Try our new research platform with insights from 80,000+ expert users

Rapid7 Penetration Testing Services vs Veracode comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Rapid7 Penetration Testing ...
Average Rating
8.0
Reviews Sentiment
7.1
Number of Reviews
1
Ranking in other categories
Penetration Testing Services (9th)
Veracode
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
204
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

Rapid7 Penetration Testing Services and Veracode aren’t in the same category and serve different purposes. Rapid7 Penetration Testing Services is designed for Penetration Testing Services and holds a mindshare of 1.9%, down 2.3% compared to last year.
Veracode, on the other hand, focuses on Application Security Tools, holds 7.7% mindshare, down 10.3% since last year.
Penetration Testing Services Market Share Distribution
ProductMarket Share (%)
Rapid7 Penetration Testing Services1.9%
HackerOne21.2%
Bugcrowd18.1%
Other58.8%
Penetration Testing Services
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Veracode7.7%
SonarQube Server (formerly SonarQube)20.4%
Checkmarx One10.4%
Other61.5%
Application Security Tools
 

Featured Reviews

Gabriel Woolverton - PeerSpot reviewer
Wide range of coverage and free
A useful improvement would be to have white papers for specific vulnerabilities readily available. It seems like they are not always linked when you are looking for a vulnerability identifier in the database. It would be useful to ensure that that information is readily available. That way, if you need to dive deeper into a vulnerability, you would have the capability to do so basically right there on the website.
Kv Rao - PeerSpot reviewer
Integrates pipelines smoothly and fortifies code against vulnerabilities
I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The initial setup is very straightforward. This is not a tool that you have to set up yourself. All you have to do is just access their web-based vulnerability database application, which is open source and available to pretty much anyone."
"The reporting being highly accurate is pretty cool. I use another product and I was always looking for answers as to what line, which part of the code, was wrong, and what to do about it. Veracode seems to have a solid database to look things up and a website to look things up."
"It can be very hard to make a good lab environment with a console with log windows and code bases. What I like about Veracode is that they managed to do that. It has a very responsive graphical user interface and has worked very well. I was very pleased with that."
"The Veracode technical support is very good. They are responsive and very knowledgeable."
"All three of Veracode's offerings are valuable: SCA, SAST, and DAST. It helps identify security loopholes right in the development phase, allowing developers to get feedback around what kind of vulnerabilities exist as soon as they check in the code or even before that in their IDE."
"Veracode has impacted our overall security posture because we are from a security background. Every week, we review the dashboards of open findings."
"We use it to get our scan results and see where our software is vulnerable or not vulnerable."
"When we expanded our definition of critical systems to include an internal application to be scanned by Veracode, we had initial scans that produced hundreds of vulnerabilities. We expected this, based on how the code was treated previously, but the Veracode platform allowed us to streamline our identification of these items and develop a game plan to quickly address them."
"I have used this solution in multiple projects for vulnerability testing and finding security leaks within the code."
 

Cons

"A useful improvement would be to have white papers for specific vulnerabilities readily available. It seems like they are not always linked when you are looking for a vulnerability identifier in the database."
"If the dynamic scan is improved, then the speed might go up. That is somehow not happening. We have raised this concern. It might also help if they could time limit scans to 24 hours instead of letting them go for three days. Then, whatever results could be shared, even if the scan is not complete, that would definitely help us."
"The cost of the solution is a little bit expensive. Expensive in the sense that there was a hundred percent increase in cost from last year to this year, which is certainly not justified."
"There should be more APIs, especially in SCA, to get some results or automate some things."
"They need to have a plug-in, a better integration with the development environment."
"The feature that allows me to read which mitigation answer was submitted, and to approve it, requires me to use do so in different screens. That makes it a little bit more complicated because I have to read and then I have to go back and make sure it falls under the same number ID number. That part is a little bit complicated from my perspective, because that's what I use the most."
"On-premise implementation is not available."
"Maybe the boards could be made easier to understand or easier to customize."
"Veracode's container scanning could be improved. We containerize all the platforms we use inside a Docker image. For example, we create a Microsoft Docker image that we build our application on top of. I would like Veracode to implement IT scans before we commit the code."
 

Pricing and Cost Advice

Information not available
"Licensing cost is on a yearly basis and there are no additional costs, the pricing is straightforward."
"Negotiate some, but their prices are reasonable."
"We are still considering it at the enterprise level. It has a subscription-based model. We find its price a little high based on the features it provides."
"Licensing is pretty flexible. It's a little bit weird, it's by the size of the binary, which is a strange way to license a product. So far they've been pretty flexible about it."
"I don't have firsthand knowledge of Veracode pricing, but based on client feedback, it seems to be expensive with additional fees for certain features."
"I recommend going for a one-year licensing with CA, because currently they are the leaders in this field with more features and a much better turn around time with a cheaper position, but there are a lot of new companies coming up in the market and they are building up their platforms."
"Veracode has been fair. We use their SaaS solution and it's just an annual subscription."
"I believe the price is fair according to market standards."
report
Use our free recommendation engine to learn which Penetration Testing Services solutions are best for your needs.
869,771 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
University
12%
Financial Services Firm
12%
Computer Software Company
10%
Educational Organization
9%
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise43
Large Enterprise112
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers nearly five security testing features within its own service, making it a compet...
 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Motorola, Liberty wines, Kaman Corporation
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about HackerOne, Pentera, Bugcrowd and others in Penetration Testing Services. Updated: October 2025.
869,771 professionals have used our research since 2012.