Veracode

very, there should be more out of the box dashboards and we would like more reporting features

The reporting and analytic features are critical to any security program, with ours being no exception. Being able to report various statistics and metrics, especially in condensed formats as Veracode helps to provide, is something that we feel is very important especially in regards to more executive management. This helps to transform the work we perform in our development security practices into a more tangible form of numbers for our decision-makers. To this extent we use both the reporting dashboards as well as the individual report exports to provide up-to-date information to relevant parties.

The reporting side, we mainly use for internal reporting to the executive team, but in some cases we show the report to potential or existing clients.
Analytics is used by our development and operational team to make sure that vulnerabilities are rectified.

The reporting and analytic features of a solutions for our use case is absolutely imperative. We have integrated Veracode with Jira, Brinqa and Service Now to streamline the process of reporting issues to our engineering team. These integrations are the cornerstone of our workflow, allowing us to communicate security findings to engineering team for remediations.

The reporitng and analytic features are very useful, both for new products and established products. For new products, it establishes a baseline from which we can clean up any issues. For established products, it's helpful to see how items featured in the reporting and analytic features have changed over time. Very useful.

Our product has undergone successive enhancements that have left their mark.
The reporting and analysis functions of a solution are very important to us.
We use the many metrics available in Veracode to help us show the progress we've made and the progress still to be made.
We also collect other metrics, for example, every Quality gate failure is also tracked and reported as an incident metric.

Very important! They're used daily to check on progress and stay on top of new defects as they pop up. It's also useful for identifying application functions that are repeatedly generating defect reports so we can hone in to the defective code, fix it, and clear out potentially hundreds of reported CWEs in one fell swoop.

We basically depend on static scanning in the pipeline. The only time we look at the reports is after PEN testing.

Incredibly important. These features allow us to show our leadership what we have accomplished and plan to accomplish in the coming months.

Very important. The ability to customize reporting for internal and external stakeholders is key in ensuring appropriate information is shared with the right parties. Reports can be customized, defaulted to executive summaries, made to meet PCI requirements, etc.