Veracode Valuable Features

UmarQureshi - PeerSpot reviewer
Security Lead at a retailer with 10,001+ employees

Veracode Fix is a new feature that functions similarly to auto-remediation for low or medium flaw codes. Essentially, it serves as a means to demonstrate to developers how to create secure coding modules and solutions. I am excited about it because I believe it will accelerate development time.

View full review »
AkashKhurana - PeerSpot reviewer
Senior Software Engineer at Publicis Sapient

The most valuable feature is detecting security vulnerabilities in the project. This is especially important when choosing third-party dependencies since we may not be aware of any potential security concerns or issues in the code. Veracode can help identify security issues in third-party dependencies, including code fixes and bugs. By focusing on our own security issues, we can also address potential security issues in third-party dependencies. Before going into production, we typically conduct a record scan in each department to ensure security measures are in place. 

View full review »
Reyansh Kumar - PeerSpot reviewer
Technical Specialist at Accenture

The user interface is excellent, the code review process is quick and provides great analytics to understand our code better, and the SAST scan is high-speed.

Veracode is excellent at preventing vulnerable code from going into production; the scans are speedy and give us a detailed analysis of our code. 

We use the Software Bill of Materials feature; it's essential and advantageous. We can't do a bill of materials manually, so it's excellent that Veracode provides this. SBOM helps us manage our risks, as every company has software that needs to be run appropriately throughout the user and client base. It's necessary to have a security audit or security compliance in such applications, and Veracode enables this functionality so we can easily identify security flaws and take measurable action.

Creating a report using the SBOM feature is straightforward, and it's important to our organization because it provides a return on our investment. Previously, we sometimes required a third-party resource to create reports, but with Veracode, it's easier to take care of that on our end.  

The solution's policy reporting allows us to set our standards, group policies, and regulations, so ensuring code compliance is part of its analysis. Veracode notifies us if any flaws are detected, allowing us to take action to correct them.  

The solution provides visibility into application status at every development phase throughout the SDLC; we can use Veracode during the development, design, testing, and implementation phases. We can easily analyze our code before commencing large production deployments and fix any issues.   

View full review »
Buyer's Guide
Veracode
March 2024
Learn what your peers think about Veracode. Get advice and tips from experienced pros sharing their opinions. Updated: March 2024.
765,234 professionals have used our research since 2012.
PB
ML engineer at a consultancy with 10,001+ employees

The most valuable feature is Veracode SDP, which allows for something related to third-party vulnerabilities. When we build a product, we use a lot of third-party libraries instead of building everything from scratch. We just use a library which has already been built; we just use that component in our product. Sometimes, these libraries may have bugs or issues, and it's hard to keep track of them because we use thousands of them.

Veracode's tool scans every single library and gives a dashboard showing the number of libraries, high and low criticality issues, and whether a product has any issues. It helps us assess the libraries and decide whether to resolve the issues or replace the library to minimize risks.

I like the solution's ability to prevent vulnerable code from going into production. It does a pretty good job in most cases, but I have seen a few false positives in the code scan. It means that sometimes, like recently, we run a scan where we encounter a part of JavaScript code where it's just a string evaluation. Despite not posing any real threat, the system flagged it as a potential vulnerability, suggesting it could be exploited to hack into the system. We looked into that code and found it wasn't the case; it was a false positive. It wasn't a big issue because we reported it to Veracode, and they made an exception and resolved it. It does a pretty good job, but sometimes it can be very misleading.

However, the solution's false positive is not a big deal because it's very minimal. Veracode does a very good job, but 99% of the time, it works well. Only, like, 1% - 2%. Like, sometimes we manage false positives. It's not a big blocker as well. Every software is not perfect. Also, these are very minimal fixes. Sometimes, if we raise a support ticket to mitigate this issue, the response is also pretty good, and it can be resolved within one or two days. So it's not that big of a deal.

View full review »
Robert Hood - PeerSpot reviewer
Information Security Architect at a tech vendor with 5,001-10,000 employees

The most valuable feature is the SAST capability and its integration into the Veracode pipelines.

View full review »
Alice William - PeerSpot reviewer
Senior Web Developer at a insurance company with 1,001-5,000 employees

We like the fact that all the issues are identified and that Veracode provides sufficient information on how to resolve them. This is very helpful if we need to troubleshoot problems ourselves, as we have plenty of information at our disposal. Additionally, we appreciate the option to request a consultation directly from the issue itself. Whenever there is a problem, there is a small button that says "Reach out to a consultant." We can then schedule a call with a consultant who can help us resolve the issue.

View full review »
Anant Upadhyay - PeerSpot reviewer
Game Developer at Gamezlab

Veracode is easy to use even if you're not a security professional. I like the dynamic analysis feature, which offers a lot of cost savings when used in production. Veracode helps prevent vulnerable code from entering production, and it has a low false-positive rate, so it can reliably find real vulnerabilities. 

The software bill of materials feature has proven helpful in finding bugs and flaws that may cause problems in our product when we launch it. It has helped a lot to exponentially reduce the cost after the launch cycle. It is quite easy to create reports and perform a detailed analysis because much of the process is automated. It can fix most issues automatically.

View full review »
SumalyaGuha - PeerSpot reviewer
Security Engineer at a comms service provider with 10,001+ employees

The static analysis is the most valuable aspect for us.

It also has the ability to block a build. In pipeline scanning, there is a configuration that can be set with respect to the security level of the flaw. If there is a high or a critical issue, there's a way the build can be failed and blocked before going into production. But the best case that I have found for blocking builds is in the staging area. You don't really want any blocking done on the production environment because there are business SLAs that the enterprise has to fulfill. The best case would be blocking the builds in the staging phase, the pre-production environment, so that everything is taken care of before it is pushed to production.

There are three integration points for Veracode. One is the IDE plugin. Whenever a developer is writing code on their IDE platform plugin for Veracode—whether IntelliJ or Visual Studio, et cetera—it tells them if that piece of code has any vulnerabilities and if there is a better way to write the code.

The next point is the pipeline integration in which, whenever a build is getting pushed from a standalone branch to the main branch, a scan is done on that commit to see if there are any vulnerabilities.

Finally, when the build is published with the whole module, it can do another scan, as well. These three scans have their own pros and cons. The policy scan, which is a build scan, does the scanning on an overall basis with regard to the different standards out there, like OS and Spin5. It scans the first-party and third-party code, which is the most holistic scan that there can be. But the point is that it scans at three different integration points or stages, so it helps developers to remediate their vulnerabilities before they have moved far in the pipeline. Shift-left is definitely possible through Veracode.

View full review »
Rishabh Khanna - PeerSpot reviewer
Security Engineer at a tech services company with 5,001-10,000 employees

We use a code review-based tool, so the unique aspect of Veracode is that it is really good for legacy or old technologies. It can scan old databases and old code written 20 years back.

Depending on the technology we are working with, the solution's ability to prevent vulnerable code from going into production whether it is Java-based code or ASP.net, the efficient number of identification codes is the best in the market for legacy technologies. I would use Fortify or Checkmarx to test accordingly using the latest code.

The best feature I like about Veracode is the ability to give low-level access to accounts. The identity access management system is really good and we can even integrate it with the ID. For example, if we're coding in Eclipse or something similar we can push the code from the ID directly into Veracode's backend to have its security tested. It is cloud-hosted and the downtime is very minimal. We could check the results anywhere, anytime. This makes the platform's independence very good. 

The solution provides visibility into application status at every phase of development. We can see and make adjustments accordingly at each level.

Veracode is a great solution for old applications. I would only recommend Veracode for older applications.

View full review »
KK
CEO and App Developer at DroidForge

Its intelligent remediation capability is very helpful. The advanced algorithms not only identify vulnerabilities but also intelligently recommend tailored remedy strategies. It has a code system analyzer and then proposes the most effective and efficient solutions for each of the identified vulnerabilities.

This unique functionality significantly streamlines our development process offering free use and exchangeable insights, saving valuable time and resources for our team. We can leverage the reports for intelligent remediation guidance to speedily address vulnerabilities with tailored and contextual remediation solutions, ensuring data applications meet high-security standards.

We can optimize our development workflow for maximum efficiency.

I like the feature update, which offers a lot of cost savings for us in production. Veracode also helps in preventing variable code from entering production. We have a very low false positive rate. It can find their issues and loopholes. It's a very good thing.

I've used Del Force. We have experience using that. The team is licensed and guided us very quickly. I had positive reviews from the team, and we were all satisfied with their guidance.

The innovative features offered by Veracode are excellent. It offers a static analysis of security vulnerabilities such as SQL infections and cross-site scripting. Also, it has this dynamic analysis feature which scans the running application for vulnerabilities that can be exported by our trackers. We can see if there is a broken authentication or issues in session management. It has software-compliant analysis, which identifies open-source components in the software application known for security vulnerabilities.

It also has interactive application security testing, which scans the running application for vulnerabilities while interacting with the users, which can help identify loopholes while we're interacting and testing the application.

The product offers manual penetration testing, which helps us identify and validate security vulnerabilities. It also offers us continuous scanning, which can be integrated with continuous integration and continuous delivery pipelines, to enable container scaling of applications throughout the whole software development life cycle. It provides the remediation guidance.

I’ve used a feature called VeracodeFix that produces AI-generated fixes. We have not used it that much.

Veracode provides us with visibility into application status at every phase of development. It’s provided visibility into our apps. We are able to identify the issues and bugs before the deployment or after (before the launching of the product), so we do not have any patching issues.

Veracode has been a transformative asset for our company. It has fortified our development cycle by providing us with comprehensive security assessments, allowing us to proactively identify potential vulnerabilities in our applications. This proactive approach has bolstered the trust of our clients.

It saves us time. We’ve saved time doing manual testing and investigating code. It has also enabled us to identify bugs earlier, so we do not have to release the patches after the product is launched. It’s significantly contributed to saving us time and money by automating the process of detecting vulnerabilities.

Veracode has had a positive impact on our security posture. Our implementations have seen remarkable improvement in our overall development resulting in a reduction in post-deployment security incidents. This decrease in security vulnerabilities has not only saved approximately 25% of the development time that we previously spent on addressing these issues. It’s also significantly boosted our client content leading to a 20% increase in our customer retention rate. Moreover, the enhanced security posture achieved through Veracode has enabled us to secure larger and more communicative contracts contributing to a 30% increase in our annual income.

It’s helped with our security strategy. Our time spent on investigating code would be higher. We spend less time and money on patching and dealing with error codes.

View full review »
Ashish Upadhyay - PeerSpot reviewer
Founder at BlockMosiac

It's good at identifying security issues. It can pinpoint issues very effectively. 

The solution helps us build and maintain trust between users and partners.

It's specifically designed to be customizable. We can maintain robust and secure code.

We can easily identify vulnerabilities. Many others, like Microsoft, aren't able to catch certain vulnerabilities. This is much more effective.

I use a variety of features in the solution. Many can be integrated with various software tools. There are good scanning capabilities and data analysis features as well. 

We use the software bill of materials feature. It helps us manage our risks. We've seen dramatic changes in our risk posture. The detection of security incidents has increased.  We also have noted a faster time to market for our features by 40%. 

