We performed a comparison between Snyk and Veracode based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.
Comparison Results: Based on the parameters we compared, Snyk comes out ahead of Veracode. Veracode has a higher cost and the Static and SAST scans may not be as user-friendly to developers.
"Our customers find container scans most valuable. They are always talking about it."
"The solution's vulnerability database, in terms of comprehensiveness and accuracy, is very high-level. As far as I know, it's the best among their competitors."
"There are many valuable features. For example, the way the scanning feature works. The integration is cool because I can integrate it and I don't need to wait until the CACD, I can plug it in to our local ID, and there I can do the scanning. That is the part I like best."
"Snyk is a developer-friendly product."
"Snyk categorizes the level of vulnerability into high, medium, and low, which helps organizations prioritize which issues to tackle first."
"I am impressed with the product's security vulnerability detection. My peers in security are praising the tool for its accuracy to detect security vulnerabilities. The product is very easy to onboard. It doesn't require a lot of preparation or prerequisites. It's a bit of a plug-and-play as long as you're using a package manager or for example, you are using a GitHub repository. And that is an advantage for this tool because developers don't want to add more tools to what they're currently using."
"From the software composition analysis perspective, it first makes sure that we understand what is happening from a third-party perspective for the particular product that we use. This is very difficult when you are building software and incorporating dependencies from other libraries, because those dependencies have dependencies and that chain of dependencies can go pretty deep. There could be a vulnerability in something that is seven layers deep, and it would be very difficult to understand that is even affecting us. Therefore, Snyk provides fantastic visibility to know, "Yes, we have a problem. Here is where it ultimately comes from." It may not be with what we're incorporating, but something much deeper than that."
"The solution has great features and is quite stable."
"The static analysis gives you deep insights into problems."
"Veracode is very easy to use."
"The analysis of the vulnerabilities and the results are the most valuable features."
"The Veracode technical support is very good. They are responsive and very knowledgeable."
"I like Veracode's API. You can put it into a simple bash script and run your own security testing from your MacBook in less than 15 minutes."
"Vulnerability Management and mitigation recommendations help with resolution of issues found, prior to deployment to production."
"The coverage of backdoors attacks on security that's the most valuable for my clients."
"That it is a cloud-based solution is very valuable to us. We don't need that hardware running our scans and hosting the environment to be scanned. Also, the technology, the static scanning versus dynamic scanning produces a much better result, a more accurate result."
"Offering API access in the lower or free open-source tiers would be better. That would help our customers. If you don't have an enterprise plan, it becomes challenging to integrate with the rest of the systems. Our customers would like to have some open-source integrations in the next release."
"The solution's integration with JFrog Artifactory could be improved."
"One area where Snyk could improve is in providing developers with the line where the error occurs."
"Generating reports and visibility through reports are definitely things they can do better."
"We have seen cases where tools didn't find or recognize certain dependencies. These are known issues, to some extent, due to the complexity in the language or stack that you using. There are some certain circumstances where the tool isn't actually finding what it's supposed to be finding, then it could be misleading."
"Compatibility with other products would be great."
"The feature for automatic fixing of security breaches could be improved."
"All such tools should definitely improve the signatures in their database. Snyk is pretty new to the industry. They have a pretty good knowledge base, but Veracode is on top because Veracode has been in this business for a pretty long time. They do have a pretty large database of all the findings, and the way that the correlation engine works is superb. Snyk is also pretty good, but it is not as good as Veracode in terms of maintaining a large space of all the historical data of vulnerabilities."
"Improve Mobile Application Dynamic Scanning DAST - .ipa and .apk"
"To be able to upload source codes without being compiled. That’s one feature that drives us to see other sources."
"It could be improved with support for more programming languages, like SQL."
"The security labs integration has room for improvement."
"They should improve on the static scanning time."
"It needs more timely support for newer languages and framework versions."
"Veracode scans provide a higher number of false positives."
"It would be nice if Veracode were bundled with some preferred vendors like Salesforce and offered at a discount."
Snyk is ranked 4th in Application Security Tools with 41 reviews while Veracode is ranked 2nd in Application Security Tools with 193 reviews. Snyk is rated 8.2, while Veracode is rated 8.2. The top reviewer of Snyk writes "Performs software composition analysis (SCA) similar to other expensive tools". On the other hand, the top reviewer of Veracode writes "Helps to reduce false positives and prevent vulnerable code from entering production, but does not support incremental scanning ". Snyk is most compared with SonarQube, Black Duck, Fortify Static Code Analyzer, GitHub Advanced Security and Checkmarx One, whereas Veracode is most compared with SonarQube, Checkmarx One, Fortify on Demand, OWASP Zap and Fortify Static Code Analyzer. See our Snyk vs. Veracode report.
See our list of best Application Security Tools vendors, best Container Security vendors, and best Software Composition Analysis (SCA) vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
