PyCharm is an extensive Integrated
Development Environment (IDE) for Python developers. Its
arsenal includes intelligent code completion, error detection, and rapid
problem-solving features, all of which aim to bolster efficiency. The product supports programmers in composing orderly and maintainable
code by offering PEP8 checks, testing assistance, intelligent refactorings, and
inspections. Moreover, it caters to web development frameworks like Django and
Flask by providing framework…
$9.90
per month per user
Veracode
Score 8.8 out of 10
Mid-Size Companies (51-1,000 employees)
Veracode provides advanced application security solutions, trusted by enterprises to develop and maintain secure software. Its platform identifies exploitable risks, speeds up vulnerability remediation, and reduces security debt at scale using a proprietary AI-assisted remediation engine.
1. We need only a few features and detailed reporting for static analysis. Veracode is enough to suit that need. 2. We have not used other products since 2013. So Veracode became de-facto standard for us.
PyCharm is well suited to developing and deploying Python applications in the cloud using Kubernetes or serverless pipelines. The integration with GitLab is great; merges and rebates are easily done and help the developer move quickly. The search engine that allows you to search inside your code is also great. It is less appropriate for other languages.
Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.
Git integration is really essential as it allows anyone to visually see the local and remote changes, compare revisions without the need for complex commands.
Complex debugging tools are basked into the IDE. Controls like break on exception are sometimes very helpful to identify errors quickly.
Multiple runtimes - Python, Flask, Django, Docker are native the to IDE. This makes development and debugging and even more seamless.
Integrates with Jupyter and Markdown files as well. Side by side rendering and editing makes it simple to develop such files.
Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.
The biggest complaint I have about PyCharm is that it can use a lot of RAM which slows down the computer / IDE. I use the paid version, and have otherwise found nothing to complain about the interface, utility, and capabilities.
At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.
It's pretty easy to use, but if it's your first time using it, you need time to adapt. Nevertheless, it has a lot of options, and everything is pretty easy to find. The console has a lot of advantages and lets you accelerate your development from the first day.
- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.
I rate 10/10 because I have never needed a direct customer support from the JetBrains so far. Whenever and for whatever kind of problems I came across, I have been able to resolve it within the internet community, simply by Googling because turns out most of the time, it was me who lacked the proper information to use the IDE or simply make the proper configuration. I have never came across a bug in PyCharm either so it deserves 10/10 for overall support
Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.
We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.
When it comes to development and debugging PyCharm is better than Spyder as it provides good debugging support and top-quality code completion suggestions. Compared to Jupiter notebook it's easy to install required packages in PyCharm, also PyChram is a good option when we want to write production-grade code because it provides required suggestions.
Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.
Veracode's platform has had a very positive impact on our security posture, paving the path towards having coverage monitored automatically on hundreds of internal applications throughout the development lifecycle.
Veracode's platform has also had a very positive impact on improving the security knowledge of our development team, providing meaningful feedback as well as training options to reduce mitigation time and help to prevent flaws before they are created.