The compliance reporting has been very good. It's very easy. We can do it within a couple of hours. It helps us stay in compliance with standards and regulations. 

The visibility and transparency we get through static analysis, dynamic analysis, software composition, analysis, and manual penetration testing through our SDRC are excellent.

The false positive rate is very low. Using this platform, we spend way less time performing investigations. It helps improve our employee's confidence rate in managing the static analysis. We're saving about 50% of our time now that we have fewer false positives.

We are able to efficiently fix flaws. We've mitigated potential vulnerabilities by 50% and reduced incidents by 30%.

It's helped us save time. Most tasks are done with much less time needed.

After implementing the solution, we've seen a much better security posture. The security incidents and associated costs have lowered substantially. 

I'd reduced the cost of DevSecOps in our company by 40% to 50%.

View full review »
Boyapati Sivannarayana - PeerSpot reviewer
Devops Engineer at Accenture

We've only used the solution for a year; it hasn't been that long.

The deployment mode is very useful.

We like that it can prevent vulnerable code from going into production.

We use the low-level elements and do greenlight deployment through Veracode.

It helps us manage our licensing and security risks. However, we are in the implementation process right now. So far, it's okay and working fine.

It's good that we can do a full code scan, front to back, or vice versa.

We mostly use the policy scan and vulnerability scan mostly. 

The security is okay.

View full review »
Shashank Niranjan - PeerSpot reviewer
Senior Software Engineer at Capgemini

Being able to scan our applications and identify all codes and defects is an extremely valuable feature.

View full review »
Devid William - PeerSpot reviewer
Application Security Architect at Banco Votorantim

The speed is the most valuable aspect.

Veracode's ability to prevent vulnerable code from going into production is very good since we have a few false positives. I'd rate this feature nine out of ten.

Veracode's policy reporting for ensuring compliance with industry standards and regulations is great. It has a detailed report that we can look at to see our landscape easily.

Veracode provides visibility into application status at every phase of development Verticode static analysis, dynamic analysis, software composition analysis, and manual penetration test throughout your SDLC. It positively affects our DevSec processes. It's not possible to bypass Veracode. It's very secure.

There are very few false positives. I'd rate the false positive rate as nine out of ten. It's very good. It's very positive for developer confidence. They understand security development very well and Veracode provides excellent transparency.

It's reduced the time we've spent on tuning policies. We've saved around two hours. We used to waste around 3 hours and now we can do what we need to in 30 minutes.

It's helped our team fix flaws. The security gate helps our developers learn how to fix vulnerabilities. The solution has also helped them save time in their efforts. It provides descriptions of how to fix certain items. It saves them from having to search on the internet for fixes.

The solution has had a positive effect on our security posture. I'd rate it nine out of ten. We have very secure applications. 

View full review »
OK
Sr. Development Manager at RWS Holdings PLC

It's hard to say that any single feature is the most essential. There are many errors and vulnerabilities in software today in the standard libraries for different vendors because. We don't need to reinvent the wheel every time because we're using standard libraries, and it's important to know that your security isn't compromised because you use libraries with vulnerabilities. 

We use Veracode as a quality gate. We do not do continuous delivery or continuous deployment. We're releasing about twice a year, so we use it as a quality gate in this situation. We should analyze various types of patch software. From my observations, it has been an excellent tool so far. We also have an external penetration testing effort, and the testers have not found any issues, so that tells us that Veracode has been successful at preventing issues from entering production.

I use the software bill of materials. Our product consists of many systems and components and redundancies that must be processed manually. We are in contact with the Veracode guys, and I think the next release will have this software bill of materials added. It isn't a problem with Veracode. It's a problem with the way we upload and build sources. In the implementation stage, we want the results as fast as possible, and we've done it in a way when we upload. It can be optimized when we upload it to Veracode. 

View full review »
PavanKumar18 - PeerSpot reviewer
Senior Testing Engineer at TollPlus LLC.

One thing we like is the secret detection feature. It has helped us to discover keys stored in our settings file as a TXT document. We can address that vulnerability by using encryption. We can even scan Docker images for vulnerabilities. Static analysis is another good feature of Veracode because we can run a security scan during development to identify the vulnerabilities.

Veracode helps us prevent vulnerabilities from entering production. We can put it into the pipeline and set an acceptable limit for vulnerabilities. If the number of vulnerabilities is under the threshold, we can deploy automatically. 

View full review »
Zach Handzlik - PeerSpot reviewer
Release Manager/Scrum Master at Amtech Software

Veracode's integration with our continuous integration solution is what I've found to be the most valuable feature. It is easy to connect the two and to run scans in an automated way without needing as much manual intervention.

We feel very confident about Veracode's ability to prevent vulnerable code from going into production. Having the stamp of approval helps not only from a marketability standpoint but also from an overall good feeling within the organization that we're doing our part to help keep our code free from vulnerabilities.

This solution provides visibility into application status at every phase of development. It goes from compiling the code all the way to running it in production. It covers all major aspects of the SDLC. We run static scans and SCA scans early on in the process to make sure that we catch any code that is insecure by design. If we are able to catch it earlier on, before it's actually out in the production environment, it reduces costs. The dynamic scans are run further along in our QA process. That is, once we've deployed the code and have it in a runtime environment, we run weekly scans in a dynamic environment against the code runtime to make sure that there aren't any new vulnerabilities that got introduced. We are looking at doing manual penetration testing in 2023, where we would be using a spinoff of the code that was released to the customers to make sure that there aren't any holes through which a nefarious actor could get in and exploit what was built.

Veracode's false-positive rate is low. The few instances when it looked like there were false positives, the issues were found to be either true vulnerabilities or things that were that way by design. If a developer thought that there would be a ton of false positives when using the tool, it would then diminish the value of actually using the tool. Veracode touts itself as being a tool with the lowest false-positive rate in the market. It gives inherent confidence in the tool itself, and developers are more inclined to think that if it found something, it's pretty likely that it is not a false positive. They would then work to prove it wrong rather than discounting it without even looking into it.

We haven't really found many false positives with static analysis, and there hasn't been a significant impact on our time and cost related to tuning, leveraging data, and machine learning.

Continuous integration linking definitely saves a lot of time because it takes away the step where a developer needs to manually upload the code every time to do a scan. It can run in the background, and having the Visual Studio plugin includes it directly in the development environment. If developers do get assigned a bug that they need to fix, they can pull it right up in their development environment and not have to log in to the portal. It will all be right there.

I'm primarily the one who has been involved in DevSecOps, and Veracode has definitely reduced my time. If we had gone with a conglomeration of open-source tools, it would've taken me a ton more time. Whereas with Veracode, all the documentation is out there, and I'm able to integrate everything that I need from a usability standpoint. I don't have to learn a new tool every time I need to integrate a new security scanning option. It has helped me tremendously and has saved me a lot of time.

View full review »
JS
Manager of Application Development and Integrations at a university with 1,001-5,000 employees

Veracode Security Labs are fantastic. My team loves getting the hands-on experience of putting in a flaw and fixing it. It's interactive. We've gotten decent support from the sales and software engineers, so the initial support was excellent. They scheduled a consultation call to dive deep and discuss why we see these findings and codes. That was incredibly helpful.

Veracode's static and software composition scanning has been most beneficial for us. We already use a competing product for dynamic scanning. 

View full review »
Alex Fuglaar - PeerSpot reviewer
Manager at a financial services firm with 1,001-5,000 employees

The feature I've used the most is the static code analysis. It was incredibly easy to start using. As a new user, there wasn't a lot of lead time to understand the software work. It was also very easy to communicate the vulnerabilities that Veracode found to the engineering teams that needed to remediate the issues.

We have used the software bill of materials. This feature is good for helping us manage your supply chain, security, and licensing. That comes into play a lot when we are working with federal contracts where certain materials or processes are not allowed within contracts with the federal government. We would use that to ensure that the software itself is compliant. It is easy to create these reports using this feature.

The product’s policy reporting for ensuring compliance with industry standards and regulations is great. It took its own compliance quite seriously, which is something I always look for when dealing with the vendor. There are certain vendors out there that aren't as serious about their own security. I was comfortable with what the product was doing.

Veracode provides visibility into application status at every phase of development throughout your software development life cycle. It definitely improved the efficiency of it. One of the key things Veracode can do is it can rank the vulnerability defined based on the severity. That allowed us to hone in on what was the highest vulnerability and then work our way down. Therefore, it definitely improves the efficiency of those operations.

Veracode's false positive rate, as far as I remember from my experience, wasn't that bad. Usually, what it will do is it will identify a vulnerability, and then it will explain why the vulnerability is important, and then through those explanations, the engineers and I were able to see if something is an issue or if it is a false positive. When it comes to eliminating false positives, you're never going to have 100%. While it did introduce a little frustration, what did remediate that was the explanations that the software provided.

The false positive rate affected the time we spent on tuning these policies somewhat, however, it wasn't too bad. It wasn't anything to complain about.

For the clients I work with, it has a significant impact on improving the ability to identify and then fix flaws. The tool itself does offer strategies to remediate the efforts if, for whatever reason, the engineering team doesn't understand how best to approach them. Usually, they do, however, it is nice that they offer that service.

Veracode helped our developers save time. From my experience, what would normally take two days we're able to get done in an afternoon. That allows our team to work on more efficient work and more impactful work.

The product has had a positive experience on the overall security posture of our organization. It has definitely improved it. Hands down, it is easy to say that the solution has had a positive impact on the security posture of the organizations I consulted for.

Veracode reduces the cost of dev backups. That said, it's hard to put a number on it. It reduces the dev set time and the work they do can then be allocated effectively to other items. 

View full review »
Saket Pandey - PeerSpot reviewer
Product Manager at a hospitality company with 51-200 employees

The recommendations and frequent updates are the most valuable features of Veracode.

View full review »
Freddy Bang. - PeerSpot reviewer
Chief Technology Officer at ELEARNINGFORCE International ApS

We are using three of the features. Static analysis, dynamic analysis, and the code composition for third parties. We also use their Security Labs for training.

Veracode does a great job of preventing vulnerable code from going into production, and its policy reporting for compliance is also very good. It meets our needs.

And if you use it correctly and bring early feedback into the developers' environment, it provides visibility into application status at every phase of development. But if you only use it as an analysis after the product has been built, then you don't have the whole life cycle. So it really depends on how you integrate Veracode. For us, it gives full insights.

View full review »
Arnab Paul - PeerSpot reviewer
Cyber Security Consultant at a consultancy with 10,001+ employees

Regarding Software Composition Analysis, an exceptional feature is that during a SAST scan, SCA is seamlessly conducted in the background. Once we scan all modules and obtain SAST results, switching to the SCA section reveals the associated reports. This integrated approach eliminates the need for separate SAST and SCA scans, as is required by other tools.

The reporting feature is noteworthy. The reports are well-structured, providing comprehensive details for each vulnerability. Information about the vulnerability itself, its origin, the specific section of code it pertains to, and even the exact line of code involved are all included.

View full review »
DB
Security Engineer at a tech vendor with 10,001+ employees

I like the sandbox, the ability to upload compiled code, and how easy it is.

