No more typing reviews! Try our Samantha, our new voice AI agent.

Cymulate vs Veracode comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cymulate
Average Rating
8.4
Reviews Sentiment
6.9
Number of Reviews
6
Ranking in other categories
Threat Intelligence Platforms (TIP) (16th), Breach and Attack Simulation (BAS) (2nd), Attack Surface Management (ASM) (14th), Continuous Threat Exposure Management (CTEM) (4th)
Veracode
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
207
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Container Security (10th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Cymulate is designed for Continuous Threat Exposure Management (CTEM) and holds a mindshare of 10.3%, down 27.5% compared to last year.
Veracode, on the other hand, focuses on Application Security Tools, holds 4.4% mindshare, down 9.6% since last year.
Continuous Threat Exposure Management (CTEM) Mindshare Distribution
ProductMindshare (%)
Cymulate10.3%
Pentera11.6%
XM Cyber10.8%
Other67.3%
Continuous Threat Exposure Management (CTEM)
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Veracode4.4%
SonarQube13.6%
Checkmarx One8.8%
Other73.2%
Application Security Tools
 

Featured Reviews

SB
Security Architec at Shikun & Binui
Support and integration enhance security posture over three years
I don't know if there's something that could be improved. They surprise me. As I mentioned, I returned a month ago. I haven't fully investigated the complete system yet. I must say that we have been with them for around three years. This is amazing because throughout these three years, they have supported us every week. We meet weekly to review results and fix issues together. Apart from occasional days off, this weekly support has been consistent for three years. It's remarkable because many products are sold and then the product teams forget about you, but this isn't the case with Cymulate.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cymulate is easy to set up, install, and configure."
"Cymulate has positively impacted our organization by helping us to take care of the efficacy and reviewing the policies and configuration."
"The security validation feature helps my organization in assessing our security posture."
"The reporting capabilities are very good."
"With Cymulate, the best features are the capacity to test the EDR or malware, anti-malware solution."
"The most valuable feature for us is the zero-day."
"The product is very good, very reliable, and they've made a lot of improvements to the dashboards and the reports."
"For use cases where our company buys a product with the source code, but only the final executables or the binaries, only Veracode is able to work on that type of tool."
"I like the way the flaws are reported in the system."
"Veracode has good support for microservices, and I also like the sandbox environment. For example, when introducing a new component, we can scan it in a sandbox environment. It will not impact the main environment. When our team fixes it, they. can push it to the production environment when the results are acceptable."
"The most valuable feature is the security and vulnerability parts of the solution. It shows medium to high vulnerabilities so we can find them, then upgrade our model before it is too late. It is useful because it automates security. Also, it makes things more efficient. So, there is no need for the security team to scan every time. The application team can update it whenever possible in development."
"Veracode is easy to use even if you're not a security professional. I like the dynamic analysis feature, which offers a lot of cost savings when used in production."
"The result was amazing, enabling us to find everything that could potentially create a problem for us."
"All the top vulnerabilities are detected, which makes sure all our applications are up-to-date on market threats, and it gives a good workaround process for the developers to secure their code and ensure all our applications are secure."
 

Cons

"I will be honest, we have it, but in the last year, I didn't maintain the system until a month ago."
"The way Cymulate works for EDR could be improved, as it drops payload and requires action from the EDR console for remediation, which can block the whole process of Cymulate execution."
"The cost can be quite high, and it impacts scalability as more simulations require additional expenses."
"The reporting process requires significant improvement as it often takes longer than expected and the quality is lacking."
"The product must provide consultancy for initial setup."
"We have had some trouble with the agents."
"It would help if there were a training module that would explain how to more effectively integrate the SAST product into the build tool, Jenkins or Bamboo."
"I've seen slightly better static analysis tools from other companies when it comes to speed and ease of use."
"We have encountered occasional issues with scalability."
"Raw file scans and dynamic scans would be an improvement, instead of dealing with code binaries."
"It needs better APIs, reporting that I can easily query through the APIs and, preferably, a license model that I can predict."
"The interface is basic and has room for improvement."
"I would ask Veracode to be a lot more engaged with the customer and set up live sessions where they force the customer to engage with Veracode's technical team. Veracode could show them a repo, how they should do things, this is what these results mean, here is a dashboard, here's the interpretation, here's where you find the results."
"My advice for anybody who is interested in implementing this solution is to ensure that your technology is actually supported because the coverage is quite patchy."
 

Pricing and Cost Advice

"The product is affordable."
"Cymulate's services are expensive."
"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."
"As compared to others, it is a costly solution. It is overpriced, and many organizations with a limited budget cannot afford it. That is why they are going for other tools, but those tools are not that effective. Veracode is better in terms of quality. If you want good service, you have to pay for it."
"Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode."
"The pricing is pretty high."
"No issues, the pricing seems reasonable."
"From a cost perspective, it seems okay, although we will probably evaluate alternatives next time it's up for renewal because for us, it's a relatively high cost, and we want to make sure that we are using our resources most appropriately."
"The cost has been a barrier to wider use here. I think my team is the only one at the university. Other folks might like to use it, but it's pretty pricey. You could see what else is in the market, but I hear that's the price for most solutions. You might not find a better deal in the market, or it might be an incomplete solution. I mean, for the level of interaction we get with Veracode staff, it's been pretty good."
"I recommend going for a one-year licensing with CA, because currently they are the leaders in this field with more features and a much better turn around time with a cheaper position, but there are a lot of new companies coming up in the market and they are building up their platforms."
report
Use our free recommendation engine to learn which Continuous Threat Exposure Management (CTEM) solutions are best for your needs.
893,311 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Manufacturing Company
9%
Computer Software Company
8%
Comms Service Provider
7%
Financial Services Firm
16%
Manufacturing Company
11%
Computer Software Company
11%
Government
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise1
Large Enterprise3
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise45
Large Enterprise114
 

Questions from the Community

What is your experience regarding pricing and costs for Cymulate?
I don't know if it's expensive. It depends on the modules that you want, or the time, because they give you a tenant. A tenant for you.
What needs improvement with Cymulate?
I don't know if that helped with quick decision making for my security team because I am the security team and you must have a dedicated team to work with this tool. I don't use the analytics modul...
What advice do you have for others considering Cymulate?
With Cymulate, I have experience using the vulnerability management tools. I don't know if I have used the Continuous Security Validation with Cymulate. I don't have that module licensed with Cymul...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Euronext, YMCA, Telit, Nemours 
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Cymulate vs. Veracode and other solutions. Updated: April 2025.
893,311 professionals have used our research since 2012.