CAST Highlight vs Veracode comparison

Read 194 Veracode reviews

5,004 Views
3,537 Comparison Views

90% willing to recommend

CAST Highlight

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 5, 2024

Veracode and CAST Highlight compete in the application security testing space. Veracode seems to have the upper hand due to its comprehensive scanning capabilities and extensive integration options, making it a strong choice for regulatory compliance and SDLC integration.

Features: Veracode provides comprehensive static, dynamic, and manual scanning capabilities, which are crucial for regulatory compliance and SDLC integration. It supports a broad range of programming languages and offers robust integration with IDEs and APIs. Veracode is valued for its ease of use, especially its ability to minimize false positives, along with features for sandbox scanning and vulnerability management. CAST Highlight offers fast, automated code scanning and portfolio assessments, providing a high-level overview rather than the in-depth analysis delivered by Veracode.

Room for Improvement: Veracode faces issues with false positives and complex integrations, leading to potential usability and reporting problems. Improvements in scanning speeds and language support are needed. CAST Highlight is criticized for its abstract reporting and lack of detailed analysis capabilities, with its pricing model viewed as inflexible, limiting deeper analyses without significant cost.

Ease of Deployment and Customer Service: Veracode can be deployed across various cloud environments—public, private, and hybrid—offering adaptability but with potential complexity in implementation. While its technical support receives mixed reviews, its quick response time is praised, despite some inconsistencies. CAST Highlight shares similar support complexities and the need for potential service improvements according to its users.

Pricing and ROI: Veracode's pricing is perceived as high but justified by its comprehensive features and robust security assurances, making it less accessible for small businesses but valuable for larger enterprises in risk management and operational efficiencies. CAST Highlight is considered more cost-effective than its sibling CAST AIP, but still requires careful cost-benefit analysis. Veracode is frequently cited for delivering more measurable benefits in reducing security vulnerabilities.

To learn more, read our detailed CAST Highlight vs. Veracode Report (Updated: January 2025).

CAST Highlight vs. Veracode

January 2025

Download the complete report

Helped 832,138 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CAST Highlight

Ranking in Software Composition Analysis (SCA)

16th

Average Rating

7.8

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Software Composition Analysis (SCA)

2nd

Average Rating

8.2

Reviews Sentiment

7.0

Number of Reviews

194

Ranking in other categories

Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (5th), Penetration Testing Services (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of February 2025, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 0.9%, up from 0.9% compared to the previous year. The mindshare of Veracode is 9.9%, down from 10.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Featured Reviews

Chris Van Poele

Owner at a comms service provider with 501-1,000 employees

Offers efficient portfolio management through enhanced application insights

One of the advantages of using CAST Highlight is that it provides a clear overview of the entire portfolio. It allows me to see the overall quality of my environment and determine where improvements are needed. It also aids in the early detection of trends and can be useful in managing applications within the organization.

