Veracode Reviews

We are Veracode partners/distributors in Quito, Ecuador. 

At this moment, I am reviewing the solution. 

It helps me to detect vulnerabilities.

I use the SAST feature the most.

All areas of the solution could use some improvement.

Scanning for code security vulnerabilities within our company's products.

Made our company aware of any potential code security vulnerabilities. Also, customers can use our products knowing they are verified by top organizations as safe.

Informing me of application security vulnerabilities. Bamboo build-automation with Veracode API calls are used.

• The user interface could be more sleek.
• Some scanning requirements aren't flexible.
• Some features take some time for new users to understand (like what exactly "modules" are).

No issues with stability.

No issues with scalability.

Great.

Somewhat straightforward. There was a little confusion about "missing modules" that are third-party files that we couldn't upload because we don't actually have them. That really confused us, but the technical support resolved the confusion.

I can't report on any cost savings relating to code fixes since implementing Veracode in our development process, but it makes us feel more confident about our code, which is awesome.

We are satisfied.

None. We might look into Checkmarx.

I am very likely to recommend Veracode to colleagues. Veracode is great.

Our primary use cases are for comprehensive security assessment using static analysis, dynamic analysis, source code composition, and manual penetration tests. We also use it for security training for developers.                         

Veracode is a valuable tool in our secure SDLC process.                                                        

Source code composition analysis for vulnerabilities and license compliance is the most valuable feature.                                                                                                 

It needs better controls to include/exclude specific sections when creating a report that can be shared externally with customers and prospects.  

I have been using Veracode for one year.

We also evaluated Synopsys.

I use Veracode to run scans on .NET applications, web applications and Windows/fat form applications. I also use it to make deployments in three-tier environments: the application server tier, web server tier and the database tier.

• Veracode has improved our penetration testing process. 

• We use Veracode static analysis during development to eliminate vulnerability issues.

• I have found the user interface extremely helpful in prioritizing issues.

• It allows me to prioritize the work to help resolve an issue.

They should improve on the static scanning time.

PoC is in progress.

• Application testing
• False positives challenges
• Wide range of platforms and technology assessments

It needs to reach the level of Checkmarx's and Fortify Software's capabilities and service levels, or may further loosen the market share.

No.

No.

Customer Service:

A three out of 10.

Technical Support:

A two out of 10.

Quality levels, service offerings, pricing, and mainly the features and abundance of technologies provided by others made us switch to a different solution.

In-house.

The pricing is pretty high.

Yes. Checkmarx, SonarQube and Fortify Software.