I have experience with Veracode, as I did download it, and our cyber team manages that. I've used Veracode for quite some time, more from a user perspective, not really as an admin person to run the scans. I share my role with Veracode by normally receiving the results and then analyzing them from there, as I was looking for options.

My impressions of Veracode's best features indicate that it doesn't have what I need. It's hard to integrate and perform hybrid analysis mapping. The threat modeling components aren't detailed enough. The deciphering of the results is challenging as they're hidden, making it difficult for a non-security user or normal IT developer to understand it.

We have about 100 to 200 licenses, with a very big portfolio of 500 systems, and people still don't understand it. Training 7,000 developers isn't feasible. We had training with Veracode where they conducted a major session, but nobody understood it. These developers can't be expected to remediate and configure the tool properly for comprehensive scanning. Instead, they turn everything off and only scan a very small line of code, which doesn't benefit the agency.

I wouldn't promote Veracode because it's not automated enough, and it has many configuration issues. Manual configuration is required, requiring expertise in Veracode. My thoughts on Veracode's development over time are that they have had sufficient time to figure it out, and I'm disappointed that it remains such a technical tool. It's a tool that everybody purchased when it was released, but it still isn't user-friendly.

I've used Veracode for quite some time, more from a user perspective, not really as an admin person to run the scans.

I would rate Veracode's customer service or technical support as not great, probably a four out of ten. Anytime we use the advisory to speak with an advisor, they are either too technical or have no understanding. We have a weekly meeting with Veracode because we have our own business relationship manager. He attends the calls without a technical person or lead architect to facilitate questions. When 40 people are on a call asking questions about turning off the API or fixing issues, the response is often that they cannot answer. The service is either a hit or miss, which is why I rank it low.

Positive

I wouldn't be inclined to take a 10-minute callback to discuss my experience with Veracode because I don't prefer it, so I don't think it would be a very good review. I'm looking to replace it.

My impressions of Veracode's policy reporting for compliance with industry standards and regulations are hit or miss. While it has industry standards built in, our organization has different policies that are more structured. Each policy must be set up individually, requiring comprehensive legwork.

For example, if there's a policy for a deprecated protocol in an internal-only system, Veracode still reports it as an issue. This creates unnecessary work for internal systems that aren't public-facing and have lower risk. Configuring the tool to align with policies for sensitive, public-facing systems based on law and NIST requirements requires reviewing each line individually, which becomes a two-year project.

My impressions of Veracode's ability to prevent vulnerable code from going into production is that the static code analyzer portion is adequate.

On a scale of 1-10, this solution rates a 5.

We use the scan and code scanning functionality. Those are the main ones. I just changed my role, so this company is using Veracode, but I've been using it for quite some time before joining this new company. It is currently only managing the source code review. We have other tools that we integrate as such as infrastructure as code, container security, cloud misconfiguration reviews, and others. So it's part of the overall security posture. I can't say that it's solely for our entire security posture because it just manages a subset of one of the security requirements, which is the source code review.

It has met the company's requirements. Nowadays, we are talking about AI code generation. The company is required to leverage the existing code scan to see whether it can support scanning the code that is generated from GenAI before pushing that code to the developers. The developer wouldn't know whether this code is secure or not. Usually, we do the static scan first, but now with a code generator, we want to ensure that it generates secure code.

It did the job. Just before production, we did a scan and ensured that there were no critical or high-criticality issues before going to production. I think that helps to sanitize the code without going into a peer review. We have an automatic scan that catches all these things first, so it's beneficial.

This is especially true for the library because most of these static code scans or software component analyses scan the third-party library that has a CVE or CVSS finding. But if it's a custom-built library that isn't known to the public, it's unclear whether there's a vulnerability or not. Currently, it lacks the ability to trigger on those. We probably have to use a different solution for that.

There should be a feature where we can actually scan code that has been generated by GenAI, such as ChatGPT or Copilot. When they generate this code, they should have some kind of third-party integration feature that can suggest to us, 'This code is clean' or 'this code is good to be used for the developer.' 

We are also looking at Black Duck. They introduced a new feature. We were testing on this secure code for AI, so they do have some tools that we are currently exploring to see whether they can do secure AI code.

Regarding remediation, based on my experience, the recommendation from Veracode on remediation is quite helpful. It gives valid reasoning, and the recommendation is fixed. 

