Veracode Reviews

I currently work for a Veracode distributor here in Brazil. I work in both presales and post-sales, and I do implementations as well.

We talk a lot about shift-left and this is very important because, when you find problems near the beginning of the process, it costs less to resolve them. In addition, Veracode provides information on how to handle issues and that saves time for the developers. It's also good for a company's image because the problems are found before deployment to production. 

When it comes to developer confidence, the low false-positive rate is very important. If they use a tool with a lot of false positives, they won't believe the reports they get. And that's important because if the teams don't like a tool, they won't use it. Also, we don't have a tool in Veracode for tuning policies because it is an automated process. In most cases, we don't have many problems that require tuning. We just review the model and usually find it's fine.

To me, the principal feature is the CLI (command-line interface) because I put together a lot of implementations using it. Another important aspect is the low false-positive rate because the solution is very configurable. It is as low as 1 percent and that is a huge difference compared to competitors.

And Veracode's ability to prevent vulnerable code from going into production is the main selling point that we talk about with our customers. It is one of the most important features. 

I have also used the Software Bill of Materials (SBOM) feature in some implementations. It's important because in modern software development, people always use third-party components but they don't necessarily see the problems that they may contain. If you don't use the SBOM tool, you won't know the status of all these third-party pieces. And it's very easy to create a report using this feature because it is made in the Veracode portal with a graphical interface or, in the CLI, it's just one line of code.

Another important factor is the policy reporting for ensuring compliance with industry standards. We generally work with big companies in Brazil and, for them, maintaining the required standards is imperative. The policies can help achieve those standards.

We can also involve Veracode at every stage of the development process. It has a lot of tools to help with security.

Veracode has a new tool to automate the fixing of flaws, but we don't use it. Generally, the orientation that Veracode provides for resolving problems is good and developers can use it to handle the problems and make things work.

In the last month or so, I had a problem with the APIs when doing some implementations. The Veracode support team could be more specific and give me more examples. They shouldn't just copy the URL for a doc and send it to me. I am a distributor and a Veracode solutions expert, so if I create a ticket that means I have read the documentation. It would be better if they sent me more examples instead.

I have been using Veracode for two and a half years.

It has great stability. It uses AWS and I don't recall any downtime.

The license provides for scalability, so it's just a matter of connecting more users. We don't need to think about it, which is good.

Veracode is a SaaS solution. We just connect it to the customer's environment. It's very simple. We have plugins for the most popular CI/CD tools and, for other tools, it's one or two lines of code to implement. Generally, we just need one person who has edit access to the pipeline. So one or two people are sufficient to implement it.

There is no maintenance of the solution because it's SaaS.

The commercial guys take care of the pricing, it's not something I'm involved in. But the licensing is simple. The SAST product has some rules that some customers have found a little confusing, but overall, the licensing is simple. 

The impact that Veracode has on security posture depends on the size of the company. Usually, large companies have standards in place, and that makes code development more secure than it is in small companies. For small companies, Veracode can really make a huge improvement to the SDLC.

I use Veracode to prevent vulnerable code from going into my application.

The major improvement is that we have secure platforms, free from vulnerable code, so I'm very pleased. It's definitely a helpful solution. It helps me to minimize risks. We know that things are very secure and cannot be hacked because we have taken out the vulnerable code. Overall, the effect is that we are very secure and very reliable for our clients.

And Veracode has improved efficiency and the quality of work in our organization. It gives our developers the confidence to develop faster, saving a lot of time. It saves them around 30 percent of their time.

And the false positive rate is very impressive. It saves us a lot of time, about 20 percent, on tuning policies.

We also know that we are compliant in our industry.

The static scanning and the analytics are ideal for me. The static analysis gives you deep insights into problems.

And creating a report is easy.

They need to have a plug-in, a better integration with the development environment. 

I have three years of experience with Veracode.

It is a stable product.

It is scalable enough.

The setup is very simple. I deployed it alone and it took me five hours.

And it doesn't require any maintenance.

