Veracode Reviews & Insights

Score8.7 out of 10

217 Reviews and Ratings

Overview

Synthesised from 7 reviews | Last Published May 27, 2026

Veracode is primarily utilized by organizations to integrate security testing directly into their software development lifecycle, emphasizing proactive vulnerability identification. It leverages Static Application Security Testing (SAST) and Software Composition Analysis (SCA) to analyze code and dependencies, often integrated into IDEs and CI/CD pipelines to

Pros

Effective IDE and CI/CD integration for early security checks
Comprehensive SAST scanning capabilities for compiled code
Detailed reporting and dashboards for product owners
SaaS platform enabling parallel work execution
Dynamic analysis features providing detailed request/response insights

Cons

Limited integration and API flexibility
Dated user interface and web experience
Inflexible reporting and analytics customization
Challenges with authorization models for dashboards

Read Full Review Insights

View All Reviews

Veracode Reviews

141 Reviews

Best tool to analyse security threats in coding

Rating: 10 out of 10

Incentivized

May 19, 2026

Use Cases and Deployment Scope

Veracode Application security is incredibly useful software for identifying and addressing security vulnerabilities. It offers reliable code analysis for each step for the entire software development lifecycle. It conducts effective security scans with comprehensive reports. The static analysis feature is invaluable for preventing SQL injections and cross-site scripting attacks. Veracode has maintained best coding practices and fixed security defects within the development ecosystem.

Pros

Identification of security vulnerabilities
Code analysis
Monitoring application development lifecycle

Cons

The platform has demonstrated resilience in enhancing best coding practices.

Likelihood to Recommend

It is effectively suited in addressing most security vulnerabilities within the application development lifecycle. It offers coding insights that maintains smooth and solid workflows on the entire application development chain. The customer support team is proactive and usually offers exceptional guidelines when we face challenges. We can conduct both static and dynamic security testing on most applications.

Elaine Davis

Senior Software Engineer in Information Technology at Hexaview Technologies Inc. (201-500 employees)

Vetted Review

2 years of experience

Veracode and me . . .

Rating: 8 out of 10

Incentivized

March 26, 2026

Use Cases and Deployment Scope

Veracode is our primary Vulnerability Management solution, to help us identify vulnerabilities in our applications as early in our development lifecycle as possible. The data is sent into our central monitoring and data visualisation tool. We are trying to reduce our attack surface without compromising our ability to do business.

Pros

Documentation
Customer Support
Roadmaps

Cons

Data Visualisation
Sharing data in human readable format
Integrations with SecOps tooling

Likelihood to Recommend

The people in the organisation are world class, the tool could do with a refresh and revamp - it feels dated compared to others, especially in a world where data is moved from one platform to another i.e. SIEM, SOAR, etc.

Verified User

General Manager in Information Technology (10,001+ employees)

Vetted Review

2 years of experience

Veracode A Powerful Code Security Tool

Rating: 9 out of 10

Incentivized

February 25, 2026

Use Cases and Deployment Scope

We use Veracode to identify and help remediate high risk technical debt, as well as shift left for our developers so that they are fully equipped to prevent new flaws from making it to production code. Veracode has been a highly useful tool, albeit complicated, in meeting our application security goals.

Pros

Application Security
Flaw Analytics
Dashboards and Metrics

Cons

Ease of Use
Integration Complexity
Analytics Complexity

Likelihood to Recommend

Veracode is well suited to organizations that are willing to pull teeth to hit that 99-100 percent application security efficacy through a robust, potentially automated app security program. It is generally not suitable for organizations that are okay with less security efficacy in exchange for more ease of adoption & use, and lower overall cost.

Verified User

Strategist in Information Technology (10,001+ employees)

Vetted Review

3 years of experience

Shaping the security code reviews and SCA through Veracode

Rating: 8 out of 10

Incentivized

February 25, 2026

Pros

It proivides insights about most prevelant issues that we currently observe as a security team
Helps to monitor Mean time to resolve which is MTTR (very important metric) to support our workflow management
Scanning the code security issues on compiled code makes it very initutive about all metrics that matters

Cons

The filtering options could be more intuitive — it’s not always easy to find exactly what you’re looking for without trial and error.
While Veracode integrates with a decent number of tools, we’ve found it a bit rigid compared to some newer players in the space. Some more API or webhook integrations should be there

Likelihood to Recommend

Abhineet Sagar

DevSecOps Engineer II in Engineering at Helpshift (501-1000 employees)

Vetted Review

3 years of experience

Verified on LinkedIn

Secure your code from IDE to production

Rating: 9 out of 10

Incentivized

May 9, 2025

Use Cases and Deployment Scope

We use it a a SAST and SCA tool for all the developments in our organization. All our developers analyze the code they write using the IDE plugin and Veracode Fix to help make the software more secure.

Pros

IDE integration
Gitlab Enterprise integration
Reporting for Product Owners

Cons

SAML integration when you have multiple domains
Scan whole repos to get a sense of security maturity
Authorization model for reports and dashboard

Likelihood to Recommend

It is very good as a SAST & SCA tool when you want to work with your developers so they start generating more secure apps.
It doesn't work very well if you want to measure your security level without including the devs in the process, specially if the way they work and how they use git is heterogeneous.

Verified User

Manager in Information Technology (5001-10,000 employees)

Vetted Review

1 year of experience

One-stop SDLC Security

Rating: 10 out of 10

Incentivized

December 19, 2024

Use Cases and Deployment Scope

We use Veracode as part of our SDLC, to provide for our SAST, DAST and SCA

Pros

Assemblies
Code scanning
Dynamic scanning
Presenting results

Cons

The web interface needs some getting used to
Some parts seem a little off, as its a different piece of software that Veracode is trying to fit in

Likelihood to Recommend

Veracode might be less appropriate for small companies, which need the functionality but can’t afford it (yet)

Verified User

Manager in Information Technology (11-50 employees)

Vetted Review

1 year of experience

Superior code scanning enabling faster and more secure code.

