Good SaaS service for finding security vulnerabilities in code.

In my organization, Veracode is used as an enterprise mandate to scan any application or service built by the development teams before deploying it into higher or pre-production/testing environments. After the scans, the security team reviews the results to mitigate or fix the vulnerabilities found by Veracode static and dynamic scans following the recommendations provided by the tool, sometimes like upgrading a third-party library to a newer version through SCA.

We are moving towards one vendor now as it provides better management for a unified solution and helps in cost savings compared to multiple vendors. However, enterprise-wide, this will take time to implement as a few teams are already using another platform for their needs, and the security team is trying to consolidate those.

Reporting is crucial for interpreting the results by the development teams directly working on the output of scan results. The analysis helps project management and security teams identify potential bottlenecks and timelines to commit to leadership for the delivery of the developed applications, considering their security aspects.

Right now, my team is using it at the testing phase after development while we are parallelly trying to introduce Veracode at earlier stages in development to make the process a bit more seamless. It is also used before production deployment to ensure nothing goes into production that doesn't pass the organization's security policies.