Veracode

Score8.6 out of 10

221 Reviews and Ratings

What is Veracode?

Veracode provides advanced application security solutions, trusted by enterprises to develop and maintain secure software. Its platform identifies exploitable risks, speeds up vulnerability remediation, and reduces security debt at scale using a proprietary AI-assisted remediation engine.

Categories & Use Cases

Media

1 / 4

Screenshot of a fix

Most Frequent Users

Top 3 industries using Veracode.

Based on HG Insights installation data

View all Reviews

#1 most frequent

Professional, Scientific, and Technical Services

25.7%

585 installations of 2,276

#2 most frequent

Finance and Insurance

14.1%

322 installations of 2,276

#3 most frequent

Information

14.1%

321 installations of 2,276

Pros

Effective IDE and CI/CD integration for early security checks
Comprehensive SAST scanning capabilities for compiled code
Detailed reporting and dashboards for product owners

Cons

Limited integration and API flexibility
Dated user interface and web experience
Inflexible reporting and analytics customization

Subhashree Satapathy View profile

Developer in Engineering at infosys (10,001+ employees)

Use Cases and Deployment Scope

We use Veracode in our application as part of the application security strategy. It helps us identify and fix vulnerabilities even before our code is pushed to production. It analyses our codebases and also monitors the libraries and dependencies, which are crucial for avoiding accidental leaks or data breaches.

Pros

Can be integrated directly into deployment pipelines, giving developers instant feedback.
Scans the application for risks related to SQL injection, cross-site scripting, and insecure dependencies.
Provides reports and dashboards to ensure the application's compliance with industry standards.

Cons

Performance and scan can be improved.
Dashboard UI can be improved making it less cluttered.
Reporting functionality can be flexible for stakeholders.

Return on Investment

Reducing data breaches can avoid the higher costs associated with disaster cases, which is a positive impact.
Another positive impact is increased developer productivity, which enhances workspace efficiency.
One negative impact is the larger scanning configuration(though it is modifiable), so it is better to have scheduled scans and incremental checks.

Alternatives Considered

ServiceNow Customer Service Management and Commercient SNYC

Other Software Used

Devin, Atlassian Jira, Microsoft Visual Studio Code

Nicolas Garcin View profile

R&D manager in Research & Development at Neoxam (501-1000 employees)

Use Cases and Deployment Scope

* We run static scans on a regular basis (integrated in our continuous integration) on all our major branches.
* We review the Software Composition Analysis and the "Triage flaws" section on a regular basis (minimum every week).
* We run a dynamic scan before each major version release.
* Our goal is to fix all the Very high/high/medium vulnerabilities this year. We'll then look at the minor ones.

Pros

Report generation
Flaws description and remediation strategy
Consultation requests

Cons

Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Return on Investment

Adoption by developers: they are more aware of security aspects.
Allows us to see where we are in terms of applicative security
We're able to deliver clear security reports to our clients

Alternatives Considered

JFrog Security (Xray), Coverity Static Analysis (SAST) and CheckMark 1095

Other Software Used

SonarQube, JFrog Security (Xray), OWASP ZAP

Usability

Elaine Davis

Senior Software Engineer in Information Technology at Hexaview Technologies Inc. (201-500 employees)

Use Cases and Deployment Scope

Veracode Application security is incredibly useful software for identifying and addressing security vulnerabilities. It offers reliable code analysis for each step for the entire software development lifecycle. It conducts effective security scans with comprehensive reports. The static analysis feature is invaluable for preventing SQL injections and cross-site scripting attacks. Veracode has maintained best coding practices and fixed security defects within the development ecosystem.

Pros

Identification of security vulnerabilities
Code analysis
Monitoring application development lifecycle

Cons

The platform has demonstrated resilience in enhancing best coding practices.

Return on Investment

Reliable security configurations have contributed to positive ROI.
Successful application scanning saves cost and time.

Other Software Used

IBM SPSS Statistics, Miro, Snowflake

Verified User

General Manager in Information Technology (10,001+ employees)

Use Cases and Deployment Scope

Veracode is our primary Vulnerability Management solution, to help us identify vulnerabilities in our applications as early in our development lifecycle as possible. The data is sent into our central monitoring and data visualisation tool. We are trying to reduce our attack surface without compromising our ability to do business.

Pros

Documentation
Customer Support
Roadmaps

Cons

Data Visualisation
Sharing data in human readable format
Integrations with SecOps tooling

Return on Investment

Reduced costs of bug bounty program
Reduced business/application downtime

Alternatives Considered

Snyk

Usability

Abhineet Sagar View profile

DevSecOps Engineer II in Engineering at Helpshift (501-1000 employees)

Pros

It proivides insights about most prevelant issues that we currently observe as a security team
Helps to monitor Mean time to resolve which is MTTR (very important metric) to support our workflow management
Scanning the code security issues on compiled code makes it very initutive about all metrics that matters

Cons

The filtering options could be more intuitive — it’s not always easy to find exactly what you’re looking for without trial and error.
While Veracode integrates with a decent number of tools, we’ve found it a bit rigid compared to some newer players in the space. Some more API or webhook integrations should be there

Return on Investment

I remember one usecase where we were looking for a open source tool to scan our limited prod API;s BOLA usecase and Veracode came handy, it directly abled to stored our static creds and perfectly scanned for the use cases. Really saved our effort.
MTTR solved our Agile way of working where I was able to establish a SLA across dev accounts
Overall it provided a positive ROI talking in terms of flexibility