The developers actually understand how to fix that. However, some of the recommendations, such as upgrading a certain library to version XYZ, sometimes don't go deeper because some of these libraries are not as simple as just changing the version to fix them. There are interdependencies with other third-party components. 

Sometimes, when the recommendation asks to upgrade the version to XYZ, when we actually upgrade it, there will be another issue with other things. We usually face difficulty with that one. Sometimes we take an exemption because we can't upgrade this without breaking certain things, so we decide to go for the risk exception.

I just changed my role, so this company is using Veracode, but I've been using it for quite some time before joining this new company.

The stability is acceptable overall.

I didn't get involved much with asking them questions. During the initial phase when we started integrating, they were very helpful, but after they deployed the license and everything, we haven't reached out to them to ask any other questions. It's gone into autopilot. Once you have the license, everything just continues as it is.

In my last company, they used Veracode, and then they transitioned to Snyk. The price point was the first priority we looked at. Secondly was the integration—whether it had deeper integration with our system, and was easy for our developers to enroll and use. After a trial of 12 months with Veracode, we decided to move to Snyk.

Previously, we did a comparison between Veracode, Synopsys (which is Black Duck), and Snyk. We did our own internal review. Veracode needs to shift to a more modern approach because it still feels traditional in its way of doing code scanning compared with others, such as Snyk. They still use a base app, although they have a web version as well, but the integration part could be more seamless. I'm comparing it side-by-side with Snyk, as I'm also a heavy user of Snyk. Those aspects can be improved.

The integrated IDE tool enables users to get instant feedback in real-time on the code itself, rather than waiting for it to go through the CI/CD pipeline and get the result. They can instantly review their code on demand, which is quite beneficial.

For my previous company, when they first adopted source code review, they went for the open-source option first. I always advocate for people to go with the open-source option to understand what the features are and how exactly the source code scanning looks. Once comfortable with it, or if certain features are needed, then look for the enterprise version. Sometimes for different companies, especially small businesses, they couldn't afford Veracode because of the steep price.

Regarding integration, apps such as Jira and Confluence are important. The main thing was that it's fully and deeply integrated with the user and the repository, like Confluence. Every time there's a report, we can immediately generate a ticket from Snyk to Jira. It helps the developer get notified about issues after the scan. Then they fix the issue, tag the ticket as resolved, and once it's marked as resolved, we will do the rescan.

As a beginner, the interface is quite straightforward. People will not get confused. The technical report is professional and can be used by regulators. I can simply export it as a PDF and then share it with a regulator or any auditor for their review.

Regarding mobile code support, such as iOS, Kotlin, and others, the results were not really promising. For Java and C#, it's very good. They are pioneers in that. But for mobile development, if you're a mobile company that builds mobile apps and you have iOS, Objective-C, Swift, and Kotlin, that area needs to be polished.

I rate Veracode a seven out of ten.

We have used Veracode only for third-party libraries until now. We have automated that and have onboarded the Dev team to directly scan from their pipeline. We have integrated the CI/CD in that way. We try to see whether the third-party libraries they have been using are safe versions, and if not, we are able to guide them along. For static scan, we primarily use Fortify. With Veracode, I do not have much experience because Fortify is our main tool. 

We are the security personnel. We give proper guidance to the development team and use Veracode whenever scans are in queue or stuck, helping to provide clarity on findings. We have guided the development team with the tool so that, as security auditors, we do not have to do that. We have given guidance to the development team since every release needs code without vulnerable dependencies or vulnerable code. We have guided them in a way that they can access such tools, where they can see the report, and where vulnerable code is present.

Veracode's policy reporting for ensuring compliance with industry standards and regulations is satisfactory. Veracode provides visibility into application status at every phase of development.

Veracode has impacted our overall security posture because we are from a security background. Every week, we review the dashboards of open findings. We use both Veracode and Fortify findings, as we are using two separate tools - one for SAST and one for dependency-related issues. When we highlight these in our meetings every day, it gives us a picture of the timeline needed to fix the code. We are using that feature regularly, and it helps significantly.

The product could be improved in its reporting. The scanning process could be more streamlined as it has certain limitations when performing manual scans. It has some checks when the content is in ZIP format or other formats, which takes two or three more steps than Fortify does. From a technical point of view, I may not be the best person to answer that since I haven't used it regularly. Other than the scanning process, I think it is acceptable.

I have been using Veracode for a couple of years.

I would rate its stability as a six out of ten based on my personal opinion.

