Veracode Reviews

Name: Veracode
Brand: Veracode
Rating: 4 (181 reviews)

Vendor: Veracode

4.0 out of 5

181 reviews

4,349 followers

Post review

What is Veracode?UNIXBusinessApplication
Price:

Veracode is a leading application security platform that helps organizations to develop and deliver secure software. Veracode's solution provides comprehensive capabilities for static analysis, dynamic analysis, software composition analysis, and manual penetration testing.

Get the Veracode Buyer's Guide and find out what your peers are saying about Veracode, SonarQube, Checkmarx and more!

Helped 745,775 peers since 2012

Featured reviews

Muhammed Shabreen

CTO at RIZEK

Nov 13, 2023

From the usability perspective, it is not up to date with the latest trends. It looks very old. Tools such as Datadog, New Relic, or infrastructure security tools, such as AWS Cloud, seem very user-friendly. They are completely web-based, and you can navigate through them pretty quickly, whereas Veracode is very rigid. It is like an old-school enterprise application. It does the job, but they need to invest a little more on the usability front. From the pricing perspective, it is not very convenient for startup organizations. They should have options to onboard it for the startup ecosystem quickly and affordably. There should also be strengthening of the developer community.

Read full review

Jan Pašek

Tech Lead at a financial services firm with 10,001+ employees

Oct 27, 2023

There are many false positives, especially one particular type: reported hard-coded passwords in the code. We do not have hard-coded passwords in our code, but we are using third-party libraries that have variables with passwords in their names. For example, a variable might be named "passwordForCommonFixFile" or "passwordForSecurityStore." Veracode's keyword analysis probably assesses these variables as hard-coded passwords. This is problematic because the false positives are coming from third-party libraries, and we cannot easily check the flaws to see if they are false positives. To fix the problem, we have to compile the code, which we should not have to do. We are forced to accept the false positives because we know from the software and system design that there cannot be hard-coded passwords in the third-party libraries we are using. If the libraries were generic, then there would be no chance that they would have hard-coded passwords for the specific services that we are connecting to. To reschedule the scan, we have to go through some bureaucracy. Despite the presence of many false positives, we remain confident in Veracode. However, the impact on developer confidence is negative, as it leads to resistance to enforcing certain development processes, including the use of Veracode in the development pipeline. This is understandable, given the complexity of the process required to reschedule the flaw for a single false positive. This process requires approval from the system owner, a senior manager, and the cybersecurity team. Veracode has increased the work time of our developers because of the false positives. The area with the most room for improvement is the speed and responsiveness of the query, as it is usually very slow. I am not sure if there is a specific space allocated for us that can cause this, but when I open an application and want to click through multiple scans to see the differences, or if I want to do anything else, everything loads very slowly. This makes it much less user-friendly to play around with the GUI and explore the features.

Read full review

PavanKumar18

Senior Testing Engineer at TollPlus LLC.

Oct 23, 2023

Veracode's ability to detect security vulnerabilities is excellent. We can feel confident that none of the vulnerabilities will make it into production. It doesn't take long to realize the benefits from it. The interface is intuitive. We could start to see value from Veracode within a couple of weeks. We don't have many false positives. We're using the tool's default rules and haven't done much customization. We can feel confident in the solution's results. We can identify most of the issues before the production stage, and it also enables us to develop better practices in the development process. We also have a security testing team using Veracode to discover vulnerabilities. The discovery of issues after static analysis is super-efficient. It reduces our time spent on these tasks by about 30 percent. Veracode has had a positive impact on our overall security posture. It's comprehensive, which is critical because our applications are mostly integrated, so we don't want to take any chances.

Read full review

Pricing

Veracode Software Composition Analysis has a reasonable price for the benefits it offers, but it may not be suitable for startups due to its pricing structure. The pricing depends on the size of the company and the amount they are willing to invest in security. It is more expensive compared to other solutions but offers a lot for free. The licensing is good and having a fixed cost is important for financing purposes. The pricing should be based on the size of the organization or application, and credit-based pricing can be an option for startups. Veracode is a good tool for enterprises with multiple applications, but a small shop might prefer alternatives. The cost is worth it considering the potential consequences of a security breach. It may be too expensive for the European market, but other solutions are also expensive. Veracode works on a subscription model, and customers can explore the product completely free for the first year.

ROI

Veracode Software Composition Analysis has brought major benefits, reducing management effort and providing security insights earlier in the development lifecycle. The cost has been an important aspect, but the cost-benefit is that developers get a better understanding of where their code stands before a security tester gets involved. The solution has been very helpful for the team, making it easier to do fixes and decreasing vulnerabilities. There has been a significant decrease in vulnerabilities and an increase in awareness for security, leading to buy-in from upper management and developers. The return on investment is due to saving a lot of development hours.

Primary Use Case

Veracode Software Composition Analysis is primarily used for code analysis and scanning for vulnerabilities in third-party dependencies. It is integrated into daily build pipelines and used for both software composition analysis and static code analysis. The platform provides a centralized view of all flaws and vulnerabilities, improving visibility and communication with developers. It is used for analyzing final binaries and auditing old software in both SaaS and on-prem deployment models.

