complaint I have about PyCharm is that it can use a lot of RAM which slows down the computer / IDE. I use the paid version, and have otherwise found nothing to complain about the interface, utility, and capabilities.

Incentivized

• Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
• Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
• Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Incentivized

It's perfect for our needs, cuts development time, is really helpful for newbies to understand projects structure

Incentivized

At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.

Incentivized

Their API based customizations which I leveraged to create an ASPM package, which is developer friendly and can extend above the dashboard features, other ones are UI which is great and feels clutter free. Menu and navigation is also good so as support. Only drawback is sometimes scan takes longer which I feel so can be reduced

Incentivized

It's pretty easy to use, but if it's your first time using it, you need time to adapt. Nevertheless, it has a lot of options, and everything is pretty easy to find. The console has a lot of advantages and lets you accelerate your development from the first day.

Incentivized

- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.

Incentivized

Veracode has always been up and available to us.

Incentivized

At this point, it runs well and mostly in a timely fashion. Dynamic scans take days but this may be a config issue still to be resolved.

Incentivized

I rate 10/10 because I have never needed a direct customer support from the JetBrains so far. Whenever and for whatever kind of problems I came across, I have been able to resolve it within the internet community, simply by Googling because turns out most of the time, it was me who lacked the proper information to use the IDE or simply make the proper configuration. I have never came across a bug in PyCharm either so it deserves 10/10 for overall support

Incentivized

Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.

Incentivized

We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.

Incentivized

Checkmarx is easier to integrate with development tools and gives quick feedback during coding, which is helpful for developers. Veracode is more focused on scanning and reporting for compliance, but it’s more complex to set up. We chose Checkmarx because it fits better into our development process, offering faster scans and more useful suggestions for fixing problems

Incentivized

When it comes to development and debugging PyCharm is better than Spyder as it provides good debugging support and top-quality code completion suggestions. Compared to Jupiter notebook it's easy to install required packages in PyCharm, also PyChram is a good option when we want to write production-grade code because it provides required suggestions.

Incentivized

Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.

Incentivized

It meets our needs.

Incentivized

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• PyCharm has a very positive ROI for our BU. It has increased developer productivity exponentially.
• Software quality has significantly improved. We are able to refactor/test/debug the code quicker/faster/better.
• Our business unit is able to deliver faster. Customers are happier than ever.

Incentivized

• Veracode's platform has had a very positive impact on our security posture, paving the path towards having coverage monitored automatically on hundreds of internal applications throughout the development lifecycle.
• Veracode's platform has also had a very positive impact on improving the security knowledge of our development team, providing meaningful feedback as well as training options to reduce mitigation time and help to prevent flaws before they are created.

Incentivized