SonarCloud vs Veracode comparison

Read 197 Veracode reviews

20,515 Views
14,111 Comparison Views

90% willing to recommend

SonarCloud

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Veracode and SonarCloud are both competitors in the field of code analysis and security. SonarCloud seems to have the upper hand due to its comprehensive features, although Veracode stands out in pricing and support.

Features: Veracode provides extensive security scanning capabilities, highlighting accuracy, thoroughness, and a strong set of tools. SonarCloud's key strengths are its ease of integration, support for multiple languages, and language versatility.

Room for Improvement: Veracode users look for quicker scan times, a less steep learning curve, and simplified deployment. SonarCloud users desire more advanced security features, enhanced real-time scanning, and additional language support.

Ease of Deployment and Customer Service: Veracode's deployment is more complex and time-consuming but benefits from responsive customer support. SonarCloud offers simpler deployment and scalability, though it could improve its customer service experience.

Pricing and ROI: Veracode is considered cost-effective, offering good ROI in terms of its security offerings. SonarCloud users find its initial setup costs reasonable, with ongoing updates and features validating the expense.

To learn more, read our detailed SonarCloud vs. Veracode Report (Updated: October 2024).

Download the complete report

SonarCloud vs. Veracode

October 2024

Helped 812,628 peers since 2012

Categories and Ranking

SonarCloud

Ranking in Static Application Security Testing (SAST)

10th

Average Rating

8.2

Reviews Sentiment

6.3

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Static Application Security Testing (SAST)

2nd

Average Rating

8.2

Number of Reviews

197

Ranking in other categories

Application Security Tools (2nd), Container Security (4th), Software Composition Analysis (SCA) (2nd), Penetration Testing Services (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of October 2024, in the Static Application Security Testing (SAST) category, the mindshare of SonarCloud is 6.8%, up from 6.0% compared to the previous year. The mindshare of Veracode is 10.3%, down from 11.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Diego Moreo

Software Quality Coordinator at a retailer with 10,001+ employees

Oct 7, 2024

Enhanced code quality with data consolidation needs and good pipeline integration

We have SonarCloud integrated into our pipeline. It is used as a tool for checking code quality, clean code, bugs, and security issues. It acts as a quality gate for production, helping decide if our code can be applied SonarCloud aids us in checking major issues in legacy systems and helps…

Read full review

Sajal Sharma

Test Analyst - Security at Net solutions India Pvt.

Aug 6, 2024

Offers shift-left security strategy and helps us with the latest security configurations, OWASP standards, and SAST standards

It's robustness is the main benefit to the organization. As it gets upgraded with time, it also improves the coverage – security configuration coverages and vulnerability coverages. It also updates itself with the latest known vulnerabilities that are uploaded to the NVD, OWASP, or other databases. So it gets upgraded itself with that. And so with each upgrade, it gets better and better. The solution offers the ability to prevent vulnerable code from going into production. It provides us with a report containing multiple remediations and mitigations for each vulnerability. For example, if it finds a cross-site scripting vulnerability, it will also include references like CWE and CVE records, instructions on how to fix it, and the specific line of code or module where the vulnerability is present. This helps us fix the issues accordingly. I'm a penetration tester and DevSecOps engineer. I evaluate the findings, mark false positives, and manually exploit vulnerabilities if they exist. If we need further clarification, we raise a ticket with the Veracode team and get consultancy from them. We are a software development team. If we find a vulnerability, I exploit it and come back with the best possible mitigation, and the dev team fixes it. If we use Veracode Fix, it might use third-party implementations or make changes we aren't aware of. We need to be very aware of what our application is using internally. It should be known to us. As per my experience, the solution's policy reporting ensures compliance with industry standards. It comes with multiple features. I get the most out of it, and it's good. The solution provides visibility into application status at every phase of development. Like static analysis, dynamic analysis, software composition, and manual penetration tests - throughout the SDLC We have a pipeline that I maintain. I use the Veracode API account and have integrated it with AWS and our Jenkins pipeline. We use Snyk for SCA and Veracode for SAST scanning. At the earliest stage of the build, the SAST scan runs along with the JS and PHP files. It provides us with reports, which are then handed over to the other tools we depend on. If I validate the report or check the Veracode dashboard and find vulnerabilities, I mark them as false positives or existing issues. We work on multiple projects, but the one I'm handling these days only uses Veracode for SAST. It's been about one and a half years since I've been working with Veracode and this project. It is quite impressive. There are some things Veracode cannot find, like code obfuscations inside the code and some insecure randoms. Sometimes, it misses those flaws. But overall, if I compare it with other tools, it is better. I will definitely recommend others to use this tool. We run the scan before each deployment. If the dev team builds a new module or something, we scan it along with all the files. If we find anything, we get it fixed. That's how it works. Veracode is quite important to the organization's shift-left security strategy because we make a scan for each deployment. Sometimes, if I think we need to perform a shift-left, I just make a scan before deployment and check for any misconfiguration or vulnerability in the code.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable features of SonarCloud are the ability to discover vulnerabilities, security weak points, security hotspots, and all the feedback that comes into the feature branch. You can deploy the code with the security, you can eliminate the problem at the developer level rather than identifying the problem in the productions."

