We have three use cases. We have the dynamic scans that we use to scan the production, public-facing URLs. We also use the static scan where we work with the Dev team and scan the code base for the web application and the mobile application on both iOS and Android. Our third use case is manual penetration tests, which my team manages. We do annual manual penetration tests.
It's deployed to our platform infrastructure, which is in a public cloud.
We have some major clients using Veracode. It saves us time when it comes to doing annual pen tests. When we say we're using Veracode and they are also using Veracode, we don't have to run the test twice. They accept what we have because they know the framework is going to be the same.
A pen test can take a month; it really depends on the number of flaws that are found. So when we don't have to run a pen test twice it saves a lot of time. It not only saves time for my team, but for other teams as well, because when we run a third-party pen test for clients, I not only need to have my team coordinating it, but it requires documentation and it requires my technical support to be involved. So it saves a lot of time for a number of teams.
The report content is very good because the reports are structured in a way that they explain the scope of the scan and what the policy is. A report shows, right at the beginning, if we have passed the scan for the policy or not. That's very helpful when sharing that report externally. It's something that we didn't have before and having that now is extremely useful because it avoids a lot of back and forth with clients. If we share a report and there is no further explanation necessary on how the scan works and what we're doing to fix the flaws, it saves additional manual work that would otherwise be needed to update that information. With Veracode, we can do it automatically, just by pulling a report from the dashboard. In addition, whatever they have on the reports meets industry expectations.
Veracode provides visibility into application status across all testing types, including SAST, DAST, SCA, and manual penetration testing, in a centralized view. I manage the team, I'm not involved in the daily operations. But as a manager, it's extremely helpful, because I just log in to my Veracode instance and, on the homepage, it shows the status of all the scans. If I want more information about something, it's one click. From a managerial perspective, it's extremely helpful. The centralized view helps reduce risk exposure. If there is something wrong with a scan, if a scan doesn't run or a scan is not complete, I know about it from the main dashboard.
In addition, the solution integrates with developer tools. That creates more efficiency in the workflows because they don't need to duplicate work.
Overall, its ability to prevent vulnerable code from going into production is very good. We recently onboarded a new application into the static scan and we had almost 1,000 flaws in the first scan. We were able to mitigate all of them in less than three months. The result was amazing, enabling us to find everything that could potentially create a problem for us.
All of its features are valuable to us. We are ISO certified and we also do annual SOC 2 audits. We deal with personal, identifiable information and we host confidential information from our clients. Our use of Veracode is based on our clients' requirements and on ISO requirements. It is something that we have in place to comply with what is required. In that context, the manual penetration test is a requirement from all our clients and we do it once a year.
In terms of secure development, the SAST scan is very useful because we are able to identify security flaws in the code base itself, for the application. The dynamic scanning is mostly used to make sure that whatever is deployed to production is secure.
Veracode provides guidance for fixing vulnerabilities. This doesn't enable developers to write secure code from the start, but Veracode provides guidance through security consultants. We can book consultations in case developers cannot fix a specific flaw, and they guide us through the process based on the CWE.
The efficiency of the solution when it comes to creating secure software is good. For us, it works well. Their dashboard is really good, overall. In my opinion, it's one of the best in the market, and I say that because we have used other service providers.
Its policy reporting for ensuring compliance with industry standards and regulations is very helpful. We can create our own policy, based on our internal risk management guidelines, and run the scans against our own customized policy. That way we can set expectations to fix flaws based on our internal timeline, and we can issue reports based on that. We usually share those reports with clients. That's very useful.
They are also always updating the types of threats and that's very useful.
In addition, they provide analytics on how we're doing in terms of fixing flaws and mitigating issues.
All of the services that Veracode provides are necessary for the type and the level of security and confidentiality that we need.