Read full review

AkashKhurana

Senior Software Engineer at Publicis Sapient

Easy to configure, stable, and good vulnerability detection

Veracode's ability to prevent vulnerable code from being deployed into production is crucial. Typically, if a dependency we use has security issues or concerns, Veracode suggests upgrading to a more secure version. For example, if we're using a PayPal dependency with version 1.3 and it has a security bug, Veracode suggests upgrading to version 1.4 which fixes the issue. We usually make our project compatible with version 1.4, but sometimes Veracode recommends removing the dependent code altogether and adding the updated dependency from another repository. Veracode provides suggestions for resolving security issues and we implement them in our code after resolving any conflicts. We run the Veracode scan again and if it fails, we do not deploy the code to production. This is critical as it ensures that security issues such as bugs and fixes are addressed. Veracode consistently assists us in identifying security issues in third-party dependencies, while also ensuring the maintenance of code quality. Preventing security bugs and threats in our code improves the overall code quality of our company, which is essential given the significant concerns surrounding security today. Veracode's policy reporting is helpful for ensuring compliance with industry standards and regulations. Veracode's solution plays a major role in achieving compliance, including HIPAA compliance. Without Veracode scans, identifying security threats and third-party dependencies would be a tedious task for DevOps professionals. Veracode provides visibility into the status of our application during every phase of development, including continuous integration and continuous development CI/CD pipeline stages. This includes builds, package creation for deployment, and various enrollment stages such as develop, queue, stage, above, and production enrollment. Prior to each stage, a Veracode scan is run. This can be accessed through Jenkins or the CI/CD pipeline by clicking on the Veracode scan option, which provides a detailed report highlighting any security issues and concerns. Veracode performs statistical analysis, dynamic analysis, software composition analysis, and manual penetration tests throughout our software development life cycle. Veracode scans not only for third-party security issues but also for possible issues in our own code. This occurs in every phase of development, including the SDLC. For example, if we use an encryption algorithm with a private or public key that is easy to decode, Veracode will identify this as an error or warning in the report and suggest using multiple layers of encryption for the keys. The entire CI/CD process is part of DevOps. Therefore, the responsibility of configuring the Veracode tool usually falls on the DevOps professional. It is essential to integrate Veracode with the CI/CD pipeline within the project to ensure it is always incorporated. Whenever there is a priority or mandatory check required before deployment, Veracode should run beforehand. This integration is carried out by our DevSecOps team. Veracode's false positive rate is good, as it helps us identify possible security concerns in our code. In my opinion, it is advisable to run a Veracode scan on all codes. I have worked in the IT industry for five years, and I have observed that Veracode has been implemented in every project I have worked on. If a tool is improving our code quality and providing us with insights into potential security issues, it is always beneficial to use it. The false positive rate boosts our developers' confidence in Veracode when addressing vulnerabilities. Veracode also provides suggestions when there is a security issue with a dependency in version 1.7, prompting us to consider using version 1.8, which does not have security issues. This process involves the developers, and it leaves a positive impression on our managers and clients, demonstrating our commitment to security. We can show them that we were previously using version 1.7 but updated to version 1.8 after identifying the security issue with Veracode's help. Unfortunately, there is no centralized platform to check for network issues or problems with dependencies and versions. Veracode provides a centralized solution where we can scan our project and receive results. Veracode has helped our organization address flaws in our software and automation processes. Its positive impact has been reflected in our ROI, which increased when we started using Veracode. Without Veracode, we would be susceptible to security issues and potential hacking. However, after implementing Veracode scans, we have not encountered any such problems. It is critical for us to use Veracode because we capture sensitive data such as pharmacy information for real-time users, including patient prescriptions and refill schedules. This sensitive data could pose a significant problem if our code or software has security vulnerabilities. Fortunately, Veracode scans allow us to prevent such issues. Veracode has helped our developers save time by providing a solution that eliminates the need to manually check for dependencies or search the internet for information on which dependencies have issues. Instead, Veracode provides a detailed report that identifies the issues and recommends the appropriate version to use. Using Veracode ensures the quality of our code and also saves time for our developers. In my career of five years, Veracode has helped me resolve code issues eight times. Veracode has reduced our SecOps costs by identifying security vulnerabilities in our code. Without Veracode, if we were to go live with these issues, it could result in a breach of our encrypted data, potentially causing significant harm to our organization. This would require significant time and cost to resolve the issue and restore the data. Veracode has improved the quality of our code and reduced the risk of such incidents occurring, thereby minimizing their impact on our organization.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"CAST Highlight provides a clear overview of the role portfolio and allows users to assess the overall quality of the environment. Users can see where improvements are needed and follow up on trends of the application."

"CAST Highlight is easy to use and has a good dashboard."

"In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns."

"The most valuable features of CAST Highlight are automation and speed."

"It offers good performance."

"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."

"The most valuable features of the CAST Highlight are the interface and there are three notations that are very simple to understand and communicate with."

"The solution provides agnostic blockers for platforms as well as for containerization."

"Each time I raise a ticket regarding something, they are very quick about the responses and get connected instantly."

"The developers' awareness of the security weaknesses within their code has improved. They aren't just mitigating these issues, they are realizing these are, in fact, issues that have to be dealt with."

"I liked that I could easily find out where my errors were. Instead of going through the whole code and the scripts, it showed me where the errors were and gave me an idea of how to fix them."

"The recommendations and frequent updates are the most valuable features of Veracode."

"It allows us to prove our security levels to vendors, and additionally helps us with our HIPAA security policies."

"Veracode creates a list of issues. You can go through them one by one and click through to a new window with all the information about the issue discovered."

"It is a cloud-based platform, so every organization or every security team in the organization is concerned about uploading their code because ultimately the code is intellectual property. The most useful thing about Veracode is that if you want to upload the code, they accept only byte code. They do not accept the plain source code as an input. The code is converted into binary code, and it is uploaded to Veracode. So, it is quite secure. It also has the automation feature where you can integrate security during the initial stages of your software development life cycle. It is pretty much easy with Veracode. Veracode provides integration with multiple tools and platforms, such as Visual Studio, Java, and Eclipse. Developers can integrate with those tools by using Jenkins. The security consultation or the support that they provide is also really good. Its user management is also good. You can restrict the users for a particular application so that only certain developers will be able to see the code that has been scanned. Their reporting model is really good. For each customer, they provide a program manager. Every quarter, they have their reviews about how much it has scanned. They also ensure that the tool has been used efficiently."