Valuable Features

Veracode Software Composition Analysis has several valuable features according to users. The static application testing is the main target for some, while others appreciate the software composition analysis and its scoring system based on the Common Vulnerability Scoring system. The security and vulnerability part of the solution is also highly valuable, as it helps automate security and makes things more efficient. For those who mostly use Software Composition Analysis as a part of Static Code Analysis, the main feature is reporting and highlighting necessary vulnerabilities. The screening process helps to significantly improve standards and best practices, and the cloud-based system provides a centralized view across all testing types. Mitigation recommendations provided by the scanning engine are also highly appreciated. Overall, Veracode helps users fix flaws in code and increase their fixed-rate, making development more rapid.

Room for Improvement

Veracode Software Composition Analysis could improve its UI, which can be messy and outdated. The pricing should also be more convenient for startup organizations, and the developer community needs strengthening. The mitigation recommendations are not always helpful, particularly in dealing with third-party libraries and code logic flaws. Integration with existing pipelines, such as Jira and DevOps, needs improvement. Additionally, connecting agent-based software analysis with policy scanning would be more efficient. The speed of the system needs improvement, particularly for users located in Europe. Finally, the Jira integration automation aspect could be improved significantly.

Initial Setup

The initial setup for Veracode Software Composition Analysis varied among users. Some found it fast and easy, while others encountered technical difficulties and challenges with integrating it into their pipelines. The documentation was not always well-written or structured, and some had to invest time in properly building their solution. However, many appreciated the automation and integration capabilities, and some even added additional security measures such as Docker container scanning. The number of people involved in the implementation varied, and some followed an agile approach with user stories and planning.

Scalability

Some users find Veracode Software Composition Analysis to be inflexible, while others find it to be scalable and adaptable to their needs. The number of users varies, and some teams take care of maintenance themselves. For some users, scalability is an issue and they would like to see improvements. However, for others, scalability is not a concern as they use Veracode Cloud as a service. The platform provides a range of security features, including manual penetration testing, and dashboards that show progress. The scalability of the solution may depend on the size and culture of the organization using it. Overall, Veracode Software Composition Analysis is used for a range of critical applications, and its cloud-based nature allows for scalability.

Customer Service and Support

Veracode's customer service and support is highly rated by users. They are described as reliable partners with good expertise and provide valuable comments on proposals. Technical support is helpful and responsive, with most users rating it at least 8 out of 10. Veracode's support staff is skilled, and they are able to find solutions to problems quickly and effectively. Some users have had questions about the consistency of results between different sandboxes, but they found that these are peculiarities of the platform and not serious issues. Overall, Veracode's support is well-regarded and highly recommended by its users.

Stability

Overall, the stability of Veracode Software Composition Analysis is considered good and robust by users. While some have experienced a few glitches with the platform, it is generally stable and available. False positives are a common issue, but the software is still considered stable for scanning compared to other applications. The team at Veracode is continuously working on improving the platform and adding features that developers request.

Deployment Model

The respondents have provided various deployment models for the Veracode Software Composition Analysis solution. Some have opted for public cloud deployment, while others have chosen on-premises and private cloud options.

Implementation Team

The implementation team for Veracode Software Composition Analysis was knowledgeable and provided good support throughout the process. They were responsive to our needs and helped us get up and running quickly. Their expertise made the implementation smooth and efficient. We were impressed with their attention to detail and willingness to work with us to ensure a successful implementation.

Pricing

ROI

Primary Use Case

Valuable Features

Room for Improvement

Initial Setup

Scalability

Customer Service and Support

Stability

Deployment Model

Implementation Team

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Veracode Buyer's Guide for additional reliable information.

Learn more about Veracode

Veracode's static analysis solution scans source code for various security vulnerabilities, including common web application attack vectors, injection flaws, cross-site scripting, and insecure direct object references. Veracode's dynamic analysis solution simulates real-world attacks to identify vulnerabilities that may not be detectable by static analysis alone. Veracode's software composition analysis solution scans open-source and third-party components for known vulnerabilities. Veracode's manual penetration testing service is performed by experienced security professionals who use a variety of techniques to identify vulnerabilities in software applications.

Many organizations, including Fortune 500 companies, government agencies, and startups, use Veracode's solution. Veracode's customers rely on Veracode to help them to improve the security of their software applications and to reduce the risk of data breaches and other security incidents.

Here are some of the benefits of using Veracode:

Veracode provides capabilities for static analysis, dynamic analysis, software composition analysis, and manual penetration testing to help organizations identify and fix security vulnerabilities in their software applications early in the development process.
Veracode helps organizations reduce the risk of data breaches and other security incidents by identifying and fixing security vulnerabilities in their software application.
Veracode helps organizations to comply with industry regulations. Many industries have regulations that require organizations to implement security measures to protect their customers' data. Veracode's solution can help organizations to comply with these regulations by providing them with the tools and resources they need to identify and fix security vulnerabilities in their software applications.

Veracode was previously known as Crashtest Security , Veracode Detect.

Veracode is the #1 ranked solution in top Static Code Analysis tools, #2 ranked solution in application security solutions, #2 ranked solution in AST tools, #2 ranked solution in top Penetration Testing Services, #3 ranked solution in top Software Composition Analysis (SCA) tools, and #4 ranked solution in Container Security Solutions. PeerSpot users give Veracode an average rating of 8.0 out of 10. Veracode is most commonly compared to SonarQube: Veracode vs SonarQube. Veracode is popular among the large enterprise segment, accounting for 71% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 18% of all views.

Veracode video

Veracode customers

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.