CAST Highlight vs Veracode comparison

Read 201 Veracode reviews

4,580 Views
1,198 Comparison Views

90% willing to recommend

CAST Highlight

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 5, 2024

Veracode and CAST Highlight compete in the application security testing space. Veracode seems to have the upper hand due to its comprehensive scanning capabilities and extensive integration options, making it a strong choice for regulatory compliance and SDLC integration.

Features: Veracode provides comprehensive static, dynamic, and manual scanning capabilities, which are crucial for regulatory compliance and SDLC integration. It supports a broad range of programming languages and offers robust integration with IDEs and APIs. Veracode is valued for its ease of use, especially its ability to minimize false positives, along with features for sandbox scanning and vulnerability management. CAST Highlight offers fast, automated code scanning and portfolio assessments, providing a high-level overview rather than the in-depth analysis delivered by Veracode.

Room for Improvement: Veracode faces issues with false positives and complex integrations, leading to potential usability and reporting problems. Improvements in scanning speeds and language support are needed. CAST Highlight is criticized for its abstract reporting and lack of detailed analysis capabilities, with its pricing model viewed as inflexible, limiting deeper analyses without significant cost.

Ease of Deployment and Customer Service: Veracode can be deployed across various cloud environments—public, private, and hybrid—offering adaptability but with potential complexity in implementation. While its technical support receives mixed reviews, its quick response time is praised, despite some inconsistencies. CAST Highlight shares similar support complexities and the need for potential service improvements according to its users.

Pricing and ROI: Veracode's pricing is perceived as high but justified by its comprehensive features and robust security assurances, making it less accessible for small businesses but valuable for larger enterprises in risk management and operational efficiencies. CAST Highlight is considered more cost-effective than its sibling CAST AIP, but still requires careful cost-benefit analysis. Veracode is frequently cited for delivering more measurable benefits in reducing security vulnerabilities.

To learn more, read our detailed CAST Highlight vs. Veracode Report (Updated: June 2025).

CAST Highlight vs. Veracode

June 2025

Download the complete report

Helped 856,873 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

CAST Highlight

Ranking in Software Composition Analysis (SCA)

16th

Average Rating

7.8

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Software Composition Analysis (SCA)

3rd

Average Rating

8.2

Reviews Sentiment

7.0

Number of Reviews

201

Ranking in other categories

Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Static Code Analysis (1st), Application Security Posture Management (ASPM) (2nd)

Mindshare comparison

As of June 2025, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 1.0%, up from 0.8% compared to the previous year. The mindshare of Veracode is 9.5%, down from 10.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

Featured Reviews

Jayanti Rode

Technical Associate Manager at Accenture

Identifies migration blockers and boosters while facing challenges with platform-specific roadblocks

The solution provides agnostic blockers for platforms as well as for containerization. Within that containerization, it offers generic blockers. However, my project might require it to provide Windows-specific blockers or Linux-specific blockers, as I often work with only one platform at a time. If I received categorization in containerization blockers, it would save time. Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time. Initially, I receive a response from support, however, if there is involvement from R&D or other teams, it may take longer than expected. The support team is challenging when sharing source code. As this is a static code analysis tool, it sometimes requires source code for R&D. However, CAST clients may be restricted from sharing due to business logic and nondisclosure agreements. This creates a challenge, and I may have to share pseudo code or seek client approval, risking escalation.

Read full review

David-Robertson

Director Enterprise Architecture at Exeter Finance Corp.

Static scanning and software composition analysis are very helpful, but the usability needs improvement

Static scanning and software composition analysis are very helpful. My colleagues and I don't need to be experts on all of those ancillary things, so we can focus more on the business deliverables. They have a pretty good tool that allows me to run scans of my local integrated development environment. I can find a lot of those flaws a lot sooner than I would if I had to wait for these cloud-based scans. They've come out with some sort of automated fix feature. I haven't used it, but they gave us a demo of it, and that one looks promising. I don't know if it's ready for prime time yet.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It offers good performance."

"CAST Highlight provides a clear overview of the role portfolio and allows users to assess the overall quality of the environment. Users can see where improvements are needed and follow up on trends of the application."

"The most valuable features of CAST Highlight are automation and speed."

"The most valuable features of the CAST Highlight are the interface and there are three notations that are very simple to understand and communicate with."

"CAST Highlight is easy to use and has a good dashboard."

"In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns."

"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."

"The solution provides agnostic blockers for platforms as well as for containerization."

"Within SCA, there is an extremely valuable feature called vulnerable methods. It is able to determine within a vulnerable library which methods are vulnerable. That is very valuable, because in the vast majority of cases where a library is vulnerable, none of the vulnerable methods are actually used by the code. So, if we want to prioritize the way open source libraries are updated when a library is found vulnerable, then we want to prioritize the libraries which have vulnerable methods used within the code."

"It can be very hard to make a good lab environment with a console with log windows and code bases. What I like about Veracode is that they managed to do that. It has a very responsive graphical user interface and has worked very well. I was very pleased with that."

"It has provided what we were looking for in such an application, meaning static application security testing functionality. That was what we were interested in."

"The developers' awareness of the security weaknesses within their code has improved. They aren't just mitigating these issues, they are realizing these are, in fact, issues that have to be dealt with."