It is scalable. I do not face any issues with the product's scalability.

The technical support by Veracode is good because we have encountered problems before, and the team supported us effectively. For technical support, it deserves a rating of eight out of ten.

Positive

It is somewhat complex compared to Fortify. As a Fortify user for almost five years, I find Veracode complex, but others in my team who have used it for eight to nine years don't find such issues. When we were doing manual scans before CI/CD integration, it was easier.

It took approximately four to five months to onboard the solution because it was new to developers as well. There was a certain process to be followed to get access and integrate it into the CI/CD tools. We had to explain the report format to them, showing where they could find vulnerabilities and how they could fix the code, including finding safer versions of libraries and dependencies. This took almost half of 2023, and now in 2025, they do not need our help except for technical problems when there are numerous scans in the pipeline.

The pricing is reasonable compared to other tools.

I haven't used the Veracode Fix feature that produces AI-generated fixes. 

The fact that Veracode doesn't scan source code, only binary code, is not a concern because we have certain projects that work with this approach. The AI functionality could be innovative, though I haven't experienced it yet. Regarding the breadth of Veracode's end-to-end testing versus competing solutions, I would rate it as eight out of ten.

Overall, I would rate Veracode a seven out of ten.

It helps with intelligent software composition, ISC, allowing us to test fast and get fast feedback around third-party library vulnerabilities, and have a quality gate around the CVEs, and so on.

I work as a digital consultant helping customers with their digital transformation side, with the primary focus on reliability engineering, SecDevOps, and Cloud. I have multiple clients using this same product. My clients are from different industries such as retail, consumer goods, travel, hospitality, and energy.

Veracode provides visibility into application status at every phase of development, as it's how we stitch it together, allowing us to introduce it at various phases to gain fast feedback. This capability increases the velocity in DevSecOps processes as developers receive feedback on vulnerabilities before committing, reducing the overall rework.

It helps developers save time significantly. For instance, if I take a library and assume it's going to work until it reaches QA or UAT, where we find out there's a vulnerability, that can require extensive effort for code refactoring or redesigning; Veracode helps prevent that before the pull request is merged.

Veracode impacts the overall security posture by maintaining data integrity, ensuring we are not exposed to threats from third-party libraries with known vulnerabilities. From my perspective as a SecDevOps evangelist, Veracode is crucial for an organization's shift-left security strategy. Veracode's SCA perspective offers tools that facilitate shift-left security by providing feedback before failures occur in the development process.

All three of Veracode's offerings are valuable: SCA, SAST, and DAST. It helps identify security loopholes right in the development phase, allowing developers to get feedback around what kind of vulnerabilities exist as soon as they check in the code or even before that in their IDE.

It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback. 

I think Veracode has most areas covered, but I'm not sure if they have something around container scanning yet, which is important as workloads become containerized or serverless.

Regarding innovative features offered by Veracode, it would be beneficial for them to open up a channel to broadcast new developments and features to help us adapt. We are currently integrating Veracode using their GitHub Workflow app, but it's not yet mature.

It has been more than five years. 

We have an enterprise license and direct connection with the Veracode team. I consulted their team about a couple of issues or bugs in the product that weren't matching our requirements, and we provided feedback that they took back to address. 

I would assess their help as eight out of ten in terms of how they assist with the issues I bring to them. It's good to have access to their team at no extra cost with the license, as most SaaS platforms include consulting as part of their offerings, but access to the engineering team is crucial for faster feedback on the product fix process.

Positive

I do have experience with other testing tools such as Mend and Polaris. The main differences between Mend, Polaris, and Veracode lie in the specific functionalities and how each integrates with enterprises. Overall, the basic functionalities remain similar. In comparing Veracode's breadth of end-to-end testing versus Mend, I find Veracode to clearly be a winner in the SCA segment. Other than that, both are pretty much equal in the SAST and DAST areas.

When it comes to the initial setup, it's both straightforward and complex. While the product is mature, it requires integrators. For example, I'm using GitHub Flow, but the GitHub app to plug in is not sufficiently mature.

I have not examined Veracode's pricing in detail, but from an industry perspective, I see that there is a tendency toward Veracode, which suggests competitive pricing.

I would rate Veracode's ability to prevent vulnerable code from going into production at an eight out of ten because AI is evolving, and there are other tools emerging that help by proactively changing the code without needing the developer to take action, ensuring that pull requests are handled before going into production. 