It's also straightforward to find scans we've uploaded. 

The solution's ability to prevent vulnerable code from going into production is incredible. I have done several consultations and remediation calls with the app team, and Veracode catches almost everything. It picks up the same issues in everything we scan, and we've done a lot of retests that way; the tool is very proficient in this area.  

Veracode helps our developers save time; it's a straightforward product that shows us the vulnerabilities and allows us to relay them back to the developers. This is faster and more efficient than staff going through the code manually. The solution is like having a proofreading app for our code rather than using a proofreader.  

View full review »
Prateek Agarwal - PeerSpot reviewer
Manager at Indian Institute of Management Visakhapatnam

It is fully automated. I love the automation feature.

The findings of their security analysis are wonderful. You can easily go through all the analyses done by Veracode. You can see what are the flaws and what could be the best possible resolution to minimize those flaws in the application. When an application is being used by the public, security is a challenge. Veracode helps us to analyze all the security flaws, discrepancies, and vulnerabilities inside the application. It provides good reports.

View full review »
Jan Pašek - PeerSpot reviewer
Tech Lead at a financial services firm with 10,001+ employees

I like the way the flaws are reported in the system. It is quite clearly visible where the flaw is coming from, and it is possible to upload the code to see exactly which line was identified as a security threat. I also like the software composition analysis that Veracode provides, because we can see third-party libraries that are used in our software and check if there are any known security flaws in those libraries.

View full review »
RB
Security Analyst at a insurance company with 10,001+ employees

From a developer's perspective, Veracode's greenlight feature on the IDE is helpful. It helps the developer to be more proactive in secure coding standards. Apart from that, static analysis scanning is definitely one of the top features of Veracode.

Recently, I came across a new workflow, which I had seen in Checkmarx, that shows how a vulnerability flows from the start point to the end point of a function. 

View full review »
Nantabo Jackie - PeerSpot reviewer
Sales Manager at Soft Hostings Limited

The user interface is quick, familiar, and user-friendly and makes navigation to other software very easy. It is also easy to scan a new application and view the results of previous scans and generate a report.

It is really great when it comes to knowing the vulnerabilities in the code as well.

Veracode has also really tried to make sure that they comply with any standards and regulations, and the process is quick and quite straightforward. That has had a very good and positive impact.

View full review »
Shobana Raghu - PeerSpot reviewer
Application Development Analyst at a consultancy with 10,001+ employees

I liked that I could easily find out where my errors were. Instead of going through the whole code and the scripts, it showed me where the errors were and gave me an idea of how to fix them.

View full review »
Avinash Mukesh - PeerSpot reviewer
IT Specialists at Soft Hostings

Veracode is very easy to use. I use it to scan my Java Micro Service, and it is easy to configure. It does not require any software to be installed, and it can access data files and scan them quickly. This makes it very user-friendly.

View full review »
Hassan Saleh - PeerSpot reviewer
Managing Director at Century Bottling Company

I like the static scanning, and Veracode's interface is excellent. The dashboard is easy to navigate. I love the Software Bill of Materials (SBOM) feature because it helps you explore various industries and understand what to do to minimize risks and maintain compliance. It's straightforward and ensures my applications are compliant. 

It's easy to create reports using the SBOM feature because it has templates that you can customize depending on the reporting requirements. It gives me a report of the compliance requirements for any industry. It helps us internally and improves the services we provide to our clients.

Veracode is great for preventing vulnerable code from going into production because it covers various programming languages like JavaScript and PHP. You can be confident that your code is secure no matter which language you use.

View full review »
Prasenjit Roy - PeerSpot reviewer
Sr. Cloud Solution Architect - SAP on Azure at Accenture

Veracode supports a broad range of code technologies, and it can analyze large applications. Fortify takes a long time and may not be able to generate the report for larger applications. We don't have these constraints with Veracode.

View full review »
Oscar Narvaez - PeerSpot reviewer
COE Head at a tech services company with 1,001-5,000 employees

I like Veracode's static analysis. It was one of the core development tools when I worked with a telecommunication company where we were delivering new features for various applications and purposes each week, such as CRM, data channels, compliance, traffic data, etc. 

Most of the time, the key thing was to ensure the security of digital channels and reduce the risk of any breach that could cause a security issue. It's critical to maintain the security of sensitive information transferred from our customers to the sales staff. Keeping that data secure is important for the customer relationship and also for compliance and recurring sales.

I rate Veracode 10 out of 10 for its ability to prevent vulnerable code from entering production. It has a lot of useful and intuitive features. In previous settings, static analysis was one of the primary use cases, but dynamic analysis is also helpful. Veracode is highly valuable because one vulnerability could result in service downtime or worse: a leak of customer information. 

The investment in the tool is justified because we can detect and prevent vulnerabilities much earlier in the process. Software composition analysis is also vital when we use open-source middleware or backend components for business-critical functions like bringing information from one source to another or connecting one application to another. 

View full review »
Daniel Krivda - PeerSpot reviewer
DevOps Engineer at a insurance company with 10,001+ employees

You can easily integrate it with Azure DevOps. This is an added value because we work with Azure DevOps. Veracode is natively supported and we don't have to work with APIs.

View full review »
Vikas Agrawal - PeerSpot reviewer
DevOps Lead at HealthEdge Software, Inc.

The SCA, agent-based analysis, is valuable. SAST and DAST take time, while this is quite fast. It gives the results very quickly. We have implemented it into our CI/CD pipeline.

Another aspect that is quite good is the policy reporting for ensuring compliance with industry standards and regulations. Initially, we were using freeware tools, but we are quite impressed with how Veracode gives the most detailed and latest vulnerability and security information.

View full review »
Muhammed Shabreen - PeerSpot reviewer
CTO at RIZEK

It is a good product for creating secure software. The static code analysis is pretty good and useful. The mitigation recommendations provided by the scanning engine are also pretty good.

View full review »
KN
Junior Developer Intern at a insurance company with 10,001+ employees

What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. For example, I'm running an application via the dev ops pipeline. Hence, I need to create a pipeline application and a sandbox to connect with Veracode and then add my application. When you create a sandbox, you can create it full-time or for a limited time, so I created it for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode.

I also like that for each integration in Veracode, there's documentation.

I also find the Veracode support team extraordinary because the team goes above and beyond to ensure you get the best experience.

I find Veracode essential in preventing vulnerable code from going into production because if there's a vulnerability, the solution finds it. For example, my code has many JavaScript front-end and EAR files with some vulnerabilities. Right now, I'm deploying my code, but in the future, I may have to improve it and change it to ensure the servers are secure, so in that way, Veracode becomes more important for the industry today.

Policy reporting in Veracode is good in terms of ensuring compliance with industry standards and regulations. I like that the solution is more flexible when working with applications, mainly because my organization has a good firewall. Veracode is flexible and allows the organization to connect to the firewall in various ways. The Veracode policy is flexible and has an entire page and record that connects with my application, industry, company, and server in different ways. It does not disturb my policies so that I can get my application to work.

The false positive rate for Veracode is about seventy-thirty because it gives the most accurate report. For example, my organization depends on the Veracode analysis to ensure the code is on point, so the organization is building the next BI based on the Veracode analysis.

Veracode has also helped my organization save time because, without the report, the development team would spend a lot of time figuring out what is wrong and why the application is vulnerable. Veracode points out what is happening and why the file size must be reduced, so it helps reduce mistakes in terms of time.

View full review »
Satheesh Bojedla - PeerSpot reviewer
Senior engineer at a financial services firm with 5,001-10,000 employees

The most valuable feature of the solution is Veracode's library, which supports the automation of Veracode's scanning process.

The major benefit of Veracode Static Analysis is that you can schedule a scan on demand. We found the delta approach in scanning to be super quick in terms of returning results in our company, even though we had to make uploads of certain things, but it would be longer if the size of the scanning part were huge, making it one of the drawbacks.

View full review »
Oluseyi Osifalujo - PeerSpot reviewer
Executive Director at Precise Financial Systems Limited

The static scan is the most valuable feature. We are also currently evaluating the Dynamic scan.

View full review »
Ivo Dias - PeerSpot reviewer
Sales Engineer at M3Corp

To me, the principal feature is the CLI (command-line interface) because I put together a lot of implementations using it. Another important aspect is the low false-positive rate because the solution is very configurable. It is as low as 1 percent and that is a huge difference compared to competitors.

And Veracode's ability to prevent vulnerable code from going into production is the main selling point that we talk about with our customers. It is one of the most important features. 

I have also used the Software Bill of Materials (SBOM) feature in some implementations. It's important because in modern software development, people always use third-party components but they don't necessarily see the problems that they may contain. If you don't use the SBOM tool, you won't know the status of all these third-party pieces. And it's very easy to create a report using this feature because it is made in the Veracode portal with a graphical interface or, in the CLI, it's just one line of code.

Another important factor is the policy reporting for ensuring compliance with industry standards. We generally work with big companies in Brazil and, for them, maintaining the required standards is imperative. The policies can help achieve those standards.

We can also involve Veracode at every stage of the development process. It has a lot of tools to help with security.

Veracode has a new tool to automate the fixing of flaws, but we don't use it. Generally, the orientation that Veracode provides for resolving problems is good and developers can use it to handle the problems and make things work.

View full review »
MC
Vice President of Engineering at Avant Assessment

The Security Labs feature, in particular, is valuable, and I have been using the static code analysis as well.

View full review »
Jagusztin Laszlo - PeerSpot reviewer
Lead Architect, Presales lead at Alerant Zrt.

It's good that it's cloud-based because we don't have to operate a new IT system for security scanning.

It provides a centralized view across all testing types, including SaaS, DAST, SCA, and manual penetration testing. We now have a central place with overall visibility.

In addition, the mitigation recommendations provided by the scanning engine are good. They are not all perfect, but they are good and usable.

View full review »
JW
Lead Product Security Engineer at a computer software company with 1,001-5,000 employees

The source composition analysis had very good reporting.

View full review »
MH
Chief Software Architect at a tech services company with 51-200 employees

What we found most valuable in Veracode is the ability to do automatic scans of our software. We've incorporated the solution into our SDLC process, so we take our builds before they get released and put them through scans to ensure any new vulnerabilities haven't occurred.

We found Veracode good at preventing vulnerable code from going into production.

We also use the Software Bill of Materials (SBOM) as we run many applications through Veracode. We use SBOM to discover all the different vulnerabilities and what that stack looks like.

We also found Veracode very good in helping us manage risks, such as supply chain, licensing, and security. The solution allows us to see where the risks are and if updates are available and identify how to remediate our software quickly.

Our company also found it moderately easy to use Veracode when creating a report via the Software Bill of Materials. There may be a bit of a learning curve, but once users have done it, they'll run the same report.

As for policy reporting in Veracode to ensure compliance with industry standards and regulations, we have not used the solution that way. Instead, we rely on the different statuses to achieve the levels we want to achieve and be able to use that on marketing material.

Veracode offers visibility into the application status at every development phase throughout the software development life cycle, but we have not implemented that. That feature is built into the development tool, so developers will get alerts as they code, but we plan to do that in the coming year.