"The installation was straightforward."

More Veracode pros

Cons

"The ease of configuration and customization could be improved in CAST Highlight."

"If I received categorization in containerization blockers, it would save time."

"There could be potential improvements or additional features added to CAST Highlight to make it better."

"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."

"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."

"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."

"There's a bit of a learning curve at the outset."

"We are testing Veracode's software composition analysis, but we're having trouble integrating it with SVN. It works out of the box when you use Git but doesn't work as well with other tools like SVN. It's more geared toward Git"

"The on-platform reporting needs to be opened up much more. We'd like to be able to look at the inspection data from a trending perspective in a much more open manner. I need to be able to sort and filter much more flexibly than I can today."

"The scanning could be a little faster. The process around three or four minutes, but it would help if it could be further reduced."

"Veracode is costly, and there is potential for improvement in its pricing."

"The scanning takes a lot of time to complete."

"The area with the most room for improvement is the speed and responsiveness of the query, as it is usually very slow."

"The scanning is a little slow, but other than that it's fine. It's usually when the binaries get up into the multi-hundred megabyte size."

"Veracode should include the feature to run multiple scales at a time."

More Veracode cons

Pricing and Cost Advice

"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."

"It is a pretty costly tool. A lot of customers are resistant to using it."

"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."

"CAST Highlight is an expensive solution."

"I recommend going for a one-year licensing with CA, because currently they are the leaders in this field with more features and a much better turn around time with a cheaper position, but there are a lot of new companies coming up in the market and they are building up their platforms."

"Veracode is expensive. But the solution is worth it."

"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works."

"I know that Veracode is a semi-pricey solution. If you are serious about security, I would recommend that you use an open-source option to learn how the scanning process works and then look into Veracode if you want to really step up your game and have an all-in-one solution."

"If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount."

"It is pricey. There is a lot of value in the product, but it is a costly tool."

"I'm unfamiliar with the solution's pricing, but it must be worth the cost from a company perspective, as we have been using it for years and have no plans to move away from it."

"The price of Veracode Static Analysis is expensive. There is an annual fee to use the solution and the company is upfront with the pricing model and fees."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

832,138 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

22%

Computer Software Company

17%

Insurance Company

Manufacturing Company

Financial Services Firm

17%

Computer Software Company

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about CAST Highlight?

The most valuable features of CAST Highlight are automation and speed.

What is your experience regarding pricing and costs for CAST Highlight?

The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.

What needs improvement with CAST Highlight?

There could be potential improvements or additional features added to CAST Highlight to make it better.

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.

SonarQube Server (formerly SonarQube) vs CAST Highlight

Comparisons

Compared 66% of the time

Black Duck vs CAST Highlight

Compared 6% of the time

GitLab vs CAST Highlight

Compared 5% of the time

JFrog Xray vs CAST Highlight

Compared 4% of the time

Checkmarx One vs CAST Highlight

Compared 4% of the time

More CAST Highlight Competitors

SonarQube Server (formerly SonarQube) vs Veracode

Compared 23% of the time

Checkmarx One vs Veracode

Compared 11% of the time

Fortify on Demand vs Veracode

Compared 6% of the time

Snyk vs Veracode

Compared 6% of the time

GitHub Advanced Security vs Veracode

Compared 6% of the time

More Veracode Competitors

Product Reports

Download CAST Highlight product report

CAST Highlight

February 2025

Download Veracode product report

January 2025

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

CAST Highlight is a SaaS software intelligence product for performing rapid application portfolio analysis. It automatically analyzes source code of hundreds of applications in a week for Cloud Readiness, Software Composition Analysis (Open Source risks), Resiliency, and Technical Debt. Objective software insights from automated source code analysis combined with built-in qualitative surveys for business context enable more informed decision-making about application portfolios.

CAST is the software intelligence category leader. CAST technology can see inside custom applications with MRI-like precision, automatically generating intelligence about their inner workings - composition, architecture, transaction flows, cloud readiness, structural flaws, legal and security risks. It’s becoming essential for faster modernization for cloud, raising the speed and efficiency of Software Engineering, better open source risk control, and accurate technical due diligence. CAST operates globally with offices in North America, Europe, India, China. Visit www.castsoftware.com.

CAST

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.