Scanning for code security vulnerabilities within our company's products.
DevOps Release Engineer at a tech services company with 51-200 employees
Makes us aware of any potential code security vulnerabilities in our products
Pros and Cons
- "Informs me of code security vulnerabilities. Bamboo build automation with Veracode API calls are used."
- "The user interface could be more sleek. Some scanning requirements aren't flexible. Some features take some time for new users to understand (like what exactly "modules" are)."
What is our primary use case?
How has it helped my organization?
Made our company aware of any potential code security vulnerabilities. Also, customers can use our products knowing they are verified by top organizations as safe.
What is most valuable?
Informing me of application security vulnerabilities. Bamboo build-automation with Veracode API calls are used.
What needs improvement?
- The user interface could be more sleek.
- Some scanning requirements aren't flexible.
- Some features take some time for new users to understand (like what exactly "modules" are).
Buyer's Guide
Veracode
November 2024
Learn what your peers think about Veracode. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
824,053 professionals have used our research since 2012.
For how long have I used the solution?
One to three years.
What do I think about the stability of the solution?
No issues with stability.
What do I think about the scalability of the solution?
No issues with scalability.
How are customer service and support?
Great.
How was the initial setup?
Somewhat straightforward. There was a little confusion about "missing modules" that are third-party files that we couldn't upload because we don't actually have them. That really confused us, but the technical support resolved the confusion.
What was our ROI?
I can't report on any cost savings relating to code fixes since implementing Veracode in our development process, but it makes us feel more confident about our code, which is awesome.
What's my experience with pricing, setup cost, and licensing?
We are satisfied.
Which other solutions did I evaluate?
None. We might look into Checkmarx.
What other advice do I have?
I am very likely to recommend Veracode to colleagues. Veracode is great.
Disclosure: My company has a business relationship with this vendor other than being a customer: Partner.
VP Engineering at a tech services company with 201-500 employees
Source code composition analysis helps with vulnerabilities and license compliance
Pros and Cons
- "Veracode is a valuable tool in our secure SDLC process."
- "It needs better controls to include/exclude specific sections when creating a report that can be shared externally with customers and prospects."
Buyer's Guide
Veracode
November 2024
Learn what your peers think about Veracode. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.
824,053 professionals have used our research since 2012.
Team Lead / Architect at a tech services company with 1,001-5,000 employees
We use its static analysis during development to eliminate vulnerability issues
Pros and Cons
- "We use Veracode static analysis during development to eliminate vulnerability issues"
- "I have found the user interface extremely helpful in prioritizing issues."
- "They should improve on the static scanning time."
General Manager - Application Security at a tech consulting company with 51-200 employees
Needs to improve service levels and capabilities versus competitors. Provides a wide range of platforms and technology assessments.
Pros and Cons
- "Wide range of platforms and technology assessments."
- "It needs to reach the level of Checkmarx's and Fortify Software's capabilities and service levels, or may further loosen the market share."
Buyer's Guide
Download our free Veracode Report and get advice and tips from experienced pros
sharing their opinions.
Updated: November 2024
Product Categories
Application Security Tools Static Application Security Testing (SAST) Container Security Software Composition Analysis (SCA) Penetration Testing Services Static Code Analysis Application Security Posture Management (ASPM)Popular Comparisons
SonarQube Server (formerly SonarQube)
GitLab
Snyk
Checkmarx One
Mend.io
Fortify on Demand
Sonatype Lifecycle
CrowdStrike Falcon Cloud Security
Acunetix
PortSwigger Burp Suite Professional
GitHub Advanced Security
HCL AppScan
Qualys Web Application Scanning
GitHub
Klocwork
Buyer's Guide
Download our free Veracode Report and get advice and tips from experienced pros
sharing their opinions.
Quick Links
Learn More: Questions:
- What is the biggest difference between Veracode and Checkmarx?
- Which gives you more for your money - SonarQube or Veracode?
- Checkmarx or Veracode. Which should we choose?
- Would you recommend Veracode? What are some of your use cases?
- Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode
- What do I scan when changing code in Veracode?
- If you had to both encrypt and compress data during transmission, which would you do first and why?
- When evaluating Application Security, what aspect do you think is the most important to look for?
- What are the Top 5 cybersecurity trends in 2022?
- What are the threats associated with using ‘bogus’ cybersecurity tools?
We have heard the need for faster scan times and I see this was an area you wanted to see improvement. I wanted to give you an update regarding our Static scanning. We recently extended the Veracode Static Analysis product family to include three purpose-built scan types:
• IDE Scan, which provides fast, automated security feedback to developers in the IDE, in seconds
• Pipeline Scan, a new, first-of-its-kind offering, which runs on every build and provides security feedback on code at a team level, with a median scan time of 90 seconds
• Policy Scan, which returns a full security assessment of the code before release, in a median scan time of 8 minutes
If you would like more information on our static analysis improvements let me know!