TrustRadius: an HG Insights company

Veracode

Score8.4 out of 10

230 Reviews and Ratings

Learn More

What is Veracode?

Veracode provides advanced application security solutions, trusted by enterprises to develop and maintain secure software. Its platform identifies exploitable risks, speeds up vulnerability remediation, and reduces security debt at scale using a proprietary AI-assisted remediation engine.

Read more details.

Categories & Use Cases

Media

Screenshot of a fix
Screenshot of the Veracode Platform
Screenshot of SCA
Screenshot of SCA Github

1 / 4

Screenshot of a fix

Who Buys & Uses Veracode

Veracode Reviews

What users are saying about Veracode.
View all Veracode reviews

Pros

  • Robust security scanning capabilities for compiled code.
  • Effective identification of critical vulnerabilities (e.g., SQL injection, XSS).
  • Clear and useful reporting and dashboard features.

Cons

  • Outdated and unintuitive User Interface and web experience.
  • Limited API flexibility and webhook options for SecOps tooling.
  • Complexity and authorization model issues in reporting.

Veracode Mitigates Vulnerability swifty

Incentivized
Umesh GuptaView profile
Senior Consultant in Product Management at Deloitte USI (10,001+ employees)

Use Cases and Deployment Scope

Veracode helped our organisation in scalability and its optimization of security inspections.It gave output of the scan in few minutes it pointed for right corrections and We can easily connect for dynamic product and conduct scan.In our business, we have applications written in so many different languages. Finding something that can consistently scan and not generate false positives across the paradigm or the whole ecosystem of languages, that is impressive.

Pros

  • Veracode has ability to scale
  • We get the benefit of security inspections.
  • Accurateness of the inspection outcomes

Cons

  • Add more documentation within the application
  • It can be improved in terms of the UI platform as it could be more seamless
  • We are currently integrating Veracode using their GitHub Workflow app, but it's not yet mature.

Return on Investment

  • Our business benefitted from Veracode by its feature of automating the scanning process which saved the manual effort.
  • It's worth the money for our business as we have seen rarely any outages as it is on our private cloud.
  • Veracode's reporting helped us in understanding issues early with the scan.

Alternatives Considered

SonarQube

Other Software Used

AWS CodeArtifact, Microsoft Azure

Great Product for Static and Dynamic Analysis

Incentivized
Parth MutrejaView profile
Analyst in Engineering at Deloitte (10,001+ employees)

Use Cases and Deployment Scope

My company is using Veracode as the first item to be run before a Application Security Review. It shows the items that are the possible problems before running a dynamic vulnerability scan.Also it gives a crisp report and my team can make necessary changes and build secured and robust application.

Pros

  • Gives crisp report
  • Static Analysis
  • Scan small packages

Cons

  • Veracode is a commercial product with tiered pricing plans, which can be expensive for smaller teams or those with limited budgets.
  • It could be better if scanning time is improved.

Return on Investment

  • We can carry out static analysis against different kind of files - apk - .bca - jar files - war files - .dll files

Alternatives Considered

Snyk

Other Software Used

Snyk

Veracode Secure Software development.

Subhashree SatapathyView profile
Developer in Engineering at infosys (10,001+ employees)

Use Cases and Deployment Scope

We use Veracode in our application as part of the application security strategy. It helps us identify and fix vulnerabilities even before our code is pushed to production. It analyses our codebases and also monitors the libraries and dependencies, which are crucial for avoiding accidental leaks or data breaches.

Pros

  • Can be integrated directly into deployment pipelines, giving developers instant feedback.
  • Scans the application for risks related to SQL injection, cross-site scripting, and insecure dependencies.
  • Provides reports and dashboards to ensure the application's compliance with industry standards.

Cons

  • Performance and scan can be improved.
  • Dashboard UI can be improved making it less cluttered.
  • Reporting functionality can be flexible for stakeholders.

Return on Investment

  • Reducing data breaches can avoid the higher costs associated with disaster cases, which is a positive impact.
  • Another positive impact is increased developer productivity, which enhances workspace efficiency.
  • One negative impact is the larger scanning configuration(though it is modifiable), so it is better to have scheduled scans and incremental checks.

Alternatives Considered

ServiceNow Customer Service Management and Commercient SNYC

Other Software Used

Devin, Atlassian Jira, Microsoft Visual Studio Code

My experience with Veracode

Incentivized
Nicolas GarcinView profile
R&D manager in Research & Development at Neoxam (501-1000 employees)

Use Cases and Deployment Scope

* We run static scans on a regular basis (integrated in our continuous integration) on all our major branches.
* We review the Software Composition Analysis and the "Triage flaws" section on a regular basis (minimum every week).
* We run a dynamic scan before each major version release.
* Our goal is to fix all the Very high/high/medium vulnerabilities this year. We'll then look at the minor ones.

Pros

  • Report generation
  • Flaws description and remediation strategy
  • Consultation requests

Cons

  • Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
  • Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
  • Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Return on Investment

  • Adoption by developers: they are more aware of security aspects.
  • Allows us to see where we are in terms of applicative security
  • We're able to deliver clear security reports to our clients

Alternatives Considered

JFrog Security (Xray), Coverity Static Analysis (SAST) and CheckMark 1095

Other Software Used

SonarQube, JFrog Security (Xray), OWASP ZAP

Usability

Best tool to analyse security threats in coding

Incentivized
Elaine Davis
Senior Software Engineer in Information Technology at Hexaview Technologies Inc. (201-500 employees)

Use Cases and Deployment Scope

Veracode Application security is incredibly useful software for identifying and addressing security vulnerabilities. It offers reliable code analysis for each step for the entire software development lifecycle. It conducts effective security scans with comprehensive reports. The static analysis feature is invaluable for preventing SQL injections and cross-site scripting attacks. Veracode has maintained best coding practices and fixed security defects within the development ecosystem.

Pros

  • Identification of security vulnerabilities
  • Code analysis
  • Monitoring application development lifecycle

Cons

  • The platform has demonstrated resilience in enhancing best coding practices.

Return on Investment

  • Reliable security configurations have contributed to positive ROI.
  • Successful application scanning saves cost and time.

Other Software Used

IBM SPSS Statistics, Miro, Snowflake

Veracode Alternatives

Products similar to Veracode that may also meet your needs.
View all Veracode alternatives
Checkmarx
CompareLearn more
SonarQube
CompareLearn more
HCL AppScan
CompareLearn more
Snyk
CompareLearn more
Coverity Static Analysis (SAST)
CompareLearn more
Sentinel Source
CompareLearn more