Semgrep vs Veracode comparison

Read 207 Veracode reviews

18,784 Views
12,397 Comparison Views

90% willing to recommend

Semgrep

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Semgrep and Veracode based on real PeerSpot user reviews.

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Semgrep vs. Veracode Report (Updated: December 2025).

Download the complete report

Semgrep vs. Veracode

December 2025

Helped 879,259 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Semgrep

Ranking in Static Application Security Testing (SAST)

18th

Ranking in Software Composition Analysis (SCA)

11th

Ranking in Static Code Analysis

7th

Average Rating

8.0

Reviews Sentiment

6.5

Number of Reviews

Ranking in other categories

Supply Chain Management Software (3rd)

Veracode

Ranking in Static Application Security Testing (SAST)

2nd

Ranking in Software Composition Analysis (SCA)

3rd

Ranking in Static Code Analysis

1st

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

207

Ranking in other categories

Application Security Tools (2nd), Container Security (8th), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of December 2025, in the Static Application Security Testing (SAST) category, the mindshare of Semgrep is 2.9%, up from 1.0% compared to the previous year. The mindshare of Veracode is 5.8%, down from 10.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Market Share Distribution
Product	Market Share (%)
Veracode	5.8%
Semgrep	2.9%
Other	91.3%

Static Application Security Testing (SAST)

Featured Reviews

Manjunath Maneppagol

Cloud & Application Security at Sixt SE

Context-aware code analysis has reduced noise and now improves developer experience with actionable security findings

I have consistently observed that their scan time is an issue for mono repos. Sometimes with their AI-based scanning, when you triage that scan, the scan never completes or finishes(, which makes it difficult. Another consistent issue is that whenever you have a new repo to onboard to the platform, the tool ideally should detect the master branch by default. However, sometimes the tool fails to identify it and will never scan it unless manually somebody looks into it and fixes the issue. Although their support team is really good, this issue was present six or eight months ago during the POC and is still present now. If it is affecting multiple customers, it should be prioritized and fixed. I would say that their integration aspects could have been improved. I see a lot of different security solutions that provide flexibility to the security teams based on Jira project, team divisions, Slack, and all those can be very much easily customized. Semgrep needs to work on the enhancement of their notification capabilities. Currently, they are working on identifying business logic vulnerabilities or privilege escalation vulnerabilities by looking at the code, and they should continue to focus on and improve this effort. Regarding stability, whenever you have a mono-repo which is a very large repository, the scan never finishes or the scan never kicks in. At that time, you have to reach out to the support team and ask them to expand the resources in the back end to fix it. This is an issue I keep seeing often on that platform.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Compared to other competitors in the market, the AI-backed capability is the biggest strength of Semgrep."

"The most valuable feature is the ability to write our custom rules."

"The visibility into application status helps reduce risk exposure for our software. Today, any findings provided by the DAST are reviewed by the developers and we have internal processes in place to correct those findings before there can be a release. So it absolutely does prevent us from releasing weak code."

"Scanning of .war and .jar is key for us."

"Veracode enables us to build a strong data security layer in our platforms. We can increase customer confidence in data security. Some PCI/HIPAA compliance issues were impossible to resolve without Veracode."

"Veracode provides faster scans compared to other static analysis security testing tools."

"The source composition analysis had very good reporting."

"The reporting being highly accurate is pretty cool. I use another product and I was always looking for answers as to what line, which part of the code, was wrong, and what to do about it. Veracode seems to have a solid database to look things up and a website to look things up."

"All three of Veracode's offerings are valuable: SCA, SAST, and DAST. It helps identify security loopholes right in the development phase, allowing developers to get feedback around what kind of vulnerabilities exist as soon as they check in the code or even before that in their IDE."

"I like the way the flaws are reported in the system."

More Veracode pros

Cons

"There should be more information on how to acquire the system, catering to beginners in application security, to make it more user-friendly."

"I have consistently observed that their scan time is an issue; sometimes with their AI-based scanning, when you triage that scan, the scan never completes or finishes, which makes it difficult."

"Sometimes, I get feedback from a developer saying, "They are scanning a Python code, but getting feedback around Java code." While the remediation and guidelines are there, improvement is still required, e.g., you won't get the exact guidelines, but you can get some sort of a high-level insights."

"There is room for improvement in documentation."

