No more typing reviews! Try our Samantha, our new voice AI agent.

Kiuwan vs Veracode comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Kiuwan
Ranking in Application Security Tools
34th
Ranking in Static Application Security Testing (SAST)
29th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
23
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Application Security Tools
3rd
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Container Security (14th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (3rd)
 

Mindshare comparison

As of November 2026, in the Application Security Tools category, the mindshare of Kiuwan is 1.2%, up from 1.1% compared to the previous year. The mindshare of Veracode is 4.2%, down from 6.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Veracode4.2%
Kiuwan1.2%
Other94.6%
Application Security Tools
 

Featured Reviews

Mustufa Bhavnagarwala - PeerSpot reviewer
CyberRisk Solution Advisor at a consultancy with 10,001+ employees
Though a stable tool, the UI needs improvement
Kiuwan can improve its UI a little more. The user experience can be made better. Kiuwan offers a user interface that is similar to the one offered by Windows 7 or Windows 98, which I saw when I ran the tool and tried to scan the repository to find the security issues. The product's UI has certain shortcomings, where improvements are required.
YS
Software Development Engineer II at Rocket Software
Monthly scans have provided baseline security but still miss critical vulnerabilities
Veracode can improve to stand in this market. They do not have to do much; they just need to improve their UI experience and add more documentation within the application rather than just creating documentation pages on different websites. They need to ensure their web application guides whoever uses it. Since whoever uses Veracode must be a technical person, they just need to guide them to the actual points. They can also improve their security capabilities by adding more filters to identify what vulnerabilities their application has. They need to improve their scanning engine to scan for more critical defects. Also, the integration part can be enhanced by adding features to integrate with a CLI, such as introducing a CLI version or a Jenkins plugin. If such features exist, they should show it as a pop-up, signaling that they have a new feature. Currently, it feels Veracode from two years ago is still the same, so that is something Veracode needs to improve. They can improve the security part. Some of the severe security issues were never caught by Veracode in the reports. In fact, I have never seen any high or critical severity issues pop up in my Veracode report. That is one thing they can improve on their scanning ability to catch high severity issues. Next is integration; Veracode does not provide any tools to integrate with Jenkins or CLI. I do not even know if there is any CLI for Veracode that I can use to automate in my pipeline. The last thing is the UI interface that they have, as it is a bit confusing. I remember we did not have the capability to handle authentications of our internal application. We had to write Selenium code using a Selenium IDE. To write a Selenium script for a Veracode scan, you have to download a Selenium IDE, record it, and then paste that file into Veracode. I can see that Selenium IDE is already decommissioned, so it is no longer used by anyone. Still, we have to use it because Veracode only supports that kind of file for Selenium to automate. They can add more ways to authenticate our application using normal JavaScript or Python or Shell script. I feel these are the four main points. They can document it more by adding tooltips into the application that explain why a parameter is required and what other options are available. For the same example with the Selenium script, they can add a link to their documentation that explains what other kinds of scripts can be written for authentication. I feel they can also make the UI more intuitive so that whoever uses it can guide themselves, as whoever uses Veracode is already a technical person.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"I like that it provides a detailed report that lets you know the risk index and the vulnerability."
"I've found the reporting features the most helpful."
"The most valuable feature is the time to resolution, where it tells you how long it is going to take to get to a zero-base or a five-star security rating."
"We are using this solution to increase the quality of our software and to test the vulnerabilities in our tools before the customers find them."
"The most valuable feature of the solution is the continuous integration process, which enables us to make the best in terms of security of our solution and not introduce new mistakes, with problems solved step by step."
"The solution has a continuous integration process."
"I've tried many open source applications and the remediation or correction actions that were provided by Kiuwan were very good in comparison."
"The solution will measure your development team, give a KPI for the CISO, reduce the time it takes to find and correct coding errors, and more."
"I like Veracode's ease of integration and onboarding. You can quickly and easily get started with a new project or application. That's one area where Veracode shines relative to other tools we've evaluated. Other tools need more work or an engineer to do the setup. With Veracode, you can do the onboarding in a few steps quickly."
"There are really three solutions at the top of the industry ratings, and Veracode is the best, in my opinion."
"It is easy to use for us developers. It supports so many languages: C#, .NET Core, .NET Framework, and it even scans some of our JavaScript. You just need the extension to upload the files and the reports are generated with so much detail."
"It is a good product for creating secure software. The static code analysis is pretty good and useful."
"If you have Azure DevOps and would like to understand your code and how secure it is, then there are not a lot of better options."
"Veracode impacts the overall security posture by maintaining data integrity, ensuring we are not exposed to threats from third-party libraries with known vulnerabilities."
"It gives us more confidence in the application security of the products we scan."
"So, it is everything that we wanted from a security point of view, and it is easy to roll out."
 

