Based on the user reviews, Veracode is the preferred product over SonarQube. Veracode has received mixed reviews for its customer service and support, but some customers praise its responsiveness and knowledge. In contrast, SonarQube's customer service and support experiences vary. Additionally, Veracode's pricing is considered reasonable and affordable by some, while SonarQube's pricing opinions vary. Overall, Veracode's comprehensive security testing capabilities and ease of use make it the preferred choice.
I prefer Wiz over Veracode for its user-friendly interface, robust security features, seamless integration, and excellent customer support. Wiz also offers more customization options, clearer instructions for new users, and faster response times, enhancing the overall user experience.
Prisma Cloud by Palo Alto Networks is preferred over Veracode due to its competitive pricing, ease of deployment, and comprehensive security capabilities. Users find the setup cost reasonable, report cost savings, and highlight the intuitive interface and advanced threat detection. Additionally, Prisma Cloud\'s top-notch customer service receives consistent positive feedback from users, making it the preferred choice.
Based on user reviews, Veracode is preferred over GitLab for its comprehensive security testing capabilities, accurate vulnerability detection, and reliable reporting. Users appreciate Veracode's prompt and knowledgeable customer support, although there is room for improvement. The deployment process of Veracode is manageable, with varying experiences among users. The pricing of Veracode is considered reasonable by some, while others find it expensive. Veracode provides a valuable investment in security with a positive impact on organizations, contributing to increased sales and retention rates.
Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.
The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security.
I believe pricing is better compared to other commercial tools.
The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security.
I believe pricing is better compared to other commercial tools.
Organizations use Black Duck for compliance audits, license compliance, open-source vulnerability scanning, and risk management. It integrates into CI/CD pipelines, performs source code and binary analysis, and identifies software licenses during M&A processes. Users appreciate its extensive knowledge base, easy vulnerability scanning, and integration with Docker and various technologies.
Depending on the use case, the cost could range from $10,000 USD to $70,000 USD.
The price is quite high because the behavior of the software during the scan is similar to competing products.
Depending on the use case, the cost could range from $10,000 USD to $70,000 USD.
The price is quite high because the behavior of the software during the scan is similar to competing products.
OWASP Zap is a powerful tool used for security and vulnerability testing of applications. Its primary use case includes scanning pipelines, dynamic testing, penetration testing, and vulnerability scanning. OWASP Zap's most valuable functionality is its ability to scan and fix vulnerabilities, provide clear explanations in reports, and discover more vulnerabilities compared to other tools. It helps organizations by improving application security, reducing the need for external testers, and strengthening overall security.
It is highly recommended as it is an open source tool.
It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy.
It is highly recommended as it is an open source tool.
It's free and open, currently under the Apache 2 license. If ZAP does what you need it to do, selling a free solution is a very easy.
Mend.io is a software composition analysis tool that secures what developers create. The solution provides an automated reduction of the software attack surface, reduces developer burdens, and accelerates app delivery. Mend.io provides open-source analysis with its in-house and other multiple sources of software vulnerabilities. In addition, the solution offers license and policy violation alerts, has great pipeline integration, and, since it is a SaaS (software as a service), it doesn’t require you to physically maintain servers or data centers for any implementation. Not only does Mend.io reduce enterprise application security risk, it also helps developers meet deadlines faster.
We are paying a lot of money to use WhiteSource. In our company, it is not easy to argue that it is worth the price.
The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps.
We are paying a lot of money to use WhiteSource. In our company, it is not easy to argue that it is worth the price.
The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps.
Fortify on Demand is a web application security testing tool that enables continuous monitoring. The solution is designed to help you with security testing, vulnerability management and tailored expertise, and is able to provide the support needed to easily create, supplement, and expand a software security assurance program without the need for additional infrastructure or resources.
We used the one-time application, Security Scan Dynamic. I believe the original fee was $8,000.
Buying a license would be feasible for regular use. For intermittent use, the cloud-based option can be used (Fortify on Demand).
We used the one-time application, Security Scan Dynamic. I believe the original fee was $8,000.
Buying a license would be feasible for regular use. For intermittent use, the cloud-based option can be used (Fortify on Demand).
Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.
The price of Fortify Static Code Analyzer could be reduced.
The licensing is expensive and is in the 50K range.
The price of Fortify Static Code Analyzer could be reduced.
The licensing is expensive and is in the 50K range.