We just got the Veracode Fix feature, but we need to understand it more deeply to know if it just performs code fixes or handles dependencies as well. Can it arrange or adjust my versions to make sure that the library that I'm using does not have any vulnerabilities? We have not enabled AI-generated fixes because we need to try it out and see how it performs, especially concerning human intervention in auto-upgrading or automatic patching in production. I am yet to explore the continuous delivery and continuous deployment aspects to provide feedback on that. 

I would recommend Veracode to others, as it maintains strong industry adoption.

Overall, I would rate Veracode an eight out of ten.

My use case for Veracode includes utilizing the SSA and SAST modules as part of improving the code that we are developing in the company, and we have 130 developers that we are trying to onboard in this platform. We have been able to onboard 100 more or less in these months, and the idea is to change the way they are developing because we want them to heavily use the IDE integration. 

We mostly use Visual Studio Code, and we have them using the integration plugin with Veracode so that they can fix the security issues at dev time. When we have the product in the pipeline, and we run the scans again, it's a green light.

Veracode Fix has affected our time to remediate security flaws in cases where we've been able to use it correctly because the proposals were on point, and it's been great. 

We've seen that in the same sprint that we were developing the features, now those features are implemented without any technical security debt. What happened before was that we needed another sprint to solve those technical debts. So we haven't seen an increase in time, and the speed of development of the teams is better, and now the product is being delivered with less technical debt.

One of the aspects I appreciate most about Veracode is that even though we have a license for developers, we don't get charged by the users who don't develop code but are only trying to access the platform to see the reports or the dashboard, such as architects who do some code reviews but don't develop. That's a nice feature that doesn't happen on other platforms that we analyzed. 

Another feature that we appreciate significantly is Veracode Fix and how it's integrated with Visual Studio Code. Even though it has some room for improvement, the key usage for us is to be able to solve everything. The developers also learn how and why they have to solve the security vulnerabilities detected. At the same time, they are developing the feature. Veracode Fix has affected our time to remediate security flaws in cases where we've been able to use it correctly because the proposals were on point, and it's been great.

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

I have been using Veracode for nine months.

It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.

I have contacted the technical support and customer support. With Veracode's technical support, for some issues, it has been really difficult for them to understand the problem, and they ask us to do some tests we've already told them we completed in the first ticket. I think there is room for improvement there. However, we are also working with premier support, where we have an engineer assigned to our account. When we work with him on one of our problems, it gets solved much faster. Now we always try to add this engineer to all of our tickets so that we can solve everything faster. That's because we have the premier support as part of our agreement.

Positive

The initial deployment was difficult. We had some problems with the SSO integration. But Veracode found a fix, and they are delivering the final solution to production. It took us a lot of time to get that mitigation, and it's not that fast to onboard the dev teams. We are having meetings with each team depending on the language they are using and the type of application; it may be really fast or take up to a week for them to have the product integrated. My expectation was that it was going to be faster.

For us, it wasn't the most expensive solution proposed. Part of our decision to get Veracode was that when we evaluated against other products, Veracode was cheaper. What they need to measure is that you need a tool that is efficient and works for your products and how you develop, which has a nice level of detection and a low level of false positives. We make an evaluation and only choose tools that offer a good balance between providing good detections and a low amount of false positives. What was happening with SonarQube was that we had lots of false positives, making teams not care about the vulnerabilities because most were false positives. Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.

We have used some alternatives to Veracode for some of the use cases. For example, for SAST, we've been using SonarQube from Sonatype and also some IDE plugins that we've asked the developers to use, but we didn't have any centralized platform to manage and false positives or findings. For SSA, we've been using Renovate Bot and also SonarQube and some of the GitLab integrations that we've been using for some use cases. The only one that we've used as an enterprise solution for all the products was SonarQube and Renovate Bot; the other tools were tested with a small number of teams.

We don't use some of these tools because we don't have the license for them. We are not using Veracode for DAST or for manual penetration testing, but we are using the other ones, and they give visibility through the process. I think that Veracode does it, but since we are not using DAST, we are only part of the development process before going to the runtime environments. So we are not checking anything on runtime. That part of the process, where you have the product running and you make real tests on the running product, we are not solving with Veracode, but that's mainly because we don't have the DAST licenses. The way we are using Veracode now means that since we haven't finished the rollout yet, we are not putting any restrictions on our pipelines so that they can only go to production if Veracode didn't find any critical vulnerability. Now, we are not using it as a blocker, so it depends on the team. Some teams don't want to appear in red in the reports from the last pipeline scan, so they are delivering much more secure code to production. Other teams don't care and still deliver with the same vulnerabilities, but that's something that varies from team to team. Generally, most teams have improved a lot, for example, by updating all the libraries and reducing all the critical and high vulnerabilities, delivering to production only with low or medium vulnerabilities.

