Continuous Dynamic (formerly WhiteHat Dynamic) vs Veracode comparison

Black Duck and Veracode are both solutions in the Dynamic Application Security Testing (DAST) category. Black Duck is ranked #12, while Veracode is ranked #1 with an average rating of 7.5. Black Duck holds a 4.3% mindshare in DAST, compared to Veracode’s 14.8% mindshare. Additionally, 50% of Black Duck users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Continuous Dynamic (formerl...

Read 2 Continuous Dynamic (formerly WhiteHat Dynamic) reviews

1,291 Views
633 Comparison Views

50% willing to recommend

Veracode

Read 208 Veracode reviews

24,557 Views
3,929 Comparison Views

89% willing to recommend

Continuous Dynamic (formerl...

Veracode

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Continuous Dynamic (formerly WhiteHat Dynamic) and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST).

To learn more, read our detailed Dynamic Application Security Testing (DAST) Report (Updated: June 2026).

Buyer's Guide

Dynamic Application Security Testing (DAST)

June 2026

Download the complete report

Helped 900,747 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Continuous Dynamic (formerl...

Ranking in Dynamic Application Security Testing (DAST)

12th

Average Rating

8.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Dynamic Application Security Testing (DAST)

1st

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

208

Ranking in other categories

Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Container Security (12th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of June 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of Continuous Dynamic (formerly WhiteHat Dynamic) is 4.3%, up from 2.6% compared to the previous year. The mindshare of Veracode is 14.8%, down from 27.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST) Mindshare Distribution
Product	Mindshare (%)
Veracode	14.8%
Continuous Dynamic (formerly WhiteHat Dynamic)	4.3%
Other	80.9%

Dynamic Application Security Testing (DAST)

Featured Reviews

it_user245412

Executive Vice President, Operations at a computer software company with 51-200 employees

The product and customer service is extremely efficient but I would like to see more research and code examples.

* The continuous online scanning capabilities and reporting features. * The SaaS product features accessible from a browser make managing our online systems easy. * The ability to review security items quickly along with being able to retest vulnerabilities on our schedule make the Sentinel product an invaluable tool for our company’s product security requirements.

Read full review

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

Integrates security into the development process and improves team collaboration

Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The SaaS product features accessible from a browser make managing our online systems easy."

"When we do have errors, Veracode is always available, their consultants, to help us either mitigate the error, or provide technical assistance on pointing exactly where the problem is and how we could probably fix it. I'm always amazed at how knowledgeable they are."

"It helps me to detect vulnerabilities."

"Static code scanning is the most valuable feature."

"Informs me of code security vulnerabilities. Bamboo build automation with Veracode API calls are used."

"Another feature of Veracode is that they provide e-learning, but the e-learning is not basic, rather it is quite advanced... in the e-learning you can check into best practices for developing code and how to prevent improper management of some component of the code that could lead to a vulnerability. The e-learning that Veracode provides is an extremely good tool."

"Veracode is giving us the mandate of claiming that our code is more secure because we are using an external third-party, neutral tool to examine our code and expose vulnerabilities."

"The policy reporting for ensuring compliance with industry standards and regulations is pretty comprehensive, especially around PCI. If you do the static analysis, the dynamic analysis, and then a manual penetration test, it aggregates all of these results into one report. And then they create a PCI-specific report around it which helps to illustrate how the application adheres to different standards."

"We have to look at it from the perspectives of how important it is to fix something and when it should be prioritized for fixing. The JSON output from the agent-based scans gives us the CVS core, and that makes things much easier."

More Veracode pros

Cons

"I would like to see more research and code examples for the vulnerabilities identified to better assist us with our remediation process."

"The sandbox could use some improvement; when creating a sandbox, it requires us to put the application name in twice, which seems unnecessary."

"Veracode isn't important to the organization's shift-left security strategy itself. It's a tool."

"The GUI requires significant simplification, as its current complexity creates a steep learning curve for new users."

"The usability isn't good in Veracode. Sometimes, it will show a problem, but it's difficult to go into their tool and figure out where it is. You primarily use a web browser to access their system. It requires a lot of clicks. The static analysis is a separate part of their system from the SCA, so that's a bit difficult. They haven't fully integrated that. It's difficult for the consumer."

"I would like to see these features: entering comments for internal tracking; entering a priority; reports that show the above."

"It could be improved with support for more programming languages, like SQL."

"Those pages need to be redesigned."

"The security labs integration has room for improvement."

More Veracode cons

Pricing and Cost Advice

Information not available

"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."

"Veracode's price is high. I would like them to better optimize their pricing."

"The cost of scanning code is cheaper. It's typically $0.50 per line of code. However, it's expensive to run a high-level process that would normally require a human security expert. For example, penetration testing costs about $1,000 per application for penetration testing. The cost of these features may be too high for smaller organizations. On the other hand, Veracode's interactive application security testing is fast and cheaper compared to other software."

"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."

"It's worth the value"

"Depending on the number of users, my company makes payments toward the solution's licensing costs."

"The solution is expensive."

"Veracode is a very expensive product."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.

See recommendations

900,747 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Healthcare Company

13%

Computer Software Company

12%

Construction Company

Financial Services Firm

16%

Manufacturing Company

11%

Computer Software Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	46
Large Enterprise	114

Questions from the Community

Ask a question

Earn 20 points

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Checkmarx One vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 12% of the time

OpenText Dynamic Application Security Testing vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 11% of the time

Fortify Application Defender vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 5% of the time

Fortinet FortiAppSec Cloud vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 5% of the time

Polaris Platform vs Continuous Dynamic (formerly WhiteHat Dynamic)

Compared 5% of the time

More Continuous Dynamic (formerly WhiteHat Dynamic) Competitors

SonarQube vs Veracode

Compared 6% of the time

Checkmarx One vs Veracode

Compared 5% of the time

HCL AppScan vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

Invicti vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Dynamic Application Security Testing (DAST)

June 2026

Continuous Dynamic (formerly WhiteHat Dynamic) report

Download Continuous Dynamic (formerly WhiteHat Dynamic) product report

Buyer's Guide

Veracode

May 2026

Download Veracode product report

Also Known As

Sentinel Dynamic, WhiteHat Security Application Security Testing, Synopsys WhiteHat Dynamic

Crashtest Security , Veracode Detect

Overview

Continuous Dynamic^™ is a powerful dynamic application security testing (DAST) solution that rapidly and accurately finds vulnerabilities in websites and applications. With this DAST solution, you can perform scans and testing at the scale and speed modern enterprises need to identify security risks across your entire application portfolio.

Black Duck

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Dynamic Application Security Testing (DAST)

June 2026

Download Free Report

Find out what your peers are saying about Veracode, Checkmarx, OpenText and others in Dynamic Application Security Testing (DAST). Updated: June 2026.

DOWNLOAD NOW

900,747 professionals have used our research since 2012.

See our list of best Dynamic Application Security Testing (DAST) vendors.

We monitor all Dynamic Application Security Testing (DAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.