We found a moderate false positive rate in Veracode. There were a few false positives. Veracode can identify vulnerabilities, which we found nice. We could flag false positives on Veracode so they don't continue to pop up and hunt them down, and the solution will ignore those in the future.

The false positive rate in Veracode doesn't affect developer confidence in the solution when fixing vulnerabilities because we realized that our application is huge. False positives will happen in large applications just because of the different ways of implementation and features. No toolset can handle all those different features and interactions, so we can't say they relate to vulnerability.

Veracode dramatically impacted our company's ability to have security awareness and achieve a level of confidence that we can put out to the marketplace.

We also saw how Veracode affected our company's overall security posture, explicitly being able to put the solution into automatic scanning mode, then through our SDLC cycles, and achieve a Veracode-verified status. We can use that as a marketing advantage and say that we've achieved Veracode-verified status with one of the leading vendors of security scanning software. We've reached a level of status with them, and we continually scan our software so our clients can be confident that our software has been scanned for security files before implementing a new software release.

View full review »
AK
LSA at a consultancy with 10,001+ employees

The CI/CD integration is the most valuable feature of Veracode. This feature is not present in other solutions.

View full review »
BF
Application Security Engineer at Advantasure

I like Veracode's static scanning and SCA. We use three static scans, software composition analysis, and dynamic scans. We haven't used dynamic scanning as much, but we're trying to integrate that into our environment more. 

For the most part, we've had good luck with the static scans as well as the software composition analysis scans. Veracode does a decent job of catching most vulnerabilities from making it into production, but it doesn't catch everything.

View full review »
Geofrey Mutabazi - PeerSpot reviewer
Founder at a manufacturing company with 1-10 employees

I believe that testing code early on is always beneficial, and using UI saves time by detecting issues in the flow before the release cycle through verification scanning. Additionally, I appreciate the integration provided by Veracode that seamlessly integrates with our CI/CD tools and allows us to integrate with IPA as well. Overall, I'm impressed with the integration and user interface.

View full review »
Michea Mbaziira - PeerSpot reviewer
Insurance Agent at ICEA

Code scanning is the most valuable feature. 

The templates allow us to create wonderful reports.

The software bill of materials feature helps our supply chain security.

View full review »
Prakash Pillay - PeerSpot reviewer
Director - Product Solution/Architecture at a tech vendor with 10,001+ employees

It scans for the OWASP top-10 security flaws at the dynamic level and, at the static level, it scans for all the warnings so that developers can fix the code before we go to UAT or the next phase.

It also gives us a centralized view of issues and that is important because security is key to any application. We want to identify the flaws as early as possible. The centralized view means that everybody can see the report and remediate accordingly.

View full review »
Evan Gertis - PeerSpot reviewer
Penetration Tester at a tech vendor with 51-200 employees

We use the screening process to help our security professionals and developers fix flaws in the code. It's probably the most utilized security tool that we have at our company.

Scanning with Veracode SCA reduces scan times by a few seconds. It also helps to increase our fixed-rate by 14%.

The scanning process helps to significantly improve our standards and best practices.

The mitigation recommendations provided by the scanning engine of Veracode are important for developers to understand. They need to know how to fix things. So just giving them a blank vulnerability and saying, "this is the issue," doesn't really help. They need something that tells them how to fix the flaw and where to fix the flaw.

Veracode helped us with certification and audit. We're working towards Veracode Level Four right now, we've achieved Veracode Level Three status, and we're looking forward to reaching the next certification level. The goal of that is to eventually have all of our third-party vulnerabilities and mitigate them so that we're in good standing and we don't have anything coming from a third-party library that could possibly compromise our application. Once we get to that fourth certification Veracode Level Four, that would be great.

View full review »
CM
CyberSec professional at a manufacturing company with 5,001-10,000 employees

The admin ID can be downloaded into Visual Studio, for example, and developers can use that directive without having to type code. I think this is the best feature of Veracode.

The integration of static testing with our Azure DevOps CI pipeline was easy.

View full review »
Dipjyoti Roy - PeerSpot reviewer
Senior Devops Engineer at Thosmon Reuters

The capability to identify vulnerable code is the most valuable feature of Veracode.

View full review »
Vladimir Shilov - PeerSpot reviewer
DevSecOps at Ciklum ApS

The most valuable features of the solution are its extensive reporting capabilities and user-friendly interface.

View full review »
Mahammad Azeem - PeerSpot reviewer
Application Architect at a tech services company with 10,001+ employees

The most valuable feature is the seamless automation of Veracode via the pipeline, in comparison to other solutions like Fortify SSC, which are complex to integrate through the pipeline. Although there is a lot of coding involved in writing each end, Veracode breaks the process down into multiple steps. We first package our source code and upload it, after which a pre-scan is conducted. If the pre-scan identifies any files that don't conform to the Veracode format, it will display a warning or prompt us to correct the issues before proceeding. This allows us to have programmable control; in fact, we can program Veracode so that after the upload is completed, it automatically scans the files to check if they are all in Veracode format.

For example, my ZIP file contains a hundred files. Out of these, ninety files meet Veracode's criteria, while ten files are incorrect. I can instruct Veracode, through pipeline automation, not to wait for manual action and continue with the scan or upload the scan results. Veracode can automatically proceed with the selected files in this scenario. All of this can be controlled programmatically. Furthermore, once the scan report is generated, it becomes available in the workspace, and we can send an email with this report as an attachment. This type of report is referred to as a detailed Veracode report and can be customized. Typically, we prefer the customized report, while some developers may also opt for XML reports. The ability to manage this sequence of steps in the Veracode scan is programmable and can be handled accordingly.

View full review »
VS
Sr. Web Application Security at a tech vendor with 10,001+ employees

The CSA vulnerability scanning is useful. 

View full review »
SR
IT Manager at a financial services firm with 5,001-10,000 employees

Ours is a Java-based application and Veracode can detect vulnerabilities in both Angular, which is used for the UI, and also in the backend code, which includes APIs and microservices. That's one good aspect and something where other applications have a lower rating. Veracode gives us wholesome insights into the vulnerabilities in the application, both in the UI and in the backend.

Also, the false positive rate is good. I don't have any qualms about using Veracode.

View full review »
Walwasa Mulutazah Yahaya - PeerSpot reviewer
Project officer at BRAC Uganda

It's helping us with security and making sure that we develop faster. It's able to scan every vulnerability. It's very powerful software that one can use to make sure that you have a very good, secure platform. The code analysis and reporting feature can give you instructions on how you can fix or how you can mitigate an issue in a good way. You can get the code analysis and make sure that it's very safe.

The Software Bill of Materials (SBOM) feature is very good. Veracode is very unique and very easy to use. You can be sure of the risk assessment and compliance with available policies to make sure that the product you are providing the client or the customer is not only secure enough but also gives good privacy.

It's easy to create a report. It does not require any technical knowledge. The report is good, and it gives out detailed information about the implementation process and integration into the CI/CD pipeline.

View full review »
Peter Westin - PeerSpot reviewer
Backend Engineer at a tech company with 1,001-5,000 employees

It can be very hard to make a good lab environment with a console with log windows and code bases. What I like about Veracode is that they managed to do that. It has a very responsive graphical user interface and has worked very well. I was very pleased with that.

I like the web interface of the interactive labs and the information there. It's very well done by those who developed it, and it works very well. It's very fun and you get to learn new things and think like an attacker. It's not like on TryHackMe, but the information I got from doing the labs here was information that I didn't have before. The quality of the information was really good.

When I started to use Veracode, there were a lot of policy documents and I actually have a habit of always reading those. I haven't made a list of all the regulations and policies and how well it complies with all the security regulations, but from what I could see, it is aligned with security regulations and certifications. And in the lab environment, they have divided things into different topics like OWASP top-10. That is very actual and follows the security guidelines that are commonly accepted by organizations today.

View full review »
Naushath Raja - PeerSpot reviewer
Senior Director at a tech vendor with 10,001+ employees

Dynamic scanning is the most useful feature.

View full review »
JA
IT Project Manager at Orange España

Among the most valuable features are that

  • its overall user interface is good
  • the static scanning process is wonderful
  • it analyzes vulnerabilities in your source code, which is very helpful
  • it explains very clearly about the vulnerabilities that we have in our code, in terms of security and compliance.

It has the ability to statically scan your source code before it goes to production. It can be scanned within your testing or development environment, and that is very useful. And good explanations of all the vulnerabilities in your source code help take care of those issues in future code implementation as well.

Veracode also has built-in functionality called the Software Bill of Materials. It is very useful if you are arranging the details regarding all your bills of materials within your code and your licensing. Using SBOM it is very easy to create reports. You just click on it and you can easily extract a report.

Veracode provides regular updates to the platform, updates that support rapid changes in technology and our development practices. It provides SAST analysis in the pipeline very quickly so that we can easily identify issues. It can also integrate with different pipelines, DevOps tools, and platforms. It is a highly efficient tool in terms of security vulnerabilities and reporting on them.

It provides an easy way to track flaws, tying them together with an explanation. There is an easy-to-use plugin for Visual Studio for the validation of code without having to do a complete, separate scan. It has the functionality to scan IDE methods.

For compliance reporting, you can configure your organization's data privacy policies and your country's policies. If those policies are breached, it provides you notification that something is not meeting the policies that you have set, so you can easily identify those cases and take corrective measures.

View full review »
Sairam Bathini - PeerSpot reviewer
DevSecOps Engineer at Tata Consultancy

The best feature of Veracode is that we can do static and dynamic scans. Veracode performs software composition analysis, and we can use the solution to download different reports like the summarized report. Veracode’s interface is good.

View full review »
SA
Manager IT at a tech company with 201-500 employees

I believe the static analysis is Veracode's best and most valuable feature. Software composition analysis is a feature that most people don't use, and we don't use SCA for most of our applications. However, this is an essential feature because it provides insight into the third-party libraries we use.

View full review »
JV
Manager Consultant at a tech services company with 1-10 employees

Static code scanning is the most valuable feature. Moreover, Veracode integrates with various frameworks and workflow solutions.

View full review »
Shiva Prasad Reddy - PeerSpot reviewer
Program Analyst at a tech services company with 10,001+ employees

It yields around 90 percent accurate results. It pinpoints the errors. Its accuracy is very interesting. It also elaborates on flaws, meaning it provides you with details about what is valid or not and how something can be fixed.

Another valuable feature is in the dynamic analysis, which provides information on which libraries are outdated so that we can improve them and get them up to date. We found a lot of outdated libraries in use in our organization. As a result, it has improved our stability. The software composition analysis keeps you updated on each kind of data it reports on, including libraries and third-party DLLs.

View full review »
Fiorina Liberta - PeerSpot reviewer
Principal SRE Engineer at AIA Singapore

The most valuable feature is the security and vulnerability part of the solution. It shows medium to high vulnerabilities so we can find them, then upgrade our model before it is too late. It is useful because it automates security. Also, it makes things more efficient. So, there is no need for the security team to scan every time. The application team can update it whenever possible in development. Because we are using the Azure methodology, this helps us make sure that the application team can do it using the proper Azure method. For example, when we are using scrum, the application team can improve this Veracode scan on this scrum methodology. Therefore, if they were going to create a pull request, it would be detected. It would be scanned first before it goes to production or another environment, then they can fix it so we can do development more rapidly.