It helps our organization's ability to fix flaws very quickly. It helps in that aspect. We have fixes, remediation guidance to help fix issues. Veracode provides a training platform for developers to ensure they have awareness and knowledge, so they have a place to get information. It helps our developers save time, but we don't have many metrics on that.

When it's used, it's helpful. That's about making people use it and requiring it to be used. It has been used at times, and we could get issues resolved and things fixed. It was quite advantageous for some time. I'm in a different part of the team now, and I've seen that since I've left, the numbers have gone the other way. Somebody was showing me how they just got big old backlogs of things, and they're not even able to keep up with issues. That's when they're working with Code Fix. They try to get them to use Veracode Fix, which will speed up things for development, so the security team's support team will not be backlogged.

It gives notifications to prevent vulnerable code from going into production. It doesn't stop anything from going into production, but it notifies you. You can then consider not promoting that code. The values and assessments it provides can be introduced in the different areas in our development cycle and pipeline.

Regarding visibility into application status in every phase of development, such as static analysis, dynamic analysis software, and SAST, I would say that's not possible when considering every phase of development, such as requirements and architecture, as it's not part of that. However, from where it is engaged in the software development lifecycle standpoint, it provides that information.

The most valuable features include the total developer experience, along with regulator exposure and DevOps pipeline. It encompasses everything as an enterprise solution. In an enterprise, you want developers to be able to do things easily. You want to be able to monitor development in IDEs and the environment states of working pipelines. You want to integrate DevOps pipelines that do scan assessments and evaluation, and promotion to later stages in the pipeline and testing cycles. You still want your security team to be able to access data or pull information for evaluations or regulatory compliance, and report back to corporate compliance.

For the teams that use it, it does affect the time to remediate security flaws. It fixes issues directly in the IDE while you're doing it.

Many teams now have IDE plug-ins and the ability to generate fixes in the code. It's becoming more of a standard thing. They focus on creating security fixes and tools. A nice addition would be if it could be extended for scenarios with custom cleansers.

I've used Veracode for a while now.

Their support is pretty good.

Positive

I don't know why they switched, but it was the decision made before I joined the company, and then the pandemic hit. It was delayed, but it had already been paid for, so eventually the switch happened.

They did evaluate other options before choosing Veracode. I'm not familiar with the process they used, but they absolutely did evaluate. I've seen documentation, and Checkmarx was on that list as well.

From a policy standpoint, industry policy and related matters, you have to adjust and adapt things for systems and solutions. It's capable, but another part of the company is responsible for some of that. We may not necessarily get feedback, so with the ability to use it effectively, I don't think we've matured as an organization to take advantage of it effectively.

Veracode isn't important to the organization's shift-left security strategy itself. It's a tool. You have the strategy, you set the strategy, and you find a solution that will adhere to and work with the strategy. That's generally the goal. Veracode works well with the strategy once you decide and define it. Strategy is set, and then you select the tool.

Veracode is a very good tool, especially from a compliance standpoint. I would rate it an eight out of ten.

We have now switched to another solution but our use case was SAST.

Veracode was crucial to our shift-left security strategy, as we implemented it into our transformation projects. We defined internal strategies to use Veracode in the earlier stages of application development. Each sprint received application code, and we consistently scanned it using Veracode, reducing many security flaws early in development. This proactive approach helped developers to address any remaining flaws. Additionally, we defined a Jira workflow specifically for SAST bugs to track and manage security issues effectively.

Veracode helped with policy compliance. We have proposed Veracode for SAST to our stakeholder in the banking plarform. They have specific security policies that the code needs to accommodate. We have two sets of policies defined: one is the default policy in Veracode, and the other is provided by stakeholders from the chief security team, who have imported policies relevant to the banking platform. The default policy is not sufficient to ensure the code is secure, so stakeholders provided more security policies relevant to their domain and the platform.