"The SaaS solution for checking code without execution and dealing with security issues is valuable."

"SonarCloud is overall a good tool for identifying code smells, bugs, and code duplication, but we've found that using Android Lint is more effective for our needs."

"I'm not implementing the solutions. However, I've talked to the people who deploy the tools, and they are happy with how easy setting up SonarCloud is."

"Its dashboard provides a unified view of various code quality metrics, including code duplication, unit test coverage, and security hotspots."

"The reports from SonarCloud are very good."

"The solution can be installed locally."

"The solution provides continuous code analysis which has improved the quality of our code. It can raise alarms on vulnerabilities with immediate reports on the dashboard. Few things are false positives and we can customize the rules."

More SonarCloud pros

"I like the static scanning, and Veracode's interface is excellent. The dashboard is easy to navigate."

"There are quite a few features that are very reliable, like the newly launched Veracode Pipelines Scan, which is pretty awesome. It supports the synchronous pipeline pretty well. We been using it out of the Jira plugin, and that is fantastic."

"Developer Sandboxes help move scanning earlier within the SDLC."

"What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode."

"The most valuable feature is the security and vulnerability parts of the solution. It shows medium to high vulnerabilities so we can find them, then upgrade our model before it is too late. It is useful because it automates security. Also, it makes things more efficient. So, there is no need for the security team to scan every time. The application team can update it whenever possible in development."

"It has provided what we were looking for in such an application, meaning static application security testing functionality. That was what we were interested in."

"This static analysis helps ensure a secure application rollout across all environments."

"It has improved the quality of code being delivered for test and its vulnerability resolutions timeline has improved."

More Veracode pros

Cons

"The solution needs to improve its customization and flexibility."

"SonarCloud's UI needs enhancement."

"CI/CD pipeline is part of a whole chain of design, development, and production, and it's becoming increasingly crucial to optimize the various tools across different stages. However, it's still a silo approach because the full integration is missing. This isn't just an issue with SonarCloud. It's a general problem with tooling."

"Reporting features are missing in SonarCloud."

"We had some issues with the scanner."

"SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird. We then need to manually go and mark the false positive."

"I've been told by the developers that the solution is too limited. It's not testing enough within the containers."

"The reports could improve by providing more information. We are not able to use the reports in our operation until they are improved. Additionally, if the vendor provided more customization capabilities it would be a benefit."

More SonarCloud cons

"The cost of the solution is a little bit expensive. Expensive in the sense that there was a hundred percent increase in cost from last year to this year, which is certainly not justified."

"Static scanning takes a long time, so you need to patiently wait for the scan to achieve. I also think the software could be more accurate. It isn't 100 percent, so you shouldn't completely rely on Veracode. You need to manually verify its findings."

"I would like to see more technical support for some of the connectors, some more detailed diagrams or run-books on how to install some of stuff; more hand-holding in the sense of understanding our environment."

"Veracode is a little costly. It's cost-effective for a large enterprise, but it may be too expensive for small businesses."

"I would love to be able to do a dynamic sandbox scan. I think that that would allow us to really get a lot more buy-in from the software development teams."