Our fix rate has increased by 15%. We know that we can update something now or put it in our roadmap to update later on in our application.

View full review »
GG
Technical Program Manager at a engineering company with 10,001+ employees
  • Customer and professional support
  • Live sessions and training
  • The coverage of the last vulnerabilities reported
  • The coverage of the programming languages
View full review »
AR
DevOps Engineer at a consultancy with 10,001+ employees

We use the full code analysis and the recommendations from the Veracode report.

View full review »
AjitMatthew - PeerSpot reviewer
Principal. - Head - IT, Information Security and Admin at a consultancy with 201-500 employees

I find all the features valuable, especially dynamic scanning, static scanning, and software composition analysis.

View full review »
Miodrag Zarev - PeerSpot reviewer
Senior Software Engineer at a tech vendor with 11-50 employees

I like Veracode's integration with our CI/CD. It automatically scans our code when we do the build. It can also detect any security flaws in our third-party libraries. Veracode is good at pinpointing the sections of code that have vulnerabilities. 

View full review »
CD
Vice President QE Practice at a computer software company with 1,001-5,000 employees

The main feature we have been using is the software composition analysis, which provides us with a scoring system in terms of version 3 of the CVS. A lot of vulnerabilities are typically detected, but, at the end of the day, we also want to check how well they are being targeted, based on the Common Vulnerability Scoring system. Not every vulnerability is high-severity, because some of them do have fixes. That particular feature is helpful for us.

It gives you JSON output. When you do agent-based scans, at any point in time, there are multiple check-ins of the code. We have to look at it from the perspectives of how important it is to fix something and when it should be prioritized for fixing. The JSON output from the agent-based scans gives us the CVS core, and that makes things much easier. It's available on the new version of the Veracode SCA agent.

It also has a decent support system for audits. From that perspective, they did a very good job.

View full review »
Chris Sawyer - PeerSpot reviewer
Full Stack Engineer at TCDRS

The dynamic scanning tool is what I like the best. Compared to other tools that I've used for dynamic scanning, it's much faster and easier to use.

View full review »
KA
Cyber Security Consultant at a computer software company with 51-200 employees

The scanning is most valuable. The scans given by Veracode are one of the key features that I like.

The integration with DevOps pipelines is seamless. 

View full review »
GR
System Engineer at a tech vendor with 10,001+ employees

The feature I like most in Veracode is that it clearly specifies the line in the entire file where a vulnerability is found. For example, if there is a vulnerability on line 32 of the demo.java file, Veracode will clearly state that and also tell me the severity of the threat, such as moderate, high, or very high.

View full review »
KW
Founder/Developer at Sarkonah

The static scanning and the analytics are ideal for me. The static analysis gives you deep insights into problems.

And creating a report is easy.

View full review »
David Jellison - PeerSpot reviewer
Senior Director, Quality Engineering at Everbridge

I think the most valuable to us is the policy management, which enables us to create different kinds of policies for different kinds of applications. Veracode policy management also allows us to plan for, track against, and report on our compliance with those different policies.

View full review »
EricOlson1 - PeerSpot reviewer
Application Security Program Manager at a tech services company with 5,001-10,000 employees

I don't have much experience with the solution yet. We're looking at integrating Manual Penetration Testing with JIRA and Bamboo and then building that into a CICD model, so the integration is the most valuable feature so far.

View full review »
FranckGafsou - PeerSpot reviewer
Security Architect Lead at a comms service provider with 10,001+ employees

There are several features which I found most valuable in Veracode Static Analysis. First, it has a user-friendly interface, so it is easy to use.

I also found its reporting features interesting because they give you visibility on the vulnerabilities and the associated risks.

The feature of scanning open source dependencies for vulnerabilities is also very interesting. You have a dependency graph which shows you how your libraries are embedded within your code, so you can also see what kind of dependencies you have from one library to another. This means if you need to upgrade to a free vulnerability version, you can assess the impact on other libraries as well.

There is also a feature that enables you to build your own dashboard. For example, if you want to query the database that is supporting the platform, you can build your own dashboard with some indicators regarding the vulnerabilities, your portfolio, or you can look for a specific type of library or a specific type of risk, and that's interesting when you want to have visibility on your key item. I use this feature often.

View full review »
KB
Sr. VP Engineering at a computer software company with 51-200 employees

With the static component analysis, they scan your code statically and they look specifically at third-party libraries and at any third-party code that you have in your product for vulnerabilities, updates, and changes in licensing. For example, if one of them changed from a license that allowed for more changes on your side to something that is more restrictive, they would flag that for you so that you can evaluate it and know immediately that you need to take some action. They keep abreast of the latest and greatest regarding third-party components. That has been good and very helpful for us to know how secure our product is as a result of using third-party libraries, as we didn't write that code.

The SAST component looks directly at our own code and any best practices we haven't followed and whether there is a security challenge or loophole. We get immense value from that as well. They've been able to flag items and say, "While this is a low-risk item, we would suggest you refactor it or add it to your roadmap to close that loophole, just in case a very clever hacker tries to get around your system. That has been very helpful to us too.

And the SAST is very quick. It sniffs through the product very quickly and almost immediately gives us the results we need. Static analysis is something you do every once in a while, in a very regimented and rigorous way, so you don't need it to be super-duper fast, but you need it to be efficient. You don't want to wait days for them to give you an analysis. And Veracode's static analysis comes back in a very short period of time.

With the DAST, you provide their product with a dynamic instance of your operational product, by pointing the dynamic testing tool at your product. It beats it up, pokes around, and tries to find ways to penetrate its defenses and find security issues and challenges within your product.

Veracode also has a very good report that gives us best practices regarding ensuring compliance, and we can go back to them for additional consulting. We've not had to do that. We typically scan through it and say, "Okay, it's good that it meets those best practices." We rely on them to make sure that their products are kept updated, so that we don't have to review a lot of these standards issues.

Also, as we did our analysis of Veracode, we loved the fact that they are completely integrated into GitHub. You can trigger everything using GitHub Actions. You don't want to go too far out of the application, move something into another repo, and have to write or copy and paste it over. Veracode easily integrated into our GitHub repos.

View full review »
SC
Systems Engineer at Shift movers

Veracode's most valuable aspect is continuous integration. It helps us integrate with other applications so that it can monitor the security process. By continuously scanning our applications, we can mitigate risks that may arise in some workflows. It streamlines compliance, policy management, and reporting on various data analytics. We use it daily to gain insight into our work processes.

The solution is built into our SecOps program. It offers modern policy management, essential support, and analytics features. It's efficient with fast and powerful risk-mitigation tools.

View full review »
SR
Product Marketer at a media company with 1,001-5,000 employees

One cool feature is the static code scan, which is very good. 

Also, the dashboards and the threat insights it provides are very good. The dashboards are intuitive and pretty straightforward, but also pretty detailed.

We get good, actionable insights at each stage, including static, dynamic, and penetration analysis, and it reduces overhead for us. 

It also has compliance monitoring and reporting capabilities that I like very much. The compliance reporting is a great feature because there are a lot of different frameworks and channels, and each unique channel has its individual compliance monitoring and policies. Veracode helps us prepare for all the different challenges.

View full review »
NS
Delivery Manager at a tech vendor with 10,001+ employees

I like Veracode's ease of integration with various cloud platforms and tools. 

View full review »
Rafael Mesquita - PeerSpot reviewer
Full Stack Software Developer at DreamDev

Veracode creates a list of issues. You can go through them one by one and click through to a new window with all the information about the issue discovered.

View full review »
PR
Senior Security Consultant at a financial services firm with 1,001-5,000 employees

The most valuable features of Veracode Static Analysis are its ability to work with GitLab and GitHub so that you can do the reviews and force the code.

View full review »
Anshuman Kishore - PeerSpot reviewer
Director Product Development at Mycom Osi

What I found most valuable in Veracode Static Analysis is that it categorizes security vulnerabilities. My company is mainly worried about security vulnerabilities, so it's beneficial that the tool identifies security-related vulnerabilities.

View full review »
Nathan S - PeerSpot reviewer
VP of Product at a healthcare company with 51-200 employees

The most valuable feature of Veracode Static Analysis is the scanning.

View full review »
Ajit Matthew - PeerSpot reviewer
Sr. Partner IT and Information Security at TheMathCompany

The certification levels are helpful. They are different levels where I think that five is the highest, and we are at level four. Having that badge and showing that we are compliant to that level helps one's reputation in the market.

The interface is easy to use.

View full review »
ST
Engineering Security Manager at Nextiva

With Veracode, it's not about features for us. It is about the pricing model that they offer. To be honest, with their vulnerability database, the total amount of false positives that we're getting is very low. 

That's the main reason we use Veracode over anybody else. New Veracode features could include a very big database of actual vulnerabilities to be better than other products.

View full review »
SM
Security Analyst at a tech services company with 11-50 employees

The SAST and DAST modules are great. The scanning part is also good. It’s pretty easy and convenient to use. Everything is described within the product. Almost everything is available in the community and the guidelines.

View full review »
BahatiAsher Faith - PeerSpot reviewer
Software Developer at Appnomu Business Services

IDE Scan is the most important feature, and then you have SCA and Platform Scan.

I like the fact that it can be used at any stage of application development. I use scanning with a particular piece of code. There is an extension that helps me to create my code easily in Visual Studio and then find flaws before deploying the code. It's definitely benefiting me and the organization. It's so quick and easy to create a code and then deploy it live.

It's easy to create reports. It works very well. It's straightforward, and it does not require a lot of time. It's a straightforward platform that you can use for performing scans or mitigating issues. It has a very good user interface. FAQs are also helpful in case you are not familiar with it. It's good and straightforward when you integrate it with machine learning platforms.

View full review »
SP
Software development program leader at Vendavo

The static scan is the feature that we use the most, as it gives us insight into our source code. We have it integrated with our continuous integration, continuous delivery system, so we can get insight quickly. We're doing scans daily, so that's the most important feature for us.

The interface is great. It allows us to look at our different applications, understand all of the different types of scans, as well as the results. The types of testing include SAST, DAST, and SCA, and it pulls all of the information together into a single view. It also produces reports that we can give to our customers when requested.

Veracode certainly provides a quick and intuitive way to understand the results, to see the context of them, and to identify what we need to do to address them. In general, it's a pretty quick way to get the information that we need in the most useful way possible. Then, we can turn around an action plan.

We have it integrated with our build pipeline and that works well. It's very important because we don't have to complete a separate, manual step of sending the software up to Veracode to scan it and get the results. It's great. the more things that we can integrate into the build pipeline, the better. It's a very positive thing.

Veracode is very good in terms of not having a lot of false positives. It would be very frustrating if a tool gave you 10 good results but 50 false positives. Even with the issues that we get that we choose not to address, we can still understand why they're being flagged. We have found that the results are meaningful and accurate, which gives us confidence in the solution when fixing vulnerabilities. 