Rating: 9 out of 10

Incentivized

December 14, 2024

Use Cases and Deployment Scope

We use Veracode to perform Static Application Security Testing (SAST) and Software Composition Analysis (SCA) scans against our code, repositories, and CI/CD pipelines for code deployments. We also utilized the IDE integration for software engineers to identify code issues earlier in the development lifecycle.

One of the areas Veracode excels in is their reporting. Our application development releases required a Veracode report to be included showing now high/critical findings.

Pros

SAST scanning
SCA scanning
Reporting
CI/CD integration

Cons

UI and UX felt a little outdates in some of the screens.
Lack of flexibility on their outdated pricing model. This has since been corrected in 2023/2024.

Likelihood to Recommend

Veracode has robust coverage of supported programming languages. We faced an issue with a competitor product where we could not scan compiled javascript (jar) files. Veracode is able to scan jar files no problem in addition to many other languages.

Verified User

Director in Information Technology (51-200 employees)

Vetted Review

4 years of experience

My experience using Veracode tool

Rating: 9 out of 10

November 18, 2024

Use Cases and Deployment Scope

I have been using Veracode for nearly 2 years, we are using its SAST and DAST features. Previously there was no source code validation in our software development life cycle. We used this tool to shift the security to left, and tried to make the process as automate as possible. The best use case of this tool is that it can be fit anywhere with flexible plugins at different stages of SDLC. Even the support is very good and co-operative.

Pros

Veracode does integrate into IDE where the development starts. IDE Scans will help in reducing the versions of code.
The best thing about Veracode is, that it is a SAAS platform, and we can run the scan and do our other work parallelly.
Veracode dynamic analysis is pretty good as it clearly shows the requests it sends to the server and the response it receives from the server. Which helps in analyzing the vulnerabilities more easily.

Cons

Reporting work can be improved.

Likelihood to Recommend

It is best suited for the Agile model projects, where business will have the continuous releases of their products. Other than that I can't comment on the scenario where it is less appropriate as I need to experience it more.

Sairam Bathini

DevSecOps Engineer in Information Technology at DesIdea Software Technologies (51-200 employees)

Vetted Review

3 years of experience

View profile

Good SaaS service for finding security vulnerabilities in code.

Rating: 9 out of 10

Incentivized

September 25, 2024

Use Cases and Deployment Scope

In my organization, Veracode is used as an enterprise mandate to scan any application or service built by the development teams before deploying it into higher or pre-production/testing environments. After the scans, the security team reviews the results to mitigate or fix the vulnerabilities found by Veracode static and dynamic scans following the recommendations provided by the tool, sometimes like upgrading a third-party library to a newer version through SCA.

Pros

It is good at recommending fixing issues with third-party dependencies used in application code with detailed version information and knowing which version fixes what.
It has a very nice interface for triaging flaws. One can sort the vulnerabilities found in code from Very Likely to be exploited to least likely to be exploited.
There is a collections feature that allows us to group together groups of application profiles belonging to the same suite of applications.

Cons

The Veracode CLI can be provided as a setup or installer file instead of the powershell command to install it from the script.
There should be a copy feature that takes comments from vulnerabilities found in one application profile and imports them into matching flaws of another application profile.
The automated module selection at the review step just after the upload should be better at identifying entry points and should select only custom-developed code modules instead of third-party ones (at least the common ones).

Likelihood to Recommend

Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.

Verified User

Team Lead in Information Technology (5001-10,000 employees)

Vetted Review

1 year of experience

My experience with Veracode

Rating: 7 out of 10

Incentivized

September 17, 2024

Use Cases and Deployment Scope

* We run static scans on a regular basis (integrated in our continuous integration) on all our major branches.
* We review the Software Composition Analysis and the "Triage flaws" section on a regular basis (minimum every week).
* We run a dynamic scan before each major version release.
* Our goal is to fix all the Very high/high/medium vulnerabilities this year. We'll then look at the minor ones.

Pros

Report generation
Flaws description and remediation strategy
Consultation requests

Cons

Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Likelihood to Recommend

* (+) Report generation for our clients: reports are very comprehensive and look professional.
* (-) Veracode pipeline scan: takes too much time, need to split our application so that it can fit within the timeout (2h). Currently we're not able to use it, we still use "upload & scan" functionality in our CI pipelines. This is a showstopper to be able to break the build in case of new vuln, and also to use Fix AI based tool.

Nicolas Garcin

R&D manager in Research & Development at Neoxam (501-1000 employees)

Vetted Review

5 years of experience

View profile

Loading Reviews List....

Video reviews

View playlist

Good SaaS service for finding security vulnerabilities in code.

Rating: 9 out of 10

Incentivized

September 25, 2024

Use Cases and Deployment Scope

Pros

It is good at recommending fixing issues with third-party dependencies used in application code with detailed version information and knowing which version fixes what.
It has a very nice interface for triaging flaws. One can sort the vulnerabilities found in code from Very Likely to be exploited to least likely to be exploited.
There is a collections feature that allows us to group together groups of application profiles belonging to the same suite of applications.

Cons

The Veracode CLI can be provided as a setup or installer file instead of the powershell command to install it from the script.
There should be a copy feature that takes comments from vulnerabilities found in one application profile and imports them into matching flaws of another application profile.
The automated module selection at the review step just after the upload should be better at identifying entry points and should select only custom-developed code modules instead of third-party ones (at least the common ones).

Likelihood to Recommend

Verified User

Team Lead in Information Technology (5001-10,000 employees)

Vetted Review

1 year of experience