Continuous Dynamic (formerly WhiteHat Dynamic) vs Veracode comparison

Why PeerSpot?

Black Duck and Veracode are both solutions in the Dynamic Application Security Testing (DAST) category. Black Duck is ranked #13, while Veracode is ranked #1 with an average rating of 7.5. Black Duck holds a 4.2% mindshare in DAST, compared to Veracode’s 13.6% mindshare. Additionally, 50% of Black Duck users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Continuous Dynamic (formerl...

Read 2 Continuous Dynamic (formerly WhiteHat Dynamic) reviews

1,659 Views
879 Comparison Views

50% willing to recommend

Veracode

Read 208 Veracode reviews

29,480 Views
4,717 Comparison Views

89% willing to recommend

Continuous Dynamic (formerl...

Veracode

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Continuous Dynamic (formerly WhiteHat Dynamic) and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST).

To learn more, read our detailed Dynamic Application Security Testing (DAST) Report (Updated: September 2026).

Buyer's Guide

Dynamic Application Security Testing (DAST)

September 2026

Download the complete report

Helped 913,806 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Continuous Dynamic (formerl...

Ranking in Dynamic Application Security Testing (DAST)

13th

Average Rating

8.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Dynamic Application Security Testing (DAST)

1st

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

208

Ranking in other categories

Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Container Security (13th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (2nd)

Mindshare comparison

As of September 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of Continuous Dynamic (formerly WhiteHat Dynamic) is 4.2%, up from 3.0% compared to the previous year. The mindshare of Veracode is 13.6%, down from 24.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST) Mindshare Distribution
Product	Mindshare (%)
Veracode	13.6%
Continuous Dynamic (formerly WhiteHat Dynamic)	4.2%
Other	82.2%

Dynamic Application Security Testing (DAST)

Featured Reviews

it_user245412

Executive Vice President, Operations at a computer software company with 51-200 employees

The product and customer service is extremely efficient but I would like to see more research and code examples.

* The continuous online scanning capabilities and reporting features. * The SaaS product features accessible from a browser make managing our online systems easy. * The ability to review security items quickly along with being able to retest vulnerabilities on our schedule make the Sentinel product an invaluable tool for our company’s product security requirements.

Read full review

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

Integrates security into the development process and improves team collaboration

Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The SaaS product features accessible from a browser make managing our online systems easy."

"If you have Azure DevOps and would like to understand your code and how secure it is, then there are not a lot of better options."

"Integrations into our developer's IDE (Greenlight) and the DevOps Pipeline SAST / SourceClear Integrations has particularly increased our time to market and confidence."

"All the top vulnerabilities are detected, which makes sure all our applications are up-to-date on market threats, and it gives a good workaround process for the developers to secure their code and ensure all our applications are secure."

"The most valuable feature is the security and vulnerability parts of the solution. It shows medium to high vulnerabilities so we can find them, then upgrade our model before it is too late. It is useful because it automates security. Also, it makes things more efficient. So, there is no need for the security team to scan every time. The application team can update it whenever possible in development."

"Within SCA, there is an extremely valuable feature called vulnerable methods. It is able to determine within a vulnerable library which methods are vulnerable. That is very valuable, because in the vast majority of cases where a library is vulnerable, none of the vulnerable methods are actually used by the code. So, if we want to prioritize the way open source libraries are updated when a library is found vulnerable, then we want to prioritize the libraries which have vulnerable methods used within the code."

"The most valuable feature is detecting security vulnerabilities in the project."

"Veracode has positively impacted my organization by helping secure our critical applications, and it has impacted very well."

"Veracode has saved us the cost of hundreds of employee hours by streamlining our vulnerability discovery process in legacy code, and by improving the quality of code released into production."

More Veracode pros

Cons

"I would like to see more research and code examples for the vulnerabilities identified to better assist us with our remediation process."

"When it comes to the speed of the pipeline scan, one of the things we have found with Veracode is that it's very fast with Java-based applications but a bit slow with C/C++ based applications. So we have implemented the pipeline scan only for Java-based applications not for the C/C++ applications."

"The security labs integration has room for improvement."

"I would like to see these features: entering comments for internal tracking; entering a priority; reports that show the above."

"Some features could be improved in terms of user-friendliness."

"The negative that I found is that it has a subscription-based model."

"The zip file scanning has room for improvement."

"One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications."

"Sometimes the scans are not done quickly, but the solutions that it provides are really good. The quality is high, but the analysis is not done extremely quickly."

More Veracode cons

Pricing and Cost Advice

Information not available

"The pricing of the product depends upon the number of codes or the number of applications."

"The pricing depends on the functionality each client desires."

"Veracode is one of the more expensive solutions in the market, but it is worth the expense because of the eLearning and the security consultations; everything is included in the license."

"Pricing/licensing is complicated."

"Veracode is a very expensive product."

"The pricing for Veracode is high, making it difficult for beginners to afford."

"It has good, fair licensing. If the price could depend on the scope of its scanning or the languages supported, then that would be better."

"The pricing is pretty high."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.

See recommendations

913,806 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Healthcare Company

12%

Construction Company

Outsourcing Company

Financial Services Firm

14%

Manufacturing Company

11%

Outsourcing Company

Computer Software Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	70
Midsize Enterprise	46
Large Enterprise	114

Questions from the Community

Ask a question

Earn 20 points

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Checkmarx One vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 12% of the time

OpenText Dynamic Application Security Testing vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 8% of the time

CucumberStudio vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 4% of the time

Fortinet FortiAppSec Cloud vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 4% of the time

Polaris Platform vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 4% of the time

More Continuous Dynamic (formerly WhiteHat Dynamic) Competitors

SonarQube vs Veracode

Compared 5% of the time

Checkmarx One vs Veracode

Compared 5% of the time

HCL AppScan vs Veracode

Compared 3% of the time

Invicti vs Veracode

Compared 3% of the time

GitLab vs Veracode

Compared 2% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Dynamic Application Security Testing (DAST)

September 2026

Continuous Dynamic (formerly WhiteHat Dynamic) report

Download Continuous Dynamic (formerly WhiteHat Dynamic) product report

Buyer's Guide

Veracode

August 2026

Download Veracode product report

Also Known As

Sentinel Dynamic, WhiteHat Security Application Security Testing, Synopsys WhiteHat Dynamic

Crashtest Security , Veracode Detect

Overview

Continuous Dynamic^™ is a powerful dynamic application security testing (DAST) solution that rapidly and accurately finds vulnerabilities in websites and applications. With this DAST solution, you can perform scans and testing at the scale and speed modern enterprises need to identify security risks across your entire application portfolio.

Black Duck

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Dynamic Application Security Testing (DAST)

September 2026

Download Free Report

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: September 2026.

DOWNLOAD NOW

913,806 professionals have used our research since 2012.

See our list of best Dynamic Application Security Testing (DAST) vendors.

We monitor all Dynamic Application Security Testing (DAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.