We may choose not to address them for different reasons. For example, it could be because it's an issue about input sanitization, but we have another layer on top of that component to handle that task. We can recognize that it's important that Veracode is flagging those things at that lower level, and that they're bringing that additional insight and consideration to the designs that we're choosing. Overwhelmingly, even the issues we choose not to address are still valuable and meaningful, so the actual false positive rate is quite low.

This is a very useful and powerful tool that ensures our code is well-designed and correctly implemented. It is important that it's only one aspect of a security program and not the only insight or the only test. That said, it provides us with some pretty important feedback and insights that we wouldn't have a great way to get otherwise.

View full review »
SM
Principal for the Application Security Program and Access Control at a engineering company with 10,001+ employees

The SCA, which detects vulnerabilities in third-party and open source libraries, was something new for us and is very well done. It provides guidance for fixing vulnerabilities. 

View full review »
Deepak Naik - PeerSpot reviewer
Chief Security Officer at Digite

The static code analysis, which is integrated into the CI/CD environment, is a valuable feature. We get quick results of what has gone into the environment in terms of any vulnerability in the code and for the Eclipse plugins of Veracode. This is one of the more valuable features because a developer can get a sense at the line level if there are any issues. 

View full review »
DC
Chief Technology Officer

Certainly it eases integration into our workflow. Veracode is part of our Jenkins build, so whenever we build our software, Jenkins will automatically submit the code bundle over to Veracode, which automatically kicks off the static analysis. It sends an email when it's done, and we look at the report.

Once it's set up - and it's pretty easy to set up - it pretty much just works and I don't really have to think about it, outside of whenever I get my emails to look at the reports.

It was a very easy integration that we did within the first week of going live with the software.

So ease of use, ease of integration.

View full review »
Pradeep Kumar. - PeerSpot reviewer
Founder and Director at Bizcarta Technologies India Pvt Ltd

Veracode provides guidance to develop secure software. It is one of the valuable features.

View full review »
‌B
Senior software engineer at a tech services company with 1,001-5,000 employees

The most valuable feature is the static scan that checks for security issues. We use Veracode for this purpose; we also use the solution for our UI, but for the backend, we only use the static scan. I'm not sure what it is called, but it is one of two scans, the other one being dynamic. We only use the static scan to identify any security issues.

Veracode assists in the prevention of vulnerable code from reaching production by providing a comprehensive review of security risks and comprehensive reports with thorough descriptions of the vulnerabilities. This allows us to address any security gaps in the release. Based on the severity, we should determine the standards for release. We should not have any security issues with a severity of medium or higher before releasing.

Veracode provides us with ultimate visibility concerning security issues. Additionally, we use OWASP, which checks our dependencies to identify any potential weaknesses, but Veracode is the only tool we use to check our source code. With Veracode, we have the capability to recognize any security issues in our source code.

View full review »
Anshuman Kishore - PeerSpot reviewer
Director Product Development at Mycom Osi

We have found the static analysis to be useful in Veracode Static Analysis. However, we are in the process of testing.

View full review »
VD
Lead Security Architect at a comms service provider with 1,001-5,000 employees

It is a cloud-based platform, so every organization or every security team in the organization is concerned about uploading their code because ultimately the code is intellectual property. The most useful thing about Veracode is that if you want to upload the code, they accept only byte code. They do not accept the plain source code as an input. The code is converted into binary code, and it is uploaded to Veracode. So, it is quite secure. It also has the automation feature where you can integrate security during the initial stages of your software development life cycle.

Veracode provides integration with multiple tools and platforms, such as Visual Studio, Java, and Eclipse. Developers can integrate with those tools by using Jenkins. The security consultation or the support that they provide is also really good.

Its user management is also good. You can restrict the users for a particular application so that only certain developers will be able to see the code that has been scanned. 

Their reporting model is really good. For each customer, they provide a program manager. Every quarter, they have their reviews about how much it has scanned. They also ensure that the tool has been used efficiently. 

View full review »
OK
Development Manager at a computer software company with 1,001-5,000 employees

Considering that in my project, we are mostly using Software Composition Analysis as a part of Static Code Analysis, for me, the main part is reporting and highlighting necessary vulnerabilities. Veracode platform has a rather good database of different vulnerabilities in different libraries and different sources. So, finding vulnerabilities in third-party libraries is the main feature of Software Composition Analysis that we use. It is the most important feature for us.

View full review »
reviewer1360617 - PeerSpot reviewer
Sr. Security Architect at a financial services firm with 10,001+ employees

Being cloud-based is a huge plus. All of our scans are always using up-to-date scan signatures and rules, and there is nothing for us to maintain.  Veracode has been spot-on with notifying about planned downtimes for maintenance and upgrades.  In my years of using the product, unplanned downtimes have been minimal (in fact I can't remember one.)

The API integration that allows integration with other tools, such as defect trackers and automated build tools, is also a benefit. We also like the integrated, available "in-person" support sessions to review and ask questions on discovered defects.

View full review »
RB
Senior Security Analyst at a wellness & fitness company with 1,001-5,000 employees

Greenlight - Developers can test their code before they commit. They are able to privately scan their code and correct any mistakes before it is committed into the build and scanned with the other components.

SAST - During a build process, we have integrated the Veracode Static Scanning (SAST) component which provides an excellent first glance at the code moving through environments.

SCA /SourceClear - Veracode SCA / Source Clear has given us excellent visibility into potential vulnerabilities found in third-party components, packages, frameworks, and libraries.

View full review »
AF
Cloud system engineer at a consultancy with 1-10 employees

The automation of Veracode is great because we no longer have to run manual testing. 

The weekly report logs are great because we can address any vulnerability issues that are detected quickly.

Veracode runs comprehensive scans and links the vulnerable code to the weekly reports identifying what services are affected and forecasting the next steps.

View full review »
LF
Sales Engineer at a computer software company with 51-200 employees

All features are valuable. I especially like SAST and ADO.

It is scalable and quick to deploy into the site and the pipelines. The reports and analytics are good, and the false positive rate is low. It gives true results.

View full review »
SM
Sponsorship Sales Specialist

The main feature, and one of the most important, is the static code analysis. We are able to complete an analysis of the security flaws with this platform. It's very good at helping us find and fix flaws.

The sandbox environment is also one of the features we are using as well as integration with our CICD pipeline, which is very useful. The product is pretty easy to understand, which is quite good.

The policy reporting for ensuring compliance with industry standards and regulations also helps us a lot.

It gives us visibility into application status at every phase. We have definitely seen an improvement in that regard.

View full review »
Calinescu Tudor - PeerSpot reviewer
Security Project Leader at ATOSS AG

The most important thing that we have used Veracode for is the static application testing. That was our main target.

View full review »
KE
Cybersecurity Executive at a computer software company with 51-200 employees

The visibility into application status helps reduce risk exposure for our software. Today, any findings provided by the DAST are reviewed by the developers and we have internal processes in place to correct those findings before there can be a release. So it absolutely does prevent us from releasing weak code.

View full review »
NS
Automation Practice Leader at a financial services firm with 10,001+ employees

The valuable features are the static analysis and the dynamic analysis. The security is also a good feature.

View full review »
NS
Lead Cyber Security engineer at a manufacturing company with 10,001+ employees

There have been a lot of benefits gained from Veracode. Compared to other tools, Veracode has good flexibility with an easy way to run a scan. We get in-depth details on how to fix things and go through the process. They provide good process documents, community, and consultation for any issues that occur during the use of Veracode.

SCA enables developers to write secure code from the start. During the development process, we run the scan. If any threats or vulnerabilities occur, we make sure to fix them, then rerun the scan. Then, we move to production. We have all the applications of our organization on Veracode using CI for our pipeline.

We use the Static Analysis Pipeline Scan, and it provides a good benefit for our developers. Previously, we didn't have any of these kinds of tools within the organization. We were using a code quality tool, but Veracode also gives us code quality. It also detects the vulnerabilities within the application, which makes sure the quality of the application is treated well. Therefore, I can give it a rating of four and a half out of five.

View full review »
DM
IT Cybersecurity Analyst at a educational organization with 11-50 employees

One of the features they have is Software Composition Analysis. When organizations use third-party, open source libraries with their application development, because they're open source they quite often have a lot of bugs. There are always patches coming out for those open source applications. You really have to stay on your toes and keep up with any third-party libraries that might be integrated into your application. Veracode's Software Composition Analysis scans those libraries and we find that very valuable.

We like their Dynamic Analysis as well. They changed the engine of the Dynamic Analysis and it does a better job. It scans better.

We use the solution’s Static Analysis Pipeline Scan. It's really good for assessing security flaws in the pipeline. Sometimes my developers have a hard time understanding the results, but those are only certain, known developers in my organization. I typically direct them to support, especially if I cannot answer the question, because I have full confidence in that process. 

The speed of the static scan is good. Our bread and butter application, which is our largest application, is bulky, and it's taking four hours. That's our baseline to compare the Static Analysis Pipeline and its efficiency. If that's only taking four hours, I have no doubt about our other applications and the solution's static analysis efficiency.

The solution’s policy reporting for ensuring compliance with industry standards and regulations is really good as well. We're a state agency and we always look to be NIST compliant. We're always looking at the OWASP and CWE-IDs, and Veracode does a really good job there. I've used it often in trying to get my point across to the developers, telling them how bad a vulnerability might be or how vulnerable the application is, based on a vulnerability we may be finding. 

View full review »
CG
Enterprise Architect, VP at a financial services firm with 501-1,000 employees

One of the best things about the solution is that I think it is kind of easy to get started using it. The pain of adoption is low. Once you got the code scanned, there is a lot of information that you have to plan time to go through and work with other teams to get things resolved or disposition.  

I think that it was easy to get started, but there was also definitely a learning curve in terms of people needing to understand what the reports meant and what to do about the information that they were getting.  

View full review »
VR
Solution Architect at a tech vendor with 10,001+ employees

The static scan and the detailed reports, which include issue information and permissions, are the most valuable features.

View full review »
SR
Manager, Information Technology at Broadcom Corporation

The most valuable feature, from a central tools team perspective, which is the team I am part of, being a DevSecOps person, is that it is SaaS hosted. That makes it very convenient to use. There is no initial time needed to set up an application. Scanning is a matter of minutes. You just log in, create an application profile, associate a security configuration, and that's about it. It takes 10 minutes to start. The lack of initial lead time or initial overhead to get going is the primary advantage. 

Also, because it's SaaS and hosted, we didn't have any infrastructure headache. We didn't have to think about capacity, the load, the scan times, the distribution of teams across various instances. All of this, the elasticity of it, is a major advantage.

There are two aspects to it. One is the infrastructure. The other one is the configuration. There are a lot of SaaS solutions where the infrastructure is taken care of, but the configuration of the application to start scanning takes some time to gain knowledge about it through research and study. That is not the case with Veracode. You don't have any extensive security profiles to consider. It's a two-pronged advantage.

Veracode also reports far fewer false positives with the static scanning. The scanner just goes through the code and analyzes all the security vulnerabilities. A lot of scanning tools in the market give you a lot of false positives. The false positive rate in Veracode is notably less. That was very helpful to the product teams as they could spend most of their time fixing real issues.