I have seen a return on investment of about 50 percent. It has reduced the number of DevOps that we need, saving us about $800 per month.

The pricing is fair. You get a lot out of the product. If you're concerned about the pricing, I will show you how it is cheap.

I would recommend using Veracode to help you understand your software and remove vulnerable code.

We use Veracode to scan our products for code security. Our company also uses Veracode's data security module.

Veracode enables us to build a strong data security layer in our platforms. We can increase customer confidence in data security. Some PCI/HIPAA compliance issues were impossible to resolve without Veracode. I rate Veracode's compliance features a nine out of ten because it provides detailed reports after each scan about potential regulatory violations. 

The solution's static analysis streamlined our DevSecOps process, which previously involved a lot of manual work to trace code vulnerabilities. Veracode reduced our DevSecOps team's time on these tasks by around 20 to 30 percent while drastically improving code quality. 

In the past, we also performed a scan using third-party vendor partners that took days to complete. Veracode conducts a quick dynamic scan each time a new iteration of code is built and deployed into the environment. It gives us an immediate result. We can deploy our products much faster, and there are no delays or surprises after the product is built. We aren't wasting time from development to deployment.

Our overall security posture improved, but we've only been using Veracode in production for less than two months. We expect a massive improvement in the next six to eight months.

The false positive rate is typically less than five percent. False positives can affect how developers use a solution. If we see too many false positives, we might start ignoring alerts. Sometimes the developers lose confidence and may take the work lightly. It isn't an issue currently because the rate is under five percent. 

Dynamic scanning is the most useful feature.

Veracode's ease of use could be improved. I would also like to see more online videos and tutorials that could help us understand the product better. It would also be helpful if Veracode created a certification program for DevSecOps staff to learn about their product and get certified. This kind of training would raise the company's profile within the industry. 

We have used Veracode for about three months. We did a proof of concept for one month, and it has been in production for two. 

I rate Veracode a ten out of ten for stability. We haven't had any issues.

Veracode is scalable, but we haven't scaled it up. However, I expect it will work well when we do.

I rate Veracode support a nine out of ten. Their support system is excellent and highly engaged.

Positive

We tried some Indian solutions and used third-party scans for static analysis, but Veracode is the first time we have fully integrated an enterprise code security solution.

Veracode is a SaaS solution. Setting it up isn't simple, but it isn't too complex. We deployed Veracode with a three-person in-house team. Veracode requires a decent amount of maintenance. You must perform periodic validation checks on how the engine is performing. 

You have to compare the price to the potential cost of data security threats, which could devastate your reputation and revenue overall. We do not doubt that the investment is worth it. It's too early to calculate an ROI, but we anticipate a reduction in overall DevSecOps costs. 

Veracode is priced competitively for our market. 

We evaluated a few other vendor partners and decided to go with Veracode because of the various features they offered.

I rate Veracode a nine out of ten. If you plan to implement Veracode, your DevSecOps should adopt modularized-based code segregation for better visibility into how this ecosystem works. It's crucial to be clear about the solutions you are procuring. There are multiple options, and not everything will work for you. Understanding your requirements, what your customer needs, and what will work best for your product is essential. Purchase the solution most suitable for your product and your company. 

You should also maximize Veracode's benefit by working closely with the tech support team. We don't use many of the features we have procured. Setting up an ongoing review mechanism with Veracode technical support is critical to better understand the product and ensure you get the maximum return for your investment. These are some points that company leaders need to discuss with their DevSecOps and DevOps teams.

We are a relatively young company that started about a decade ago. The company adopted Veracode about five years ago because it's a market leader in that segment. 

Veracode checks for security flaws in our code. We provide software for companies in the financial sector, so it's critical that we use Veracode. There are some lesser-known competitors, but Veracode is the biggest player in security software. In a way, it's good marketing to use Veracode.

We are running it locally, but we plan to move to the cloud in the next few months. We're a small company with 20 employees. Our development team deals primarily with it, and some other support guys are involved occasionally. 