Our actual application code was a CAT-A application, meaning it had to pass SAST and DAST testing for deployment into production. This was a mandatory check from our perspective to get the code deployed into production. We have internal strategies to implement Veracode in different phases of our application deployment. Before going into production, we do SAST testing in lower environments and then one round of testing in higher environments based on bug-fixing code. We are cautious about deploying directly into production after completing security testing in Veracode because we continually receive bug-fixing code from different applications. So, we defined our strategy this way.

Veracode provided visibility into application status at every phase of development, including static analysis, dynamic analysis, composition, and penetration.

Most of the fixes relate to password encryption or some kind of SQL injections. If there are any security flaws verified against the policies defined by our stakeholders, as well as Veracode's, and if they pose a potential risk of breaches, Veracode provides excellent recommendations for fixing those security flaws. This detail helps us address the issues efficiently, as it specifies where fixes need to be applied and the implications of ignoring them. The options for developers to provide false positive comments or justification through Jira tickets if a fix cannot be implemented for a particular release are also very useful. These features in Veracode significantly aid developers in addressing security flaws in the code.

Because scanning takes a long time for uploading any kind of large application code, I would estimate we saved around 30% to 40%. After implementing our strategy for SAST within our platform, we started doing SAST scanning in Veracode for every sprint. This frequency is crucial because, without Veracode, it could be very difficult to implement such a strategy in the earliest stages of application development.

Veracode had a positive impact on our security posture. 

The good thing about Veracode is that when one scans the respective application code, all the people who are part of the transformation project can update their reviews. If there are any security flaws or vulnerabilities identified, they are able to provide sufficient justification or details about the security flaws. This helps developers fix the respective flaws in the application code, which we appreciated because it made it very easy for us to assist with fixing the application code from the development perspective.

Its cost and the long scanning times for large applications are the areas for improvement. We had integrated Veracode with other tools in the DevOps pipeline, such as Ansible and Jenkins. However, we faced a challenge, so we implemented Veracode offline, out of the DevOps pipeline. We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments. We defined different strategies to utilize Veracode for analyzing static-related security bugs in application code.

I would rate it a seven out of ten for stability. If the Veracode server is down, we experience many issues during the scan, and sometimes the scan gets interrupted, requiring us to restart it.

For scalability, I would rate it a nine. It has a good capacity to scale effectively.

We had 15 to 20 licenses.

We never used Veracode support. We only worked with the stakeholders provided by the customer. They were supportive. 

The responsiveness and quality of documentation from Veracode are notable compared to other tools we are currently using, where we often struggle to find the same level of support.

Positive

It was easy.

I estimate we saved around 60% to 70% of our resources with Veracode.

Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode.

Lower budget products may struggle to incorporate all of Veracode's capabilities into their processes.

We were looking for a tool in the market that could provide support for SAST or static analysis security testing. We wanted to implement it in the earlier phases of our transformation project. We looked into the analysis of different tools in the market, and then we decided that Veracode was the right tool at the time to provide more support for the SAST testing in our transformation project.

Veracode stands out when compared to other solutions, especially regarding predefined security policies and their support for implementing the DevSecOps pipeline.

I do not have concerns about Veracode not scanning source code, only binary code. In previous scans of the same code with different tools, Veracode has identified more security flaws, so I don't worry about the scanning process. It effectively spots the security flaws.

I would recommend Veracode to other users, but you must consider the cost aspect. If an organization has sufficient funds for spending on this SAST tool, I would still strongly recommend it because of the extensive documentation and defined policies. 

Veracode allows for customized policies based on domain and platform, which is beneficial for collaboration among multiple users and teams. 

I would rate Veracode an eight out of ten. Implementing Veracode has been challenging in the DevOps pipeline due to long durations, which can delay production deployments. Hence, we established a separate strategy solely for SAST scanning, leading to my rating of eight.

We use Veracode as a vulnerability scanning tool, which checks our code base and has certain rules and policies that can be updated as per the company policies; it checks our code, finds any vulnerable APIs or libraries, analyzes them, and gives us a report, and then we work on that so that we will use the latest, all non-vulnerable libraries to make the application more secure. 

Veracode provides visibility into application status at every phase of development through static analysis. Veracode definitely affects my DevSecOps processes because without this tool it would be difficult for developers or testers to find vulnerabilities, as in a large-scale production system there are hundreds of thousands of APIs and libraries used, and it's not possible for any individual to check all of them. 

