Coremetrics / IBM Digital Analytics (discontinued) vs. Veracode

IBM analytics has continued to improve upon the days of being the original core metrics. After using the updated version for quite some time, it has been great at providing the needed analytics to measure ROI and goal performance for our quarterly KPI's. It has resulted in a great increase in web engagements although we are a midsize company, smaller outfits may not need such an expensive option.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Veracode helped us our team's developers in saving time significantly. For instance, if I take a library and assume it's going to work until it reaches QA or UAT, where we find out there's a vulnerability, that can require extensive effort for code refactoring or redesigning; Veracode helps prevent that before the pull request is merged.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• IBM CXA comprises an acquisition called Tealeaf. This tool has deep heritage and this is evident in its present-day capabilities.
• The Universal Behaviour Exchange or UBX puts the concept of personalisation at the forefront. The ability to combine physical (analog) and digital transactions to create the complete picture of a customer journey, is a stand out benefit.
• The solution does not have to involve the purchase of software. IBM CXA can be sold as a service bundled with analytics as a service. This not only lowers the cost of ownership, it gets around one of the principal issues. Strong staff with design and analytical capability to drive the solution and deliver tangible benefits.
• The seamless integration of Watson AI services to help with the heavy lifiting. Watson reinforces the analytical focus this solution has and can learn to recognise situations specific to a company.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• It is good at recommending fixing issues with third-party dependencies used in application code with detailed version information and knowing which version fixes what.
• It has a very nice interface for triaging flaws. One can sort the vulnerabilities found in code from Very Likely to be exploited to least likely to be exploited.
• There is a collections feature that allows us to group together groups of application profiles belonging to the same suite of applications.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• The user interface is in Flash, which can be very frustrating and slow at times. Apparently, this is to be transitioned in a future release.
• Can only segment the last 93 days of data. Any historical segmentation beyond the 93 days must be run in Explore (which is credit based, and has its own limitations with the number of credits per month, based on the initial contract with IBM).
• Reports can only display 93 days of data at a given time for custom date ranges. There are pre-programmed date ranges setup with IBM during implementation (last week, last month, last quarter etc.), but are not flexible enough to answer more specific questions.
• Certain reports cannot have segments applied, making answering some simple questions a bit more tricky. For example, I can create a segment around mobile devices and apply it to the marketing channels report, but I can't create a marketing channel segment and apply it to the mobile reports.
• Built in API calls allows for nice report design and automation.

• Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
• Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
• Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

IBM Digital Analytics is a great solution for our clients and I believe they offer the best solution for the retail space. We have access to IBM support via email or live chat and they can answer many of the reporting questions that come up. IBM is receptive to our feedback of the product so I am confident they will continue making improvements

At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Very easy to implement and use.

- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Never had any issues

Veracode has always been up and available to us.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

As reports are templated, the system is pretty quick. Sometimes you have to wait a bit for a report to render. Or you might have to re-load the page. But there is no real issue here and the system is on par with other similar systems.

At this point, it runs well and mostly in a timely fashion. Dynamic scans take days but this may be a config issue still to be resolved.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Overall, the level of support is very good and I would say it is a strong asset of the solution. However, you can sometimes feel that there is a difference of level among the support team.

Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Online training is really great. One of the best assets that they have. Lots of great videos, pop quizzes at the end of each module. Fantastic. Other tools have similar features, but not as good.

See previous comment: reading and understanding the encyclopedic implementation guide is a must.

We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

Much of the work we did in IBM Digital Analytics could have been answered through Google Analytics, a much simpler, agile and FREE solution set. Not mention, given the vast number of Google Analytics USERS, free and actionable support is simply a click away ... this compared to IBM Digital Analytics fractured and often absent support service.

Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

No idea

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

This solution can support large amount of data and transaction. The way that user management features are built, it shows it is meant for large organizations.

It meets our needs.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• We spend too much time trying to work around bugs on the new UI.
• We spend too much time trying to figure out how to make certain segments work because support and the knowledge center are lackluster.
• Our sales rep is very unresponsive and leaves us searching for a lot of answers on our own, including what other products we may benefit from that IBM offers.

Incentivized

Independently Invited by TrustRadius

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info

• Positive: Scanning all our applications on Veracode provides us an overview of our cyber security posture for the organization as a whole.
• Positive: Performing the SAST, SCA and DAST scanning for all the applications at the early stages of the SDLC helps us identify and mitigate security vulnerabilities early, reducing the risk of data breaches and cyber-attacks.
• Negative: Sometimes Veracode SAST scanner closed and reopens some findings, leading to reliability issues on the scanner itself.

Incentivized

Invited by the Vendor

A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info