"The number of false positives could be reduced a lot. For each good result, we are getting somewhere around 15 to 20 false positives."

"Veracode doesn't really help you so much when it comes to fixing things. It is able to find our vulnerabilities but the remediation activities it does provide are not a straight out-of-the-box kind of model. We need to work on remediation and not completely rely on Veracode."

"Veracode can be improved with more integrations, more automations, enhanced API features, and more advanced analytics."

"Veracode can improve the licensing model as it is a bit confusing."

"I noticed there is no integration with Bamboo."

"A high number of false positives are reported and this should be reduced."

More Veracode cons

Pricing and Cost Advice

Information not available

"Depending on the number of users, my company makes payments toward the solution's licensing costs."

"I think licensing needs to be changed or updated so that it works with adjustments. Pricing is expensive compared to the amount of scanning we perform."

"The pricing is fair. You get a lot out of the product."

"Veracode is a very expensive product."

"The price of Veracode Static Analysis is on the higher side."

"It is expensive. It depends on the use case, but it is very hard to find a pricing page on their website. Instead, they need to analyze your use case, but without knowing the entire project and how you're going to be using Veracode, how many scans you're going to do, if yours is a small business, it is very expensive and it affects ROI."

"The licensing cost for Veracode is fair."

"For our company, the price is reasonable for the benefits that we get."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

879,259 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Manufacturing Company

12%

Computer Software Company

11%

Comms Service Provider

Financial Services Firm

17%

Computer Software Company

14%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	70
Midsize Enterprise	44
Large Enterprise	113

Questions from the Community

What needs improvement with Semgrep?

What is your primary use case for Semgrep?

I have been working with Semgrep for almost a year, approximately six to eight months on and off. In my current organization, I have a strong experience for SAST solution POCs, and I have conducted...

What advice do you have for others considering Semgrep?

You should primarily focus on what your use case is and why you are moving out. If you are moving out just from the perspective of cost, I do not think Semgrep is the best solution for you. However...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

Coverity Static vs Semgrep

Comparisons

SonarQube vs Semgrep

Compared 42% of the time

Compared 5% of the time

Snyk vs Semgrep

Compared 4% of the time

Black Duck SCA vs Semgrep

Compared 3% of the time

Bearer vs Semgrep

Compared 3% of the time

More Semgrep Competitors

SonarQube vs Veracode

Compared 14% of the time

Checkmarx One vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 6% of the time

OWASP Zap vs Veracode

Compared 4% of the time

Coverity Static vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Static Application Security Testing (SAST)

November 2025

Download Semgrep product report

Download Veracode product report

December 2025

Also Known As

Semgrep Code, Semgrep Supply Chain, Semgrep AppSec Platform

Crashtest Security , Veracode Detect

Overview

Semgrep is an advanced static analysis tool designed to identify vulnerabilities and enforce coding standards, catering primarily to professionals with a focus on enhancing code security and quality.

Engineered for software development environments, Semgrep delivers efficient security feedback with minimal setup. By offering a rich collection of rule sets, it allows customization and integration into CI/CD pipelines, supporting continuous code examination. Semgrep not only uncovers hidden flaws but also enforces best practices, making it a valuable asset for development teams seeking to build secure and reliable software.

What are the most important features of Semgrep?

Customizable Rules: Allows users to define specific rules to match unique coding requirements.
Open Rule Repository: Provides access to a vast array of pre-defined rules covering common security issues.
CI/CD Integration: Seamlessly integrates into development workflows, providing immediate feedback.
Multi-language Support: Detects issues across different programming languages, enhancing its usability.

What benefits or ROI should users consider?

Enhanced Security Posture: Elevates the security standards of codebases.
Time Efficiency: Reduces time spent on manual code reviews.
Adaptability: Easily adapts to evolving coding standards and practices.
Cost-effectiveness: Minimizes the need for external security audits.

In industry applications, Semgrep is a popular choice for sectors such as finance and healthcare, where code integrity and security are paramount. Its integration capabilities allow for effective oversight of compliance and secure coding standards without disrupting existing workflows. This adaptability ensures it meets sector-specific requirements, making it a trusted tool in fields where data privacy and protection are critical.

Semgrep

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Policygenius, Tide, Lyft, Thinkific, FloQast, Vanta, and Fareportal

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.