Try our new research platform with insights from 80,000+ expert users

Semgrep vs Veracode comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

Semgrep
Ranking in Static Application Security Testing (SAST)
34th
Ranking in Software Composition Analysis (SCA)
16th
Ranking in Static Code Analysis
10th
Average Rating
0.0
Number of Reviews
0
Ranking in other categories
Supply Chain Management Software (27th)
Veracode
Ranking in Static Application Security Testing (SAST)
2nd
Ranking in Software Composition Analysis (SCA)
2nd
Ranking in Static Code Analysis
1st
Average Rating
8.2
Number of Reviews
198
Ranking in other categories
Application Security Tools (2nd), Container Security (3rd), Penetration Testing Services (3rd), Application Security Posture Management (ASPM) (1st)
 

Featured Reviews

Use Semgrep?
Share your opinion
Ujjwal Sachdeva - PeerSpot reviewer
Mar 26, 2024
Identifies bugs before deployment in the software-side cycle process
The solution provides us with a feature that we can directly use with static and dynamic analysis. With static analysis, we can use it while the app is not running, and with dynamic analysis, we can scan our application while it is running. It provides efficiency and also saves a lot of time for penetration testing and bug testing. The capabilities of the analysis of the code base can help us effectively detect potential vulnerabilities. This is the most valuable feature we found. It can be integrated with multiple code editors, and it can also be integrated with various CI/CD pipelines. The dynamic analytics is efficient. It helps us identify bugs while the app is running. We find that this ability is way better than its competitor. Our impression of the solution's ability to prevent vulnerable code from going into production is positive. Prior to Veracode, we used to deploy our apps, and it used to be an expensive process to fix the bugs and all the potential vulnerabilities after deployment. Now, we have access to AI. It has AI tools, which have been trained with a lot of data sets. It helps us to detect bugs and fix them. We use the free access to VeriCloud's application security consulting team. The consulting team has helped us a lot, and we've had positive experiences with the vendors. It is efficient and very fast. It takes less than two or three days, and they always respond positively. They are really fast at solving our problems. It's important for us to have access to an application security consulting team at no extra cost. We use Veracode's AI-generated fixes. They make fewer errors and are very accurate. We've had a very positive experience. They've saved approximately seven hours of debugging and error finding versus the manual penetration testing process. The solution's policy reporting for insurance compliance with industry standards and regulations is very helpful. It's fast as well. The team helps us at every step of the product life cycle. They provide us with very useful visibility into things like static analysis, composition analysis, and manual penetration. It significantly helps us to reduce the time that we have to manually fix the bugs, and it also provides us with an efficient solution for future cases via past analysis through its data algorithm. We've saved six to eight hours compared to manual fixing. Veracode has had a positive impact on our organization's ability to fix flaws compared to the prior. It has reduced our costs and time, and it has also provided us with multiple security functions. That, and it's made our application a lot more secure. It really helps our devs free up time due to less debugging needed on their part. The solution has helped us a lot with our overall security posture. Many security features were fixed prior to release, and we've been able to reduce manpower and employee count. We've reduced teams from six or seven people to two or three. The integration capabilities with our existing development tools are very good. The integration process was easy. It has stable APIs.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pricing and Cost Advice

Information not available
"It's worth the value"
"Veracode is expensive."
"Veracode is fairly priced."
"The solution is expensive."
"Veracode is expensive. But the solution is worth it."
"I believe the price is fair according to market standards."
"As compared to others, it is a costly solution. It is overpriced, and many organizations with a limited budget cannot afford it. That is why they are going for other tools, but those tools are not that effective. Veracode is better in terms of quality. If you want good service, you have to pay for it."
"The licensing is fair, it is time-limited (e.g. one year) but there is a size cap for every app. If your applications are big (due third-party libraries, for example) you should discuss this beforehand and explore suitable agreements."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
800,688 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
24%
Computer Software Company
16%
Manufacturing Company
7%
Government
5%
Financial Services Firm
18%
Computer Software Company
16%
Manufacturing Company
9%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode?
The SAST and DAST modules are great.
What is your experience regarding pricing and costs for Veracode?
The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.
 

Comparisons

 

Also Known As

Semgrep Code, Semgrep Supply Chain, Semgrep AppSec Platform
Crashtest Security , Veracode Detect
 

Learn More

 

Overview

 

Sample Customers

Policygenius, Tide, Lyft, Thinkific, FloQast, Vanta, and Fareportal
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Static Application Security Testing (SAST). Updated: August 2024.
800,688 professionals have used our research since 2012.