Cons

"We faced a lot of problems with the initial setup and support gave us difficulties around the installation."
"The next release should include more flexibility in the reporting."
"The solution seems to give us a lot of false positives. This could be improved quite a bit."
"DIfferent languages, such Spanish, Portuguese, and so on."
"The rate of false positives, where it reports issues that are not really issues, can be improved."
"Improvement could be made with the integration of the programming tools."
"I would like to see better integration with the Visual Studio and Eclipse IDEs."
"In Kiuwan there are sometimes duplicates found in the dependency scan under the "insights" tab. It's unclear to me why these duplicates are appearing, and it would be helpful if the application teams could investigate further."
"Static scanning takes a long time, so you need to patiently wait for the scan to achieve. I also think the software could be more accurate. It isn't 100 percent, so you shouldn't completely rely on Veracode. You need to manually verify its findings."
"The Web portal, at times, is not necessarily intuitive."
"The pricing for qualified startups such as Neo4j could be improved."
"It would be ideal if it was able to demonstrate higher levels of cybersecurity certifications like becoming FedRAMP compliant or working in those areas."
"The current version of the application does not support testing for API."
"I think for us the biggest improvement would be to have an indicator when there's something wrong with a scan."
"There are times when certain modules cannot be scanned automatically, requiring us to manually select these modules and initiate the scanning process on our side."
"I've seen slightly better static analysis tools from other companies when it comes to speed and ease of use."
 

Pricing and Cost Advice

"Kiuwan is an open-source solution and free to use."
"The price of Kiuwan is lower than that of other tools on the market."
"This solution is cheaper than other tools."
"I recommend contacting a sales person who will create the best plan payment plan for you, as we did."
"Check with your account manager."
"Nothing special. It's a very fair model."
"It follows a subscription model. I think the price is somewhere in the middle."
"The pricing is really fair compared to a lot of other tools on the market."
"The pricing is a little on the high side but since we combine our product into one suite, it is easy to do and works well for us."
"Without getting too specific, I'd say the average yearly cost is around $50,000. The costs include licensing and maintenance support."
"The pricing is fair. You get a lot out of the product."
"Veracode provides value for the cost, with no additional charges apart from the standard licensing fee."
"Regarding licensing, pay very close attention to what applications you're going to need to do dynamic scanning for, versus static. Right now, the way the licensing is set up, if you don't have any static elements for a website, you can certainly avoid some costs by doing more dynamic licenses. You need to pay very close attention to that, because if you find out later that you have static code elements - like Java scripts, etc. - that you want to have scanned statically, having the two licenses bundled together will actually save you money."
"It's too expensive for the European market. That is why, in a big bank with 400 applications, we are able to use it only for 10 of them. But the other solutions are also expensive, so it wasn't a differentiator."
"The licensing is fair, it is time-limited (e.g. one year) but there is a size cap for every app. If your applications are big (due third-party libraries, for example) you should discuss this beforehand and explore suitable agreements."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
920,939 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Manufacturing Company
10%
Financial Services Firm
9%
University
7%
Financial Services Firm
15%
Manufacturing Company
12%
Outsourcing Company
9%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise4
Large Enterprise6
By reviewers
Company SizeCount
Small Business70
Midsize Enterprise46
Large Enterprise114
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

DHL, BNP Paribas, Zurich, AXA, Ernst & Young, KFC, Santander, Latam, Ferrovial
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Kiuwan vs. Veracode and other solutions. Updated: November 2026.
920,939 professionals have used our research since 2012.