Pentera is the category leader for Automated Security Validation, allowing every organization to evaluate its security readiness, to know its real security risk at any given moment. Test all cybersecurity layers across the attack surface – inside and out – by safely emulating attacks & prioritize patching with a risk-based remediation roadmap.
Thousands of security professionals and service providers around the world use Pentera to guide remediation and close security gaps before they are exploited. For more info visit: pentera.io
We have to pay a yearly licensing cost for Pentera.
It's not that expensive, but it could be more cost-effective.
We have to pay a yearly licensing cost for Pentera.
It's not that expensive, but it could be more cost-effective.
Fortify WebInspect is an automated DAST solution that helps security professionals and QA testers uncover security vulnerabilities and configuration concerns by providing complete vulnerability detection. This is accomplished by mimicking real-world external security attacks on a live application in order to discover and prioritize concerns for root-cause study. Fortify WebInspect provides a number of REST APIs for easier integration, as well as the ability to be maintained via an intuitive UI or totally automated.
It’s a fair price for the solution.
The pricing for this solution is good.
It’s a fair price for the solution.
The pricing for this solution is good.
The solution's cost is a five out of ten.
The solution's pricing is good and reasonable because you can literally use a lot of it for free.
The solution's cost is a five out of ten.
The solution's pricing is good and reasonable because you can literally use a lot of it for free.
CAST Highlight is a SaaS software intelligence product for performing rapid application portfolio analysis. It automatically analyzes source code of hundreds of applications in a week for Cloud Readiness, Software Composition Analysis (Open Source risks), Resiliency, and Technical Debt. Objective software insights from automated source code analysis combined with built-in qualitative surveys for business context enable more informed decision-making about application portfolios.
Basic support is included with the standard licensing feed but it can be upgraded for an additional cost.
It is a pretty costly tool. A lot of customers are resistant to using it.
Basic support is included with the standard licensing feed but it can be upgraded for an additional cost.
It is a pretty costly tool. A lot of customers are resistant to using it.
Your web applications may be complex, but your application security testing tool doesn’t need to be. InsightAppSec brings Rapid7’s proven Dynamic Application Security Testing (DAST) technology to the Insight platform, combining powerful application crawling and attack capabilities, flexibility in scan scope and scheduling, and accuracy in results with a modern UI, intuitive workflows, and sensible data organization. This enables you to identify XSS, SQL injection, CSRF, and other vulnerabilities with unparalleled ease. The best part? All of these capabilities are delivered via the cloud so that you’re up and running in minutes to identify the critical security risks that exist in your applications.
The price of this product is very cheap.
Its price is competitive. It is not expensive.
The price of this product is very cheap.
Its price is competitive. It is not expensive.
Trivy is used for scanning vulnerabilities in Docker images, Kubernetes clusters, and repositories, ensuring compliance and security standards. Users appreciate its efficiency, quick insights, and ease of integration with CI/CD pipelines. Many highlight its comprehensive scanning capabilities, speed, user-friendly command-line experience, and open-source nature with active community support.
Trivy is an open-source product.
Trivy is an open-source product.
Polaris Software Integrity Platform is an integrated, cloud-based application security testing solution optimized for the needs of development and DevSecOps teams.
Polaris brings our market-leading security analysis engines together in a unified platform, giving you the flexibility to run different tests at different times based on application, project, schedule, or SDLC events.
CAST Application Intelligence Platform (AIP), a result of over $130M in R&D investment over two decades, is an enterprise-grade software measurement and quality analysis solution designed to analyze multi-tiered, multi-technology applications for technical vulnerabilities and adherence to architectural and coding standards and then provide business relevant information to the IT organization through various dashboards and products built with end users in mind.
Defensics® fuzz testing is a comprehensive, powerful, and automated black box solution that enables organizations to effectively and efficiently discover and remediate security weaknesses in software. By taking a systematic and intelligent approach to negative testing, Defensics allows organizations to ensure software security without compromising on product innovation, increasing time to market, or inflating operational costs.
Licensing is a bit expensive.
Licensing is a bit expensive.
Users utilize Semgrep for identifying security vulnerabilities, enforcing coding standards, and detecting bugs. Its customizable rules, seamless CI/CD integration, and quick scanning are appreciated. Although some find it slow with large codebases and complex patterns, its language-agnostic capabilities, lightweight performance, and comprehensive documentation stand out despite a steep learning curve.
