Veracode

Veracode is useful across the spectrum of development teams' AppSec maturity, size of the development community, and varied skill sets to address application security. Veracode excels in bringing together threat management teams and development teams with a single view into all application vulnerabilities and their treatment.

It's become a required element for all things AppSec in custom coded applications across the enterprise.

Veracode bends over backwards to make sure that customers are successful in ALL aspects of application security - from lifecycle-related activities to individual application scan activities. When developers have questions, the Veracode Community likely has the answers!

It takes a bit of time to get developers up to speed on setups, triage, working with defects, etc. For developers who have a backgound in scanners and computer science, they can more rapidly understand concepts like taint analysis and that makes it simpler for them to gain the best uses from the product(s). Since all scanning is tied to an application, it's easy to find everything one needs to know about the app's security and lifecycle in one place.

Overall, Veracode is one of the best, if not the best, products for application security out in the market. It is a great platform for keeping track of flaws and being able to report on them. Their support services and program management services are excellent, as they hire really good persons to handle these areas. There is still room for improvement in their analytics area.

At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.

We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.

Having worked with their support and program management teams now for over 5 years, I've been exposed to many support requests, concerns, and issues. We have even had one negative issue with their support team process, that was immediately addressed at their upper levels, and those upper-level management persons worked with me directly on the concerns. We recently had an issue with their mitigation process, and although it did take time to resolve, it was handled very professionally and escalated to the highest levels to address our concerns. Needs that have arisen from us as a customer have been addressed immediately and worked out with me directly by some of their most senior personnel to make sure our concerns are met. Again, their support services are among the best out there.

I believe this platform to be one of the most user friendly out there. After evaluating some other competitor platforms, I've seen one other that comes close to ease of use and others not so much. That is one of the main reasons we continue to renew with Veracode. Areas for improvement continue to be the analytics section and a very quick to annoy idle timer.

Veracode it is well suited in our scenario but for microservices isn't well suited. Because we have 1500+ microservices, licensing is a real problem if you have less than 1GB.

Because they are pretty fast and respond to the request.

It is very easy and intuitive to use.