We have been using Veracode for several years. It has become a crucial tool for preventing security flaws in our applications. The quality of our software has improved significantly since we started using Veracode. We have a software development shop and also provide solutions for other companies. It's critical to have our software checked by Veracode.

Our code must be free of security flaws, especially high-level ones. Our software must be above a minimum threshold. Veracode has enabled us to see the quality of our code security. We need at least an 80 percent score. We are sure that our code is high-quality and that our clients won't see security vulnerabilities in the code when we ship it to them.

Veracode covers every phase of development. We mainly use it for static analysis and recently started using it for software composition analysis.

The false positive rate is around 10 percent, which is expected in automated software. Veracode's competitors have false positives, but we're happy with Veracode's ability to mitigate the problem. We check every false positive and clear it. It does not affect our competence at all. We realize it will happen from time to time. The effect of false positives is negligible. We don't have a problem with that. We are experienced enough now to see what is or isn't. 

I like Veracode's integration with our CI/CD. It automatically scans our code when we do the build. It can also detect any security flaws in our third-party libraries. Veracode is good at pinpointing the sections of code that have vulnerabilities. 

We are testing Veracode's software composition analysis, but we're having trouble integrating it with SVN. It works out of the box when you use Git but doesn't work as well with other tools like SVN. It's more geared toward Git.

I have been using Veracode for two years in my current role.

Veracode's stability is decent. That was only one instance where it identified a security flaw but didn't detect it afterward. Otherwise, it's mostly consistent.

We use it on a couple of different projects, and we plan to move to the cloud. They have a cloud option that makes it scalable.

I rate Veracode support nine out of 10 in its current state, but given our problems in the past, I might rate it seven overall. We had some problems when I joined. They put in a lot of effort, but it took them a couple of months to get it right. They did their best to resolve it, so I appreciate that, but we weren't happy it took so long.

Positive

We don't see a direct return from using Veracode, but it ensures we deliver a product without security faults. It has also reduced our development costs, but it's difficult to quantify that. By having the code tested before we ship it to clients, we ensure our clients don't have issues with the security of our software. 

The price is reasonable and affordable for a small company like ours. Veracode provides a lot of features. You can purchase some additional tools. For example, we are currently testing software composition analysis. We discussed adding that to our standard package.  

I rate Veracode eight out of 10. I recommend first testing it on your code to see if it's appropriate. You need to see how long it takes to scan the code. 

We have multiple verticals and products, and we use Veracode to perform static analysis on our hosted applications across all the platforms. We also perform static and software composition analysis on a couple of products.

Our offices are spread out across North America, South America, Europe, and Cyprus. We also have offices in Australia that use the solution. About 25 to 30 people use the solution regularly. 

Veracode has greatly improved the security posture of our applications because we can identify and mitigate vulnerabilities that we couldn't have without the solution. Veracode provides compliance reporting so we can identify issues without having to rely on complaints. Veracode has been extremely effective at fixing flaws in our applications. We have multiple applications across multiple verticals

Veracode or any other solution like it doesn't prevent anything. The product provides insight into the vulnerabilities, but it's up to the end-user to mitigate that and move it into production. If we fail to remedy the issue and move the code into production, it isn't Veracode's failure. We can't judge the product based on whether it could do that. The product is doing what it should be doing.

In addition to dynamic and static analysis, we can perform software composition analysis, which involves going into the various libraries to retrieve details about that. We see a few false positives in Veracode but not many. It's negligible. 

Veracode has saved our developers time by identifying and reporting flaws. The developers don't need to spend time checking the code by hand. It reduces the time spent on these tasks by about 10 to 20 percent. 

I believe the static analysis is Veracode's best and most valuable feature. Software composition analysis is a feature that most people don't use, and we don't use SCA for most of our applications. However, this is an essential feature because it provides insight into the third-party libraries we use.

We have some constraints interacting with Veracode self-support. I'm not talking about their technical support. I'm talking about self-support. We sometimes have a hard time communicating with them.

I have used Veracode for the last five or six years, but the company has used it for nearly 10. 