Whenever there is a mitigation that is submitted through the platform, I'm the one who approves it. The feature that allows me to read which mitigation answer was submitted, and to approve it, requires me to use do so in different screens. That makes it a little bit more complicated because I have to read and then I have to go back and make sure it falls under the same number ID number. That part is a little bit complicated from my perspective, because that's what I use the most.
I have been using Veracode for a year.
The stability is good. We have never had problems.
We will be using more of our products in Veracode starting in January. We added one more application into the dynamic scan and we added a couple more manual penetration tests to our projects. Once you understand how it works, it's very easy to deploy to different applications.
In terms of increasing our usage of the solution, we probably won't for the next couple of years, but we never know. It really depends on the requirements that we have from clients and the requirements of the standards and the regulations. Now, we are covering most of the applications and use cases that we need. We are doing 100 percent of the code base. We are doing dynamic scans on all the URLs in production, and the manual pen tasks are also covering all the applications.
We are doubling the ACV with Veracode for 2021, and that's a lot. After that, we're going to be good for the next couple of years, unless there is something new and the Dev team needs to use some other feature that I'm not aware of at this point.
For the dynamic scans I have a couple of people from the technical support team and one person from operations. For static scans, I have my entire iOS and Android team because, depending on the type of flaw, the ticket is given to different developers. I have about 20 to 25 Veracode users.
Their technical support is usually very quick. They usually get back to us in less than 24 hours. We had a problem recently and it was the first time that we had a problem with Veracode support. We didn't get an outcome for three weeks and it created a major problem, but they usually get back to us in 24 hours.
Their Knowledge Base, their help site, is very useful. Most of the time we can find the information that we are looking for there. Sometimes we consult with their support team, but we can usually find information in their help site.
We were using WhiteHat. We switched because the dashboard was very bad and there were no analytics. The UI was also very bad, so it was not easy to manage it. Also, most of our big clients were using Veracode and asking us to migrate to Veracode. It was a combination of things.
The setup was straightforward. It takes some time in the beginning to onboard, but our onboarding process was easy from the moment that we actually connected the Dev team with Veracode. It's normal to have a certain degree of difficulty in the beginning but we didn't have any major problems.
Our deployment took between a month and 45 days.
We migrated from another vendor, so we first picked the services that we needed and the type. We started with the same scans that we had with the other vendor, and then we divided the work between the different teams. We had to have the iOS team onboard and the Android team onboard. I presented the new tool to them and created the accounts and, after that, we had parallel projects to onboard the different scans. It was definitely easier because I had different teams taking care of each one of the scans, meaning I could do everything in parallel.
For the dynamic scans we had one person involved from the technical support team. It was super-straightforward and super-easy to do. It took us a couple of hours to do it. The static scan takes a little bit more time because you have to prepare the packages. But we already had the packages ready because we migrated from another vendor. It took us some time to adjust the scans, but the actual work of uploading the packages took less than a week.
There is no direct ROI. There is a cost of security, overall. It saves a lot of time and it allows us to have the certifications and comply with the clients' requirements, but it's very hard to have a direct ROI. It's a cost for compliance and security that is worth it.
Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive.
There is also a fee for the support package, which I think is extremely expensive. We used to have the premium support and we didn't use most of it, so we're downgrading to the basic support, and even the basic support is expensive.
We evaluated BitSight. The main advantage of Veracode was the UI, the dashboard. It's very easy to use and to manage.
I can give advice to other managers. If they are willing to properly manage, but they don't have the time or the bandwidth to actually operate, it's a very good tool. It's easy to get access to information and it's easy to understand what's going on with your application without much of a burden. You don't have to waste a lot of time trying to understand a complicated report. Everything is accessible. And the amount of information that Veracode gives based on the flaws is very straightforward and makes it easy for the Dev team to fix them.
I would rate it at eight out of 10. The tool itself is a very good tool. The way they work to update the flaws and the findings is very effective. But the support is a little bit expensive and it could be a little bit better. And there are few things that could be updated in the UI, but overall it's a very good tool.
