Try our new research platform with insights from 80,000+ expert users

OpenText Dynamic Application Security Testing vs Veracode comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Dynamic Applicatio...
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
Dynamic Application Security Testing (DAST) (3rd), DevSecOps (8th)
Veracode
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
204
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

While both are Application Lifecycle Management solutions, they serve different purposes. OpenText Dynamic Application Security Testing is designed for Dynamic Application Security Testing (DAST) and holds a mindshare of 17.7%, down 21.6% compared to last year.
Veracode, on the other hand, focuses on Application Security Tools, holds 7.7% mindshare, down 10.3% since last year.
Dynamic Application Security Testing (DAST) Market Share Distribution
ProductMarket Share (%)
OpenText Dynamic Application Security Testing17.7%
HCL AppScan14.0%
Checkmarx One13.0%
Other55.3%
Dynamic Application Security Testing (DAST)
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Veracode7.7%
SonarQube Server (formerly SonarQube)20.5%
Checkmarx One10.4%
Other61.4%
Application Security Tools
 

Featured Reviews

Navin N - PeerSpot reviewer
Effective scanning of diverse file extensions with fast reporting and issue resolution
We develop software packages for clients, and these clients are mostly in the BFSI sector. The packages need to be scanned, and we engage Fortify WebInspect for this.  Customers typically perform their own application pen tests, but in some cases, we have engagements where customers want us to scan…
Kv Rao - PeerSpot reviewer
Integrates pipelines smoothly and fortifies code against vulnerabilities
I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of this solution is the ability to make our customers more secure."
"When we are integrating it with SSC, we're able to scan and trace and see all of the vulnerabilities. Comparison is easy in SSC."
"The user interface is ok and it is very simple to use."
"The solution's technical support was very helpful."
"The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients."
"It is scalable and very easy to use."
"It's a well-known platform for doing dynamic application scanning."
"Fortify WebInspect is a scalable solution, it is good for a lot of applications."
"It gives feedback to developers on the effectiveness of their secure coding practices."
"The Veracode support team is excellent."
"Static Scanning is the most valuable feature of Veracode."
"The most valuable feature is the dynamic application security testing."
"It's not "one policy fits all." I really like that Veracode allows me to set up specific policies that I can apply to applications."
"Allows us to track the remediation and handling of identified vulnerabilities."
"Veracode's most valuable aspect is continuous integration. It helps us integrate with other applications so that it can monitor the security process."
"The most valuable feature is the SAST capability and its integration into the Veracode pipelines."
 

Cons

"I'm not sure licensing, but on the pricing, it's a bit costly. It's a bit overpriced. Though it is an enterprise tool, there are other tools also with similar functionalities."
"A localized version, for example, in Korean would be a big improvement to this solution."
"The main area for improvement in Fortify WebInspect is the price, as it is too high compared to the market rate."
"There are some file extensions, like .SER, that Fortify WebInspect doesn't scan."
"It took us between eight and ten hours to scan an entire site, which is somewhat slow and something that I think can be improved."
"Fortify WebInspect could improve user-friendliness. Additionally, it is very bulky to use."
"One thing I would like to see them introduce is a cloud-based platform."
"Lately, we've seen more false negatives."
"The user interface could be more sleek. Some scanning requirements aren't flexible. Some features take some time for new users to understand (like what exactly "modules" are)."
"Their platform is not consistent. It needs a lot of user experience updates. It's slow performing, and they log you out of the system every 15 minutes, so using the platform is challenging from a developer's perspective because you always have to log in."
"Static scanning takes a long time, so you need to patiently wait for the scan to achieve. I also think the software could be more accurate. It isn't 100 percent, so you shouldn't completely rely on Veracode. You need to manually verify its findings."
"I would like to see them provide more content in the developer training section. This field is really changing each day and there are flaws that are detected each day. Some sort of regular updates to the learning would help."
"All areas of the solution could use some improvement."
"Because our application is large, it takes a long time to upload and scan."
"I haven't heard about any problems so far. However, it would be great if Veracode automatically packaged stuff up for you."
"From what we have seen of Veracode's SCA offering, it is just average."
 

Pricing and Cost Advice

"The pricing is not clear and while it is not high, it is difficult to understand."
"This solution is very expensive."
"Fortify WebInspect is a very expensive product."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"It’s a fair price for the solution."
"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
"The price is okay."
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"Veracode's price is reasonable."
"The pricing is reasonable compared to other tools."
"I don't have firsthand knowledge of Veracode pricing, but based on client feedback, it seems to be expensive with additional fees for certain features."
"I know that Veracode is a semi-pricey solution. If you are serious about security, I would recommend that you use an open-source option to learn how the scanning process works and then look into Veracode if you want to really step up your game and have an all-in-one solution."
"Veracode is costly. They have different license models for different customers. What we had was based on the amount of code that has been analyzed. The license that we had was capped to a certain amount, for example, 5 Gig. There would be an extra charge for anything above 5 Gig."
"When I looked at the pricing, it was definitely a value. In terms of the service and what it's checking, the cost was very reasonable, particularly because we could have multiple code bases as part of a project."
"We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive."
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
868,787 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Government
15%
Manufacturing Company
12%
Computer Software Company
10%
Financial Services Firm
16%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise43
Large Enterprise112
 

Questions from the Community

What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers nearly five security testing features within its own service, making it a compet...
 

Also Known As

Micro Focus WebInspect, WebInspect
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Aaron's
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about OpenText Dynamic Application Security Testing vs. Veracode and other solutions. Updated: May 2022.
868,787 professionals have used our research since 2012.