"The reporting being highly accurate is pretty cool. I use another product and I was always looking for answers as to what line, which part of the code, was wrong, and what to do about it. Veracode seems to have a solid database to look things up and a website to look things up."

"Veracode Security Labs are fantastic. My team loves getting the hands-on experience of putting in a flaw and fixing it. It's interactive. We've gotten decent support from the sales and software engineers, so the initial support was excellent. They scheduled a consultation call to dive deep and discuss why we see these findings and codes. That was incredibly helpful."

"The tech support has been very much on the forefront of contacting customers. They help us by making sure all the processes have been outlined and are being followed. They regularly look with us at the whole platform process."

"It has improved the quality of code being delivered for test and its vulnerability resolutions timeline has improved."

More Veracode pros

Cons

"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."

"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."

"If I received categorization in containerization blockers, it would save time."

"The ease of configuration and customization could be improved in CAST Highlight."

"There's a bit of a learning curve at the outset."

"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."

"There could be potential improvements or additional features added to CAST Highlight to make it better."

"The false positive rates were quite high in our case."

"They should improve on the static scanning time."

"Their scanning engine is sometimes a little bit slow. They can improve the scan time."

"It needs better APIs, reporting that I can easily query through the APIs and, preferably, a license model that I can predict."

"The scans were sometimes not accurate in version 2022. There were some false positives in the vulnerability reports. We used to get false positives, and we were responsible for checking all of the alerts and determining whether they were true positives or false positives. They might have already improved it. If they have not, they can look into how to mitigate false positives."

"The UI is not user-friendly and can be improved."

"I'd like to see an improved component of it work in a DevOps world, where the scanning speed does not impede progress along the AppSec pipeline."

"I would like to see expanded coverage for supporting more platforms, frameworks, and languages."

More Veracode cons

Pricing and Cost Advice

"CAST Highlight is an expensive solution."

"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."

"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."

"It is a pretty costly tool. A lot of customers are resistant to using it."

"Negotiate some, but their prices are reasonable."

"We pay based on the number of developers working on a particular project."

"The pricing is fair. You get a lot out of the product."

"I have not examined Veracode's pricing in detail, but from an industry perspective, I see that there is a tendency toward Veracode, which suggests competitive pricing."

"Veracode is one of the more expensive solutions in the market, but it is worth the expense because of the eLearning and the security consultations; everything is included in the license."

"We're very comfortable with their model. We think they're a good value. We worked very closely with Veracode on understanding their license model, understanding what comprises the fee and what does not. With their assistance in design, we decomposed our application in a way where we are scanning a very significant amount of code without wasting their capacity and generating redundant reported issues. You scan in profiles, per se. And we work with them, in their offices, to design the most effective approach. So the advice I would have for customers is, you can get up and live fast, but work closely with Veracode to refine the method you use for scanning and the way you compile the applications. There's a concept called entry-point scanning, and that's probably not used well by the rest of their customers. We see our licensing as a good value because we leverage it heavily."

"Veracode's pricing is competitive."

"The cost of scanning code is cheaper. It's typically $0.50 per line of code. However, it's expensive to run a high-level process that would normally require a human security expert. For example, penetration testing costs about $1,000 per application for penetration testing. The cost of these features may be too high for smaller organizations. On the other hand, Veracode's interactive application security testing is fast and cheaper compared to other software."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

856,873 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

24%

Computer Software Company

15%

Manufacturing Company

Insurance Company

Computer Software Company

17%

Financial Services Firm

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about CAST Highlight?

The most valuable features of CAST Highlight are automation and speed.

What is your experience regarding pricing and costs for CAST Highlight?

The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.

What needs improvement with CAST Highlight?

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.

SonarQube Server (formerly SonarQube) vs CAST Highlight

Comparisons

Compared 63% of the time

Black Duck vs CAST Highlight

Compared 8% of the time

Checkmarx One vs CAST Highlight

Compared 7% of the time

GitLab vs CAST Highlight

Compared 5% of the time

Snyk vs CAST Highlight

Compared 4% of the time

More CAST Highlight Competitors

SonarQube Server (formerly SonarQube) vs Veracode

Compared 19% of the time

Checkmarx One vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 7% of the time

Fortify on Demand vs Veracode

Compared 4% of the time

Snyk vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Download CAST Highlight product report

CAST Highlight

June 2025

Download Veracode product report

May 2025

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

CAST Highlight is a SaaS software intelligence product for performing rapid application portfolio analysis. It automatically analyzes source code of hundreds of applications in a week for Cloud Readiness, Software Composition Analysis (Open Source risks), Resiliency, and Technical Debt. Objective software insights from automated source code analysis combined with built-in qualitative surveys for business context enable more informed decision-making about application portfolios.

CAST is the software intelligence category leader. CAST technology can see inside custom applications with MRI-like precision, automatically generating intelligence about their inner workings - composition, architecture, transaction flows, cloud readiness, structural flaws, legal and security risks. It’s becoming essential for faster modernization for cloud, raising the speed and efficiency of Software Engineering, better open source risk control, and accurate technical due diligence. CAST operates globally with offices in North America, Europe, India, China. Visit www.castsoftware.com.

CAST

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.