"It can have more APIs and capabilities to handle other things well. We were doing a trial for it. There were two things that I looked at: one was uploading some Java-related content and the other was uploading database SQL files and having the review done on the quarterback. The Java portion of it worked fine, and it was pretty seamless, but the database portion was not. We uploaded some files to use for vulnerabilities, and the tell-all portion of it was pretty easy. We uploaded a war file and Java files, and we got the reports back on these. They were pretty clear to understand. We did the same thing for the database portion for the most part. However, the content wasn't getting uploaded in a predictable fashion, and it was slow and hard to get done. We had to do it over and over. After it indicated that the content was uploaded, there were no results. There were zero search findings. It was possibly a user error, something that we didn't do correctly, but they had acknowledged that it was something they were currently enhancing. This is something that could be made easier if they haven't already done that. I don't know how many releases they've had in that timeframe. I haven't looked at it since then. It was a trial period."

"In some cases we use their APIs; they're not as rich as I would like."

"Veracode scans provide a higher number of false positives."

More Veracode cons

Pricing and Cost Advice

"The current pricing is quite cheap."

"I rate the pricing a five out of ten."

"The price of SonarCloud is not expensive, it goes by the lines of code. 1 million lines per code are approximately 4,000 USD per year. If you need 2 million lines of code you would double the annual cost."

"While not extremely cheap, it aligns well with market standards and offers good value."

"The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable."

"I am using the free version of the solution."

"Previously, the pricing was 17,000 euros for five million lines analyzed. However, they now charge $15,000 per one million lines, significantly increasing the cost."

"Veracode is expensive."

"Licensing cost is on a yearly basis and there are no additional costs, the pricing is straightforward."

"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."

"We are still considering it at the enterprise level. It has a subscription-based model. We find its price a little high based on the features it provides."

"The pricing is a bit high."

"It is expensive. It depends on the use case, but it is very hard to find a pricing page on their website. Instead, they need to analyze your use case, but without knowing the entire project and how you're going to be using Veracode, how many scans you're going to do, if yours is a small business, it is very expensive and it affects ROI."

"You do get value for the price, but unfortunately, for a small enterprise, it's not a good option. It isn't affordable for small businesses. It's expensive for startups. They need to consider its pricing. Its pricing is not so favorable for small businesses that would love to use it."

"The pricing of the product depends upon the number of codes or the number of applications."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

812,628 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

19%

Financial Services Firm

10%

Manufacturing Company

Insurance Company

Financial Services Firm

18%

Computer Software Company

16%

Manufacturing Company

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about SonarCloud?

Recently, they introduced support for mono reports and microservices, which is a noteworthy development as it provides a more detailed view of each service.

What is your experience regarding pricing and costs for SonarCloud?

I would rate the price an eight out of ten because it's reasonable. While not extremely cheap, it aligns well with market standards and offers good value. It's an all-inclusive package where you pa...

What needs improvement with SonarCloud?

There's room for improvement in the configuration process, particularly during the initial setup phase. Setting up features like mono reports can be challenging, and the existing documentation coul...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.

Checkmarx One vs SonarCloud

Comparisons

SonarQube vs SonarCloud

Compared 74% of the time

Compared 4% of the time

GitLab vs SonarCloud

Compared 3% of the time

Coverity vs SonarCloud

Compared 2% of the time

OWASP Zap vs SonarCloud

Compared 2% of the time

More SonarCloud Competitors

SonarQube vs Veracode

Compared 24% of the time

Checkmarx One vs Veracode

Compared 13% of the time

Fortify on Demand vs Veracode

Compared 7% of the time

Snyk vs Veracode

Compared 6% of the time

Fortify Static Code Analyzer vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Download SonarCloud product report

SonarCloud

September 2024

Download Veracode product report

September 2024

Also Known As

No data available

Crashtest Security , Veracode Detect

Learn More

Sonar

Interactive Demo

Sonar

Demo not available

Overview

SonarCloud is a cloud-based alternative to the SonarQube platform. It is a fully managed SaaS solution, improving human-developed and AI-assisted code at scale SonarCloud integrates seamlessly with popular version control and CI/CD platforms such as GitHub, Bitbucket, and Azure DevOps. It provides static code analysis to identify and help remediate issues such as bugs and security vulnerabilities. SonarCloud enables developers to receive immediate feedback on their code within their development environment, facilitating the maintenance of high-quality code standards, and promoting a culture of continuous improvement in software development projects. It helps produce software that is secure, reliable, and maintainable. SonarCloud is free for open-source projects and is offered as a paid subscription for private projects, priced per line of code.

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.