Veracode provides guidance for fixing vulnerabilities and that is one of their USPs—unique selling propositions. They provide security consultations, and scheduling a consultation is very easy. Once a scan is completed, anybody who has a Veracode login can just click a button and have a security consultation with Veracode. That is very unique to Veracode. I have not seen this offered in other products. Even if it is offered, it is not as seamless and it takes some time to get security advice. But with Veracode, it's very seamless and easy to make happen.

Along those lines, this guidance enables developers to write secure code from the start. One of the advantages with Veracode is its ability to integrate the scanning with the DevOps pipeline as well as into the IDEs of the developers, like Eclipse or IntelliJ or Visual Studio. This type of guidance helps developers left-shift their secure-coding practices, which really helps in writing far better secured product.

Another unique selling point of Veracode is their eLearning platform, which is available with the cloud-hosted solution. It's integrated into the same URL. Developers log into the Veracode tenant, go through the eLearning Portal, and all the courses are there. The eLearning platform is really good and has helped developers improve their application security knowledge and incorporate it in their coding practices.

One of the things that Veracode follows very clearly is the assignment of a vulnerability to the CWE standard or the OWASP standard. Every vulnerability reported is tied to an open standard. It's not something proprietary to Veracode. But it makes it easy for the engineers and developers to find more information on the particular bug. The adherence to standards helps developers learn more about issues and how to fix them.

We use the Static Analysis Pipeline Scan as part of the CI pipeline in Jenkins or TeamCity or any of the code orchestrators that use scanning as part of the pipeline. There's nothing special about the pipeline scan. It's like our regular Veracode Static Analysis Scan. It's just that if it is part of the pipeline, you are scanning more frequently and finding flaws at an earlier point in time. The time to identify vulnerabilities is quicker.

Veracode with the integrated development environments that the developers use to write code, including Microsoft Visual Studio, Eclipse, IntelliJ IDEA, etc. It also integrates with project and portfolio management tools like JIRA and Rally. That way, once vulnerabilities are reported you can actually track them by exporting them to your project management tools, your Agile tools, or your Kanban boards. The more integrations a scanning tool has, the better it is because everything has to fit into the DevOps or DevSecOps pipeline. The more integrations it has with the continuous integration tools, the IDEs, and the product management tools, the better it is. It affects the adoption. If it is a standalone system the adoption won't be great. The integration helps with adoption because you don't need to scan manually. You set it up in the pipeline once and it just keeps scanning.

View full review »
KM
Information Assurance Manager at xMatters

All of its features are valuable to us. We are ISO certified and we also do annual SOC 2 audits. We deal with personal, identifiable information and we host confidential information from our clients. Our use of Veracode is based on our clients' requirements and on ISO requirements. It is something that we have in place to comply with what is required. In that context, the manual penetration test is a requirement from all our clients and we do it once a year.

In terms of secure development, the SAST scan is very useful because we are able to identify security flaws in the code base itself, for the application. The dynamic scanning is mostly used to make sure that whatever is deployed to production is secure.

Veracode provides guidance for fixing vulnerabilities. This doesn't enable developers to write secure code from the start, but Veracode provides guidance through security consultants. We can book consultations in case developers cannot fix a specific flaw, and they guide us through the process based on the CWE.

The efficiency of the solution when it comes to creating secure software is good. For us, it works well. Their dashboard is really good, overall. In my opinion, it's one of the best in the market, and I say that because we have used other service providers.

Its policy reporting for ensuring compliance with industry standards and regulations is very helpful. We can create our own policy, based on our internal risk management guidelines, and run the scans against our own customized policy. That way we can set expectations to fix flaws based on our internal timeline, and we can issue reports based on that. We usually share those reports with clients. That's very useful.

They are also always updating the types of threats and that's very useful.

In addition, they provide analytics on how we're doing in terms of fixing flaws and mitigating issues.

All of the services that Veracode provides are necessary for the type and the level of security and confidentiality that we need.

View full review »
AS
DevSecOps Consultant at a comms service provider with 10,001+ employees

There are quite a few features that are very reliable, like the newly launched Veracode Pipelines Scan, which is pretty awesome. It supports the synchronous pipeline pretty well. We been using it out of the Jira plugin, and that is fantastic. 

We are using the Veracode APIs to build the Splunk dashboards, which is something very nice, as we are able to showcase the application security hygiene to our stakeholders and leadership. 

We have been using Veracode Greenlight for the IDE scanning. 

Veracode has good documentation, integrations, and tools, so it has been a very good solution. 

Veracode is pretty good about providing recommendations, remedies, and guidelines on issues that are occurring.

It is an excellent solution. It finds a good number of the securities used, providing good coverage across the languages that we require at our client site.

We have been using the solution’s Static Analysis Pipeline Scan, which is excellent. When we started, it took more time because we were doing asynchronous scans. However, in the last six months, Veracode has come with the Pipeline Scan, which supports synchronous scans. It has been helping us out a lot. Now, we don't worry when the pentesting report comes in. By using Veracode, the code is secure, and there are no issues that will stop the release later on in the SDLC. 

The speed of the Pipeline Scan is very nice. It takes less than 10 minutes. This is very good, because our policy scans used to take hours.

Veracode is good in terms of giving feedback.

View full review »
ST
Associate Director

It has several components in that help you identify abilities in the core. It also provides security of different Shadow IT activities in our environment, especially around application development and website hosting.

View full review »
SN
SVP Application Security at a financial services firm with 10,001+ employees

The most valuable feature is the remediation consulting that they give. I feel like any vendor can identify the flaws but fixing the flaws is what is most important. Being able to have those consultation calls, schedule them in the platform, and have that discussion with an applications expert, that process scales well and that is what has allowed a lot more reduction of risk to happen.

View full review »
CS
Executive Assistant at a tech company with 51-200 employees

Veracode offers various security features. Veracode performs the analysis using three different methods: static analysis, dynamic analysis, and software composition analysis. These security features are the best, and the most valuable features.

View full review »
FN
Application Security Engineer at a financial services firm with 1,001-5,000 employees

The static scan module is the most valuable. 

View full review »
HM
DevOps Engineer at Barclays Technology

The best feature is definitely the detailed reports. It provides code-related queries in the order of high, medium, and low depending on what we need to do. Veracode is user-friendly as well.

It provides all the details to prevent vulnerable code from going into production. The Veracode scanning report shows where we need to create security and how to encrypt usernames, passwords, or other details. It's very helpful from an application security perspective.

With this solution, we have visibility into application status at every phase of development including static analysis, dynamic analysis, software composition analysis, and manual penetration test throughout our SDLC. It is helpful for our DevSecOps processes because we get all the details before going into production. We can then talk with the design team and developers to fix any issues before going live.

Veracode helped to improve our ability to fix flaws.

It also saved our developers' time by 50% to 60%. Before going live, we always integrate Veracode with our application's bill pipeline. Instead of resolving issues once it is live, we can fix them beforehand.

View full review »
RL
Security Architect at a financial services firm with 1,001-5,000 employees

Among the most valuable features are the ability to 

  • submit the software and get automated scan results from it
  • collaborate with developers through the portal while looking at the code
  • create compliance reports.

Otherwise, we would have to do working sessions with developers and pull together all the different findings and then probably manage it in a separate mechanism like Excel. And to have to go through source code manually would be quite time intensive and tedious.

The solution also provides you with some guidance as well as best practices around how vulnerabilities should be fixed. It points you in that direction and gives the developers educational cues.

In addition, the policy reporting for ensuring compliance with industry standards and regulations is pretty comprehensive, especially around PCI. If you do the static analysis, the dynamic analysis, and then a manual penetration test, it aggregates all of these results into one report. And then they create a PCI-specific report around it which helps to illustrate how the application adheres to different standards.

The solution also integrates with developer tools such as Visual Studio and Eclipse.

View full review »
Product Security Engineer at a tech services company with 5,001-10,000 employees

We recently started working with pipeline scanner, which is quite useful. In Veracode, you need to import zip files for the source code. With the pipeline scanner, it's easier for developers to scan their products, as they can do everything via command line. When a scanner detects a flaw, it also generates a good explanation about that flaw and good references for mitigation. That's also very useful for us.

View full review »
DJ
Senior Director, Quality Engineering at a tech services company with 1,001-5,000 employees

Multiple "Policy" profiles can be created to apply differently to different classifications of applications that include grace periods per severity. I find this a great way to manage team expectations and regulatory compliance on a per-scan and time-period cycle, leading to self-service compliance remediation.

The dependency graph visualization provides the ability to see nested dependencies within libraries for pinpointing vulnerabilities.

The Vulnerable Methods feature helps with sorting through those vulnerabilities that matter to my application codebase.

View full review »
HJ
Sr Director at a non-profit with 51-200 employees

The feature that was most valuable to us was the ability to point locally in a quorum.

View full review »
VS
Senior Manager Cyber Security at a tech services company with 201-500 employees

Static Scanning is the most valuable feature of Veracode.

View full review »
RR
Founder & CEO at a healthcare company with 1-10 employees

Veracode is fantastic! All of the features are valuable.

My experience with Veracode across the board every time, in all products, the technology, the product, the service, and the salespeople are fabulous. They are engaging.

View full review »
AB
Principle Consultant at a tech services company with 11-50 employees

SCA provides guidance for fixing vulnerabilities. It provides extensive guidance for both writing secure code and pointing to vulnerable open source libraries are being used.

From the time it takes for the solution to detect a vulnerability, both in the source code and the open source library, it is efficient. 

Within SCA, there is an extremely valuable feature called vulnerable methods. It is able to determine within a vulnerable library which methods are vulnerable. That is very valuable, because in the vast majority of cases where a library is vulnerable, none of the vulnerable methods are actually used by the code. So, if we want to prioritize the way open source libraries are updated when a library is found vulnerable, then we want to prioritize the libraries which have vulnerable methods used within the code. 

The Static Analysis Pipeline Scan is faster than the traditional scan that Veracode has. All Veracode products are fast. I have no complaints. On average, a piece of code for a customer takes 15 to 20 minutes to build versus the Static Analysis Pipeline Scan of Veracode that takes three or four minutes. So, that is 20 to 30 percent of the total time, which is fairly fast.

View full review »
it_user831864 - PeerSpot reviewer
Application & Product Security Manager at a insurance company with 1,001-5,000 employees

Static analysis scanning engine, because we need to do static analysis; that’s why we bought the product.

View full review »
MT
Software Architect at Alfresco Software

The feature that we use the most is the static analysis, by uploading the artifacts. We have two types of applications. They are either Java Server applications using Spring Boot or JavaScript frontend applications. We scan both using the static analysis. Before, we used to do the software composition on one side and the static analysis. For about a year now, we have had a proper security architect who's in charge of organizing the way that we scan for security. He suggested that we only use the static analysis because the software composition has been integrated. So in the reports, we can also see the version of the libraries that have vulnerabilities and that need to be upgraded.

It is good in terms of the efficiency of creating secure software.

My team only does cloud-native applications. Ultimately, the part that we are interested in, in testing, works fine.