This tool helps to get all the reports, outlining the APIs or libraries with severe vulnerabilities, which need to be fixed, so that is definitely helpful. Veracode positively impacts my ability to fix flaws since it not only gives us the version information but is also integrated with the artifact repository, helping us find all versions. It provides a list of vulnerable versions we are using and recommends upgrading to the non-vulnerable version. 

Veracode helps save time for my developers on the security vulnerability finding. Almost all users in my organization utilize Veracode, numbering in the thousands.

Veracode has a significant impact on my security posture. Without these tools, we would not know which libraries are vulnerable or what kind of attacks might occur, so at least from a security point of view, we can be assured we are using all non-vulnerable versions, providing a level of safety from the project team's perspective. 

The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.

The policy reporting does assist us with compliance. There are certain rules where fixing vulnerabilities is part of the policy. We have guidelines and we need to resolve them before putting something into a higher environment. It helps with that.

Veracode provides visibility into application status at every phase of development, including static analysis. Without this tool it will be difficult for the developers or the testers in a large-scale production system go through hundreds or thousands of APIs and libraries. It helps us quickly go through and understand what needs to be fixed. It sees everything, finds all versions, and gives us a list of all of the vulnerabilities and which versions have vulnerabilities. 

Improvements can be made to Veracode, particularly in terms of process. If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.

I noticed there is no integration with Bamboo.

I have worked in a project for about five years, and while we do not exactly work in Veracode, we have integrated Veracode with our applications so that it will do all the analysis and give us reports.

Veracode is stable for us.

I am not sure about the scalability of Veracode or where they are hosting their servers.

I have never needed to raise a ticket and work with Veracode experts.

Positive

I have used both Veracode and Checkmarx before choosing Veracode for one of my projects; Veracode is very established and widely used, while Checkmarx is relatively newer and has a smaller user base, though both have their place in the market.

I am not sure how Veracode is managed in terms of deployment, as we use API keys for connection.

The pricing is okay.

I would suggest some static analysis tools should be in place. Either Veracode or CheckMarx. If there's a security gap, you'll never know the cost or effect. You need early detection in place to do all of that fixing. 

I would suggest that a static analysis tool should be in place, either Veracode or Checkmarx, as both help in the SDLC cycle with early detection of security gaps, which is crucial to avoid costly effects later on; so I would say this is a must-do to facilitate early detection and fixing before production.

I'm a Veracode customer.

From an organizational perspective, there is a separate team managing Veracode, and they might find that access valuable. The fact that Veracode doesn't scan source code (only binary code) does not concern me, as that decision is made at the organizational level, and I trust that they are managing all required features. 

I would recommend Veracode to other users. It definitely helps us detect vulnerabilities in code. 

Overall, I would rate the solution an eight out of ten.

I use Veracode to implement solutions with security and to define rules, for example, for the network and the traffic of the network. Those are the main scenarios where I have interacted with Veracode. I use Veracode in the banking sector.

It makes it very easy to track and monitor activity. The visibility via the boards is very good. It enhances operations. 

The flexibility to define rules and the ability to update those rules on the fly are valuable features. It has boards where it is easy to track or monitor the activity. This is something that brings value and enhances the operation. Whenever we need to update a rule or make changes, you need to do it quickly, and this makes it possible. 

Maybe the boards could be made easier to understand or easier to customize.

I've had some interactions with this solution. 

It's quite stable. It's a very good solution.

This is easy to scale. If I need to add new infrastructure, I just need to start scanning or include new segments of the network. It will automatically include new infrastructure or it will escalate. Cloud solutions are easier to scale than on-premise solutions.

I haven't interacted with support. However, it's got good support. They respond very quickly since security is something critical. It will depend on the severity of the requests.

Positive

I was using a legacy solution, and we tried to migrate to a new solution like Veracode. However, I was not a part of deciding which solution to move to.

I was not involved in the initial deployment. 

Especially in banking, security is a must-have. If we have weaknesses in security, it will cost a lot. For example, hacking or people trying to access their networks. The scanners of Veracode bring status of the weaknesses in the current infrastructure. 

It scans and provides reports regarding the servers, the network, and the applications running on those servers. It's a very valuable kind of solution. Trying to do it manually would be costly and increase the risk of mistakes if we try to identify all those bugs in the architecture. Using an automated tool brings cost reduction and more security.

The pricing is competitive. It's not the most expensive solution. It also brings some benefits in comparison to other options. 

I would give Veracode an eight out of ten. 

I do not have any specific advice for people considering using Veracode.