Veracode is a highly stable product.

I haven't had a scenario where we've had to scale it.

I rate Veracode technical support nine out of 10. They are excellent. When we have problems, they provide a solution every time. 

Positive

We had been using a third-party service for vulnerability checking. 

The deployment is a little complex. There is a small learning curve, but it isn't too difficult. The installation isn't hard, but we need to configure the dynamic analysis where it connects to a hosted application and performs checks. We have to configure the console and set a schedule. It takes a couple of hours to configure a new application.

We have been able to mitigate lots of flaws and vulnerabilities, so Veracode has had a positive effect on our products. It's hard for me to quantify. Our company has a large footprint across Asia, North America, South America, and Europe. 

Veracode is fairly priced. 

I rate Veracode eight out of 10. I would recommend Veracode to other users. However, I suggest doing a proof of concept before moving forward with any solution. 

We primarily use Veracode for static code analysis.

Veracode detects vulnerabilities. The most essential part is Veracode's PCI compliance policies. We need to make sure our code is compliant. Veracode's policy reporting features are effective at ensuring compliance with industry standards and regulations. The policy has changed here, but that functionality works quite well. It provides visibility to application status at every development stage. 

The solution helped us find and fix flaws. It ultimately saves us some time, but we still spend a long time sorting through the false positives. Every report generates a number of issues, some of which are valid. Others are mitigated by application design or network devices. Veracode improved our security overall. There is no doubt about that. 

The CSA vulnerability scanning is useful. 

The dynamic scanning feature appears to be working, however, 90%-95% of all vulnerabilities could be easily detected by any web browser.

When it comes to dynamic scanning Veracode needs to improve its functionality.

They claim that we can do this, but it doesn't work when we're scanning the applications in real time.  

Static code analysis generates too many false positives, so it takes a lot of time to review them all. The security and development teams need to work together to mitigate the false positives. It doesn't affect the developers' confidence in the solution. It still works, but it takes time. It has a significant impact on the process. 

I have been using Veracode for five or six years.

I rate Veracode support a seven out of ten. We have weekly meetings with the support representatives to discuss any issues with the tool. It's pretty good.

Neutral

I rate Veracode a five out of ten. 

We use Veracode to scan our code before release. The scan ensures our projects will have no issues. We only use Veracode for customer-facing and revenue-generating web applications. 

Application security is paramount. It's essential to check any extended web applications we are using. Veracode enables us to check integrated segments that are based on other websites. We can also perform a light scan on some of the smaller customer-facing web applications.  

Veracode provides visibility into application status, but we do not use it during every development phase. We only use Veracode before the code goes into production. It improves our DevSecOps. We use an agile process, so we have less time to fix issues when we discover vulnerabilities. Veracode helps us fix many critical issues but only if it is compatible with all the technologies. 

It helps if the products you use are from preferred vendors like Salesforce. If your tools are incompatible, you might get some false positives. You can still use products that aren't from preferred vendors, but if you use tools like Salesforce, etc., it will automatically recognize and ignore these issues. It cuts down on the time we spend investigating. 

The overall false positive rate is good. It is about 70-80 percent accurate. In some stages, we have to let issues go and defer the fix until another time. We might wait to release a patch later. 

Veracode adds value when we run it in an integrated environment where all the core systems are similar to our production environment. It adds value to the developers in the final stages of testing or the QA environment. We can use it for functional or system testing. That is where it adds value for the developers by enabling them to fix many of the issues. Nothing flows into the queue box. We can say it has been effective if it's up to 70 percent, but if we consider the environmental constraints, it's around 30 to 40 percent. 

It adds daily value by improving the security posture of our customer-facing web applications. A developer could make a mistake not caught in the QA process. 

I like Veracode's ease of integration with various cloud platforms and tools. 

I'm also a cybersecurity expert. In addition to vulnerabilities, I am looking at this from a holistic cybersecurity perspective. Bringing Veracode in line with the latest vulnerabilities would add value. We see APT issues often, and some processes could be left vulnerable if our tool cannot cope with them. It would improve Veracode to bring it up to date with current threats that the cybersecurity industry highlights.

