Best in Security

It's being used across whole organization, multiple engineering teams are using it for third-party libraries scan i.e. software composition analysis and static application security testing. There is security labs for engineers and those who are interested in learning about security vulnerabilities and remediation, secure code training (labs). These labs are being used for encouraging developers in learning about secure coding by conducting secure code tournaments.

We prefer to consolidate solutions to one vendor , it simplifies management and streamlines processes, as there is a unified interface for monitoring and control. This can reduce complexity of security structure. Its easier for integration between different security products , offering a seamless experience and better threat detection. This opinion might change, due our organization needs and budget constraints.

The reporting and analytic features of a solutions for our use case is absolutely imperative. We have integrated Veracode with Jira, Brinqa and Service Now to streamline the process of reporting issues to our engineering team. These integrations are the cornerstone of our workflow, allowing us to communicate security findings to engineering team for remediations.

We use Veracode at almost all stages of SSDLC , In planning and development stage to assess security considerations and requirements which helps in establishing security architecture and controls.
Coding stage to perform static analysis while code is being written,
Building Stage, during CI and CD pipelines, to identify vulnerabilities.
And finally post-deployment stage, to monitor emerging new threats or vulnerabilities,

We will follow the same process, but will also consider any new features offered by the tools into consideration.