Try our new research platform with insights from 80,000+ expert users

PortSwigger Burp Suite Professional vs Veracode comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024
 

Categories and Ranking

PortSwigger Burp Suite Prof...
Ranking in Application Security Tools
8th
Ranking in Static Application Security Testing (SAST)
6th
Average Rating
8.6
Reviews Sentiment
7.7
Number of Reviews
62
Ranking in other categories
Fuzz Testing Tools (1st)
Veracode
Ranking in Application Security Tools
2nd
Ranking in Static Application Security Testing (SAST)
2nd
Average Rating
8.2
Reviews Sentiment
7.1
Number of Reviews
197
Ranking in other categories
Container Security (4th), Software Composition Analysis (SCA) (2nd), Penetration Testing Services (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

As of December 2024, in the Application Security Tools category, the mindshare of PortSwigger Burp Suite Professional is 1.8%, down from 2.0% compared to the previous year. The mindshare of Veracode is 10.4%, down from 11.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
 

Featured Reviews

Anton Krivonosov - PeerSpot reviewer
A special tool for penetration testers or security specialists to conduct security assessments
We use the solution for security assessments. It's a special tool for penetration testers or security specialists PortSwigger Burp Suite Professional is a standard tool in the security industry. It's a stable solution that has many features. You can download different plugins if you don't have…
Sajal Sharma - PeerSpot reviewer
Offers shift-left security strategy and helps us with the latest security configurations, OWASP standards, and SAST standards
It's robustness is the main benefit to the organization. As it gets upgraded with time, it also improves the coverage – security configuration coverages and vulnerability coverages. It also updates itself with the latest known vulnerabilities that are uploaded to the NVD, OWASP, or other databases. So it gets upgraded itself with that. And so with each upgrade, it gets better and better. The solution offers the ability to prevent vulnerable code from going into production. It provides us with a report containing multiple remediations and mitigations for each vulnerability. For example, if it finds a cross-site scripting vulnerability, it will also include references like CWE and CVE records, instructions on how to fix it, and the specific line of code or module where the vulnerability is present. This helps us fix the issues accordingly. I'm a penetration tester and DevSecOps engineer. I evaluate the findings, mark false positives, and manually exploit vulnerabilities if they exist. If we need further clarification, we raise a ticket with the Veracode team and get consultancy from them. We are a software development team. If we find a vulnerability, I exploit it and come back with the best possible mitigation, and the dev team fixes it. If we use Veracode Fix, it might use third-party implementations or make changes we aren't aware of. We need to be very aware of what our application is using internally. It should be known to us. As per my experience, the solution's policy reporting ensures compliance with industry standards. It comes with multiple features. I get the most out of it, and it's good. The solution provides visibility into application status at every phase of development. Like static analysis, dynamic analysis, software composition, and manual penetration tests - throughout the SDLC We have a pipeline that I maintain. I use the Veracode API account and have integrated it with AWS and our Jenkins pipeline. We use Snyk for SCA and Veracode for SAST scanning. At the earliest stage of the build, the SAST scan runs along with the JS and PHP files. It provides us with reports, which are then handed over to the other tools we depend on. If I validate the report or check the Veracode dashboard and find vulnerabilities, I mark them as false positives or existing issues. We work on multiple projects, but the one I'm handling these days only uses Veracode for SAST. It's been about one and a half years since I've been working with Veracode and this project. It is quite impressive. There are some things Veracode cannot find, like code obfuscations inside the code and some insecure randoms. Sometimes, it misses those flaws. But overall, if I compare it with other tools, it is better. I will definitely recommend others to use this tool. We run the scan before each deployment. If the dev team builds a new module or something, we scan it along with all the files. If we find anything, we get it fixed. That's how it works. Veracode is quite important to the organization's shift-left security strategy because we make a scan for each deployment. Sometimes, if I think we need to perform a shift-left, I just make a scan before deployment and check for any misconfiguration or vulnerability in the code.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The technical support from PortSwigger is excellent, managing response time and quality efficiently without any issues."
"It was easy to learn."
"I rate PortSwigger Burp Suite Professional ten points out of ten."
"The solution is quite helpful for session management and configuration."
"I have found the best features to be the performance and there are a lot of additional plugins available."
"You can download different plugins if you don't have them in the standard edition."
"The Repeater and the BApp extensions are particularly useful. Certain extensions, such as the Active Scan extensions and the Autoracer extension, are very good."
"The way they do the research and they keep their profile up to date is great. They identify vulnerabilities and update them immediately."
"The most valuable features are that you can do static analysis and dynamic analysis on a scheduled basis and that you can push the findings into JIRA."
"Veracode static analysis allows us to pinpoint issues - from a simple hard-coded test password, to more serious issues - and saves us lot of time. For example, it raises a flag about a problematic third-party DLL before development invests time heavy using it."
"In my experience, Veracode is one of the most powerful tools available in the market from a security perspective. It is a market leader in source code analysis."
"It allows us to prove our security levels to vendors, and additionally helps us with our HIPAA security policies."
"The most important feature is the static scanning analysis, and the reason is that it can tell us vulnerability in that code, right before we go ahead and push something to production or provide something to a client... Dynamic scanning actually hits our Web applications, to try to detect any well known Web application vulnerabilities as well."
"The security team can track the remediation and risk acceptance statistics."
"Each time I raise a ticket regarding something, they are very quick about the responses and get connected instantly."
"We like the fact that all the issues are identified and that Veracode provides sufficient information on how to resolve them."
 