I would also like Veracode to offer training and certifications that users can do on their own time. It would encourage people to build skills that they could reuse across the board. Many other software publishers offer this. It helps build a user base and generate interest. Training is an excellent way to market your product. It would also be helpful to build a user community online to create a knowledge base of expert users who can answer questions and advise Veracode on ways to improve the product.

We been using Veracode for five or six years. 

SonarQube is another solution we've used. SonarQube has some limitations, and we feel like it isn't keeping pace with the technology landscape. We had to reconsider our tool, which led us to adopt Veracode.

We had some challenges initially, but I think that was due to a lack of training. After deployment, Veracode doesn't require much maintenance. 

Veracode's price is reasonable because of the value it offers. If you don't catch bad code before it goes into production, you have to spend money to rework it, and a security failure in your product can cost your company. We think it's worth what we pay.

It would be nice if Veracode were bundled with some preferred vendors like Salesforce and offered at a discount.

I rate Veracode a nine out of ten.

We use Veracode for static web application scanning, and we've been using Vericode for our ethical hackers as well.

We have a dev, UAT, and staging environment. Veracode is included as a part of our DevSecOps in the staging environment. That means that when code is promoted to our staging environment, it automatically initiates a Veracode scan on our application.

The output and the recommendations given by Veracode are very useful. We are able to mitigate some of the vulnerabilities that the tool shows us. We are maintaining very clean applications with the help of the scanning we do with Veracode.

If any critical or high-risk vulnerabilities are detected in our code, we don't move it to production until we get a clean report. While we allow moderate and low-risk findings, we stop if it's critical or high. We do a scan on our staging whenever new code is promoted. Effectively, Veracode helps us to prevent moving the code to production if we detect any abnormalities.

Our application is an external-facing application and that means we have to proceed with the utmost caution when we promote code. Veracode has certainly been very helpful in giving us more accurate results and ensuring that our application does not have any vulnerabilities.

Veracode keeps developers aware of the possibility that issues will be identified. Once a vulnerability is detected, developers are careful to abide by the recommendations given by Veracode the next they are involved in new development. That's a positive regarding the solution. It helps improve the development process. We also share findings with the other development teams, so that they don't make the same mistake. We document the best practices so that the same flaws are not detected again. To that extent, our developers' time is optimally utilized.

Ours is a Java-based application and Veracode can detect vulnerabilities in both Angular, which is used for the UI, and also in the backend code, which includes APIs and microservices. That's one good aspect and something where other applications have a lower rating. Veracode gives us wholesome insights into the vulnerabilities in the application, both in the UI and in the backend.

Also, the false positive rate is good. I don't have any qualms about using Veracode.

The scanning on the UI portion of our applications is straightforward, but folks were having challenges with scans that involved microservices. They had to rope in an expert to have it sorted. In addition, one of my developers told me that they looked at the documentation that was given but still required the involvement of an expert to get the issue fixed. I would like the documentation to be a little more user-friendly.

Also, the turnaround times could be improved. From what I've heard, the scanning takes a bit of time to complete. If it could be completed a little more quickly, that would help.

We've been using it for five years.

There have been a couple of instances when the scan stopped or aborted and had to be manually triggered to complete. Other than that, there haven't been any challenges with Veracode

We used to have a tool called CAST, which determined code quality. It wasn't a security tool or scanner.

As an application manager, I certainly find Veracode very useful. It definitely improves the robustness of the application. It detects every single small or large flaw and helps us with the appropriate recommendations. I would go with Veracode unless there is a product that is equally capable but with a lower price.

Right now we have it on-prem but we are moving toward the cloud in the next six months or so. We've started that journey. I don't think there have been any difficulties in maintaining the pipeline. We've never had any challenges since we introduced Veracode as part of our DevSecOps pipeline.

For my application, it has definitely been a great tool. It ensures that your application is devoid of vulnerabilities. Go for it.