Veracode Reviews and Ratings

Use Cases and Deployment Scope

We use it a a SAST and SCA tool for all the developments in our organization. All our developers analyze the code they write using the IDE plugin and Veracode Fix to help make the software more secure.

Likelihood to Recommend

It is very good as a SAST & SCA tool when you want to work with your developers so they start generating more secure apps.

It doesn't work very well if you want to measure your security level without including the devs in the process, specially if the way they work and how they use git is heterogeneous.

Use Cases and Deployment Scope

We use Veracode as part of our SDLC, to provide for our SAST, DAST and SCA

Likelihood to Recommend

Veracode might be less appropriate for small companies, which need the functionality but can’t afford it (yet)

Use Cases and Deployment Scope

We use Veracode to perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA) scans against our code, repositories, and CI/CD pipelines for code deployments. We also utilized the IDE integration for software engineers to identify code issues earlier in the development lifecycle.

One of the areas Veracode excels in is their reporting. Our application development releases required a Veracode report to be included showing now high/critical findings.

Likelihood to Recommend

Veracode has robust coverage of supported programming languages. We faced an issue with a competitor product where we could not scan compiled javascript (jar) files. Veracode is able to scan jar files no problem in addition to many other languages.

Use Cases and Deployment Scope

I have been using Veracode for nearly 2 years, we are using its SAST and DAST features. Previously there was no source code validation in our software development life cycle. We used this tool to shift the security to left, and tried to make the process as automate as possible. The best use case of this tool is that it can be fit anywhere with flexible plugins at different stages of SDLC. Even the support is very good and co-operative.

Likelihood to Recommend

It is best suited for the Agile model projects, where business will have the continuous releases of their products. Other than that I can't comment on the scenario where it is less appropriate as I need to experience it more.

Use Cases and Deployment Scope

In my organization, Veracode is used as an enterprise mandate to scan any application or service built by the development teams before deploying it into higher or pre-production/testing environments. After the scans, the security team reviews the results to mitigate or fix the vulnerabilities found by Veracode static and dynamic scans following the recommendations provided by the tool, sometimes like upgrading a third-party library to a newer version through SCA.

Likelihood to Recommend

Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.

Use Cases and Deployment Scope

* We run static scans on a regular basis (integrated in our continuous integration) on all our major branches.

* We review the Software Composition Analysis and the "Triage flaws" section on a regular basis (minimum every week).

* We run a dynamic scan before each major version release.

* Our goal is to fix all the Very high/high/medium vulnerabilities this year. We'll then look at the minor ones.

Likelihood to Recommend

* (+) Report generation for our clients: reports are very comprehensive and look professional.

* (-) Veracode pipeline scan: takes too much time, need to split our application so that it can fit within the timeout (2h). Currently we're not able to use it, we still use "upload & scan" functionality in our CI pipelines. This is a showstopper to be able to break the build in case of new vuln, and also to use Fix AI based tool.

Use Cases and Deployment Scope

At my company, Veracode is also used for security and threat assessment. It affects many business units that I'm not willing to discuss.

Likelihood to Recommend

We use it for integrated security scanning and reporting, so I would recommend it to others for that purpose. If your company uses Atlassian products, there are also Jira integrations.

Use Cases and Deployment Scope

For static code analysis and mobile application assessments. It solves the problem of manually reviewing the applications and the source code. It provides different applicable scan policies, highly detailed remediation steps, + evidence of where the vulnerability is located. The meager rate of false positives is one of the most critical factors of the product.

Likelihood to Recommend

For static code analysis and mobile application assessments. It solves the problem of manually reviewing the applications and the source code. It provides different applicable scan policies, highly detailed remediation steps + evidence of where the vulnerability is located. The meager rate of false positives is one of the most critical factors of the product.

Use Cases and Deployment Scope

We use Veracode for performing Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA) scans for all of our products. These scans help us find and address security vulnerabilities early in the Secure Development Life Cycle (SDLC) of every product. We have also automated the SAST, DAST and SCA scans by adding the Veracode scan step in our CI/CD pipelines.

Likelihood to Recommend

Veracode is a very powerful tool for performing Static Application Security Testing (SAST) and Software Composition Analysis (SCA) for any application. It gives very few false positives from the get go, so less work for the AppSec team for filtering out the false positives.

However, it is not very good at performing Dynamic Application Security Testing (DAST). So, its not a one-stop scanning tool that fulfills all the needs.

Use Cases and Deployment Scope

We have a system that needs to be safe and secure as it contains a lot of confidential information. We use Veracode to do Dynamic, Static Code and Software Composition Analysis scans. Veracode has helped us identify and fix various security and coding issues which we expect will make our system safer and more secure.

Likelihood to Recommend

There are a lot of different things to configure to get everything up and running. If would be great if there was a Wizard that help step through all the different parts, based on what has been purchased. Once setup, the scans and reports are usually good.

Also, the emails when scans have completed should include some highlights of the results like were there any new issues discovered that need to be focused on. Otherwise, it requires constant reviewing.