Item: Veracode
Rating: 10
Author: Verified User

Overall Satisfaction with Veracode

Use Cases and Deployment Scope

Veracode DAST is used on app applications in the portfolio. SAST/SCA scans and DAST scans are run monthly for all Critical application in the portfolio. In total there around 120 applications in scope for the program.

Pros and Cons

Pros

Customer support that won't permit any failures anywhere along the line.
Regular updates to the platform that supports rapid changes in technology and development practices
Sets the standard for how AppSec scanners should work

Cons

Sometimes finding the right person to help takes a little time
Pricing of SAST/SCA scans may scare off some potential customers until they understand that it's worth it.

Return on Investment

Faster scan times make it easier for developers to address exposed vulns
Simplified reporting removes the need for external data and reporting mechanisms

Security Needs

As long as two products are not doing identical work, it makes sense to diversify to make sure we're using best-in-class tools and processes.

Reporting and Analytics

Very important! They're used daily to check on progress and stay on top of new defects as they pop up. It's also useful for identifying application functions that are repeatedly generating defect reports so we can hone in to the defective code, fix it, and clear out potentially hundreds of reported CWEs in one fell swoop.

Secure Software Development

From the beginning of coding through post-deployment Veracode works seamlessly

So far, Veracode is being built-in to become a natural part of the process. People are encouraged to begin using Veracode from the first set of code with IDE-based scans to sandbox scans and finally to gated or policy scans.

Alternatives Considered

Checkmarx, Micro Focus Fortify Static Code Analyzer and HCL AppScan

Veracode stands out as the best of breed for all types of AppSec scanners.

Key Insights

Do you think Veracode delivers good value for the price?

Yes

Are you happy with Veracode's feature set?

Yes

Did Veracode live up to sales and marketing promises?

Yes

Did implementation of Veracode go as expected?

Yes

Would you buy Veracode again?

Yes

Other Software Used

Visual Studio App Center, Azure App Service, Azure Application Gateway

Likelihood to Recommend

Veracode is useful across the spectrum of development teams' AppSec maturity, size of the development community, and varied skill sets to address application security. Veracode excels in bringing together threat management teams and development teams with a single view into all application vulnerabilities and their treatment.

Using Veracode

Users and Roles

All developers use Veracode at their desktops, along with Azure pipeline scans and sandbox scans. Greenlight is used in the IDE for development. Other users are the AppSec Team in the CISO's office for oversight and management of the platform, and the compliance teams who pull data directly from the Veracode API.

Support Headcount Required

5 - We have a dedicated team of 3 people in India who work directly with the development team in Indonesia and 2 people in the US who support the installation and manage site users.

Business Processes Supported

Rapid remediation of High and Very High severity defects
Open Source library security and currency
Recurring use of DAST on all Web and API-based apps.

Innovative Uses

Showcasing results from AppSec processes
Training on basic concepts, like CWEs and Mitigation processing

Future Planned Uses

We're hopeful that Veracode Fix works as advertised!
Develop a repository of best practices for remediating defects
Custom cleansers

Likelihood to Renew

It's become a required element for all things AppSec in custom coded applications across the enterprise.

Evaluating Veracode and Competitors

Products Replaced

Yes - It replaced two products - Tenable DAST scanning and Checkmarx CXSuite. Those products were poorly managed and coverage was too limited for them to be useful as a security scanner.

Key Differentiators

Scalability
Ease of Use
Other

Veracode reputation was the driving factor. Knowing how powerful and instantly useful Veracode can be drove our easy decision to procure it!

Evaluation Lessons Learned

I would short-cut it and go with the vendor I know would serve us best and Veracode made that choice simple!

Veracode Support

Support Rating

Veracode bends over backwards to make sure that customers are successful in ALL aspects of application security - from lifecycle-related activities to individual application scan activities. When developers have questions, the Veracode Community likely has the answers!

Using Veracode

Usability

It takes a bit of time to get developers up to speed on setups, triage, working with defects, etc. For developers who have a backgound in scanners and computer science, they can more rapidly understand concepts like taint analysis and that makes it simpler for them to gain the best uses from the product(s). Since all scanning is tied to an application, it's easy to find everything one needs to know about the app's security and lifecycle in one place.