There are some false positives, like any products that we have tried in this area, but slightly less. I would trust Veracode more than the others. For example, we had quite a few issues with Snyk which was much worse in terms of false positives, when we tested it for open source.

Also, the solution's ability to prevent vulnerable code from going into production is perfectly fine. It delivers, at least for the reports that we have been checking on Java and JavaScript. It has reported things that were helpful.

View full review »
MS
Executive Director at Parthenon-EY
  • Multiple languages and framework support: We can use one tool for our SAST needs.
  • Developers report liking the IDE integration provided by this tool.
View full review »
it_user873351 - PeerSpot reviewer
CISO at Laboratory Corporation of America Holdings

Veracode helps me in several implementations over a couple of industry sectors in a number of ways.

My coding, especially the code we develop, has a number of faults per line and that costs me money and time to fix those, into the lifecycle. Veracode enables me to provide better code, faster, so my time to market is less.

The security means my total cost of ownership goes down significantly over a period of time. The more code I write, the better I organize that, the less my expense is in maintaining that code.

View full review »
it_user836430 - PeerSpot reviewer
Senior Infrastructure Engineer at a healthcare company with 5,001-10,000 employees

The most important features, I would say, are the scanning abilities and the remediation abilities within the product. Scanning because, obviously, we want to make sure that our application code is flaw-free. And the remediation tools are helpful to the developers to help them track and manage their flaws.

We have been able to integrate Veracode through many of the IDEs that our developers use, using the Veracode APIs, or they've been actually been doing this manually as part of their SDLC.

View full review »
it_user778905 - PeerSpot reviewer
Technical Director at a financial services firm with 1,001-5,000 employees
  • Completeness, comprehensiveness
  • speed
  • ease of use

We have such a wide variety of users for Veracode, including security champions, development leads, developers themselves, that the ease of use is really quite important, because we don't assume anything about what those people might already know, or need to know. It just makes it very useful for anyone who has to engage with it.

View full review »
YT
R&D Director at a computer software company with 201-500 employees

It is faster to adopt and use because it's a SaaS software. As a service tool, we didn't have to deal with any installation emails. We also didn't have to download packages, upgrade, or maintain their on-prem machine, which is usually the case for on-prem solutions. This is a critical point that we needed to consider when adopting the right tool. So, SaaS was a deal breaker for us. 

I don't have any complaints about the policy reporting for ensuring compliance with industry standards and regulations. It is good and a mandatory part of our process.

View full review »
Christian Camerlengo - PeerSpot reviewer
Senior Programmer/Analyst at a financial services firm with 10,001+ employees

The reporting being highly accurate is pretty cool. I use another product and I was always looking for answers as to what line, which part of the code, was wrong, and what to do about it. Veracode seems to have a solid database to look things up and a website to look things up. We've had very few issues that we have actually had to contact Veracode about.

It does give some guidance, up to a point, for fixing vulnerabilities. It does a pretty good job of that. We went from a bunch of errors to a handful that I needed help with, and that was mostly because they provided some good information for us to look at. If I had been using this product a long time ago, I would have been able to anticipate a lot of things that Veracode discovered. The product I'm working on is about 12 years old and this was the first time we ran scans on it using Veracode. It identified quite a few issues. If you're starting a new project, it would be a good place to start. Once you get used to what people like penetration testers are looking for, this is a good tool to prevent having a pen test come back bad.

The Static Analysis Pipeline Scan is very good. It found everything that we needed to fix.

View full review »
MV
Cybersecurity Expert at PSYND

The most valuable feature is actually the support provided by Veracode. Once you start to use the platform, you can mount the IDE plugin for your script. The advantage is that you can run the scan and check what the problem is and you can fix it yourself. Support could be used to address something that could go beyond your skills. If you use Veracode Greenlight, you have a small pop-up that you can use to interact directly with the team and you can ask a consultant to advise how an issue can be fixed. One of the good things about the Greenlight plugin is that it is very simple. There are several guides that tell you how to install it. It's a matter of one or two minutes and you are ready to go.

Once you check something, they provide links, not manually, it's all automated. When you want to check into a vulnerability you click and open the website where there is a description. If this is not enough of an answer, you can ask directly by scheduling an appointment with a Veracode guy.

Another feature of Veracode is that they provide e-learning, but the e-learning is not basic, rather it is quite advanced. They don't teach you how to develop in Java, Python, PHP or C#, but they instruct you about the best practices that should be adopted for secure code developing and how to prevent improper management of some component of the code that could lead to a vulnerability. The e-learning that Veracode provides is an extremely good tool. And as far as I know, there are no other competitors that offer it.

The best stuff is the training: this enables your team to adopt the same programming approach, although these people have a different background or joined the projects in a different phase. Doing that, they can take the training and be aligned so that they all write code in a good way.

We also use the Static Analysis Pipeline Scan and it's quite good. They provide several of the most common templates for pipelines. You see the process, while you program, right up until you package an application, and that the platform is able to detect things that are a blocking point. Before deploying to the production, you already know what is doing. And the speed of the Pipeline Scan is quite good.

Another good feature is the policy reporting for ensuring compliance with industry standards and regulations. We test compliance for medical devices, for GDPR, and for payment methods. These are all good. If you are not correctly prepared on one of these sets of regulations, you know that Veracode is going to take care of it using pre-prepared templates. But we can also customize our own policy if we are facing a unique use case. Even if it's not really common, we can take a regulation and build it the way we want it to look.

In addition, you can check everything from the dashboard. Veracode provides a web portal that is connected with your account and through that you can check the status of all the deployments that were run. And suppose you also have an application that is quite complex. You can deploy and upload it through the portal. When it is ready, you receive a notification from the portal that the job has been done and that you can check the results. When you go to the dashboard, you have the OWASP vulnerabilities. There is a really simple graphic with the colors showing how many vulnerabilities have been found and how much these vulnerabilities are repeated in your code. It also tells you the potential effect, if it is a backdoor data breach, for example, etc. It also suggests what you can do to remediate. It might suggest modifying code or changing the status of some part of the development, or updating a third-party.

And if you have people on different projects, there is also a role management feature, so you can select, for example, that people who are working on a given project can only see that project. If you are running something with different levels of classifications, for example, if you have an external consultant, it does not affect the confidentiality of the system. When people are collaborating, not all people are at the same level of an NDA. It is good that each person can see only their part implementing Need-To-Know.

It also integrates with developer tools. We use IntelliJ and Eclipse, among others.

View full review »
SH
Chief Information Security Officer with 501-1,000 employees
  • Having the option of static scanning. Most tools of this type are centered around dynamic scanning. Having a static scan is very important.
  • Utilizing the software as a service. We do the scanning of the compiled code ourselves but it's on their servers, which is a plus.
  • Technical support is available if needed and that is advantageous.
  • Having online education and training is also advantageous. 
View full review »
SK
Director Software Engineering at a tech services company with 51-200 employees

All the features provided by Veracode are valuable.

View full review »
DA
DevOps and Cloud Architect at a hospitality company with 1-10 employees

Veracode can emulate the most sophisticated attack and create unique or specific use cases around automatic penetration testing. It gives us the ability to investigate any sensitivities to vulnerabilities that we may have.

View full review »
BM
Assistant Vice President of Programming and Development at a financial services firm with 501-1,000 employees
  • Code analysis tool to help identify code issues before entered into production.
  • Vulnerability Management and mitigation recommendations help with resolution of issues found, prior to deployment to production.
  • Developer Sandboxes help move scanning earlier within the SDLC.
  • The platform itself has a lot of AppSec best practices information, especially in the mitigation recommendation process. They have also offered cybersecurity e-learning for our team. 
View full review »
it_user779082 - PeerSpot reviewer
Senior Information Security Program Manager at a financial services firm with 10,001+ employees
  1. The ability on static scans to be able to do sandbox scans which do not generate metrics.
  2. Gives us every vulnerability that has been identified, so there is no human intervention. Therefore, we can actually look and prioritize our own vulnerabilities as opposed to having someone else try to get in between.
View full review »
Jesus Montes Ceron - PeerSpot reviewer
Architect of solutions at IPComMx

The coverage of backdoors attacks on security that's the most valuable for my clients.

View full review »
JS
Senior Software Developer at a pharma/biotech company with 201-500 employees

The analysis of the vulnerabilities and the results are the most valuable features.

View full review »
it_user673734 - PeerSpot reviewer
Chief Technology Officer at a tech vendor with 201-500 employees

It has an easy-to-use interface.

View full review »
EP
Professor at BitBrainery University
  • Dynamic analysis of on-premises applications using the Veracode proxy module.
  • Static analysis of applications, on which I share property with third-parties.
View full review »
it_user866175 - PeerSpot reviewer
Information Security Engineer Team Lead at a hospitality company with 1,001-5,000 employees

The reporting and mitigation features which allow our people to work on their own.

View full review »
it_user797976 - PeerSpot reviewer
Global Application Security at a pharma/biotech company with 10,001+ employees

The Static and Dynamic Analysis capabilities are very valuable to us. 

View full review »
it_user797976 - PeerSpot reviewer
Global Application Security at a pharma/biotech company with 10,001+ employees

It has the ability to scale, and the fact that it doesn't produce a lot of false positives.

View full review »
RO
IT security architect at a consumer goods company with 10,001+ employees

The main feature that I have found valuable is the solution's ability to find issues in static analysis. Additionally, there are plenty of useful tools.

View full review »
SS
Head Of Information Security at a media company with 51-200 employees

The most valuable features are that you can do static analysis and dynamic analysis on a scheduled basis and that you can push the findings into JIRA.

Static Analysis Pipeline Scan was able to find security defects in the software we were sending its way. For both Android and iOS that worked very well. It did have a lot of false positives though, but at least we knew it was working. The speed of the pipeline scan was completely reasonable. I don't have any complaints about the time it took.

View full review »
EC
AVP, IS Manager at a financial services firm with 1,001-5,000 employees

The identification of flaws.

View full review »
it_user854784 - PeerSpot reviewer
Director Security and Risk OMNI Cloud Operations at a tech vendor with 1,001-5,000 employees
  • The static scanning of the software is very important to us.
  • The ability to set policy profiles that are specific to us. 
  • The software composition analysis, to give us reports on known vulnerabilities from our third-party components.
View full review »
it_user335091 - PeerSpot reviewer
Senior Security Consultant at a retailer with 1,001-5,000 employees

Static code analysis is a valuable feature.

View full review »
MW
Managing Director at Harrods

The solution provides the capability for the application teams to track remediation and the handling of identified vulnerabilities. The system provides workflow capabilities for the application teams to send the completed scans to the security teams for their review. In addition, the security team can track the remediation and risk acceptance statistics.

View full review »
it_user842937 - PeerSpot reviewer
Systems Architect at a tech vendor with 201-500 employees

The most important one is the static scanning analysis, and the reason is that it can tell us vulnerability in that code, right before we go ahead and push something to production or provide something to a client.

We pair that with dynamic scanning, which actually hits our Web applications, to try to detect any well-known Web application vulnerabilities as well. It's really just a way for us to stay ahead of it and provide some assurances and security with the software that we deliver.

Also, Veracode has a nice API that they provide to allow for custom things to be built, or