Cons

"The solution doesn't offer very good scalability."
"The tool is very expensive."
"There needs to be better documentation provided. Currently, we need to buy books, or we need to review online some use cases from other professionals who have been using the solution to find out their experience. It is not easy to find out how to properly do a security assessment."
"One area that can be improved, when compared to alternative tools, is that they could provide different reporting options and in different formats like PDF or something like that."
"You can have many false positives in Burp Suite. It depends on the scale of the penetration testing."
"A lot of our interns find it difficult to get used to PortSwigger Burp's environment."
"The Auto Scanning features should be updated more frequently and should include the latest attack vectors."
"Currently, the scanning is only available in the full version of Burp, and not in the Community version."
"It's very expensive for a small organization."
"The one thing I'd like to be able to do is schedule dynamic scans. Today we're kicking those off manually, but I believe that it's something have on their roadmap."
"Sometimes, the scans halt or drop for some reason, and we need to get help from Veracode to fix it."
"I would like to see more AI features. It's a current subject because with ChatGPT and other solutions being developed all the time, IT attacks will increase... To defend against those it's very important that the good guys use AI in ways that are good instead of bad."
"The security labs integration has room for improvement."
"One feature I would like would be more selectivity in email alerts. While I like getting these, I would like to be able to be more granular in which ones I receive."
"Their scanning engine is sometimes a little bit slow. They can improve the scan time."
"It will be beneficial for developers if Veracode Greenlight includes Python."
 

Pricing and Cost Advice

"Burp Suite is affordable."
"I rate the pricing a four out of ten."
"For a country such as Sri Lanka, the pricing is not reasonable."
"At $400 or $500 per license paid annually, it is a very cheap tool."
"It is expensive for us in Brazil because the currency exchange rate from a dollar to a Brazilian Real is quite steep."
"We pay a yearly licensing fee for the solution, which is neither cheap nor expensive."
"PortSwigger Burp Suite Professional is expensive compared to other tools."
"This solution requires a license. It is expensive but you receive a lot of functionality for the price."
"Pricing seems fair for what is offered, and licensing has been no problem. All developers are able to get the access they need."
"The price of Veracode Static Analysis is expensive. There is an annual fee to use the solution and the company is upfront with the pricing model and fees."
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"The product’s price is a bit higher compared to other solutions."
"For our company, the price is reasonable for the benefits that we get."
"The pricing is fair."
"The worst part about the product is that it does not scale at all. Also, microservices apps will cost you a fortune."
"It is expensive. It depends on the use case, but it is very hard to find a pricing page on their website. Instead, they need to analyze your use case, but without knowing the entire project and how you're going to be using Veracode, how many scans you're going to do, if yours is a small business, it is very expensive and it affects ROI."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
817,354 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
17%
Financial Services Firm
12%
Government
11%
Manufacturing Company
8%
Financial Services Firm
18%
Computer Software Company
16%
Manufacturing Company
8%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

Is OWASP Zap better than PortSwigger Burp Suite Pro?
OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with ...
What do you like most about PortSwigger Burp Suite Professional?
The solution helped us discover vulnerabilities in our applications.
What is your experience regarding pricing and costs for PortSwigger Burp Suite Professional?
I would rate the pricing a six out of ten. It's not as flexible here as it might be in European or American markets.
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode?
The SAST and DAST modules are great.
What is your experience regarding pricing and costs for Veracode?
The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.
 

Also Known As

Burp
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Google, Amazon, NASA, FedEx, P&G, Salesforce
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about PortSwigger Burp Suite Professional vs. Veracode and other solutions. Updated: December 2024.
817,354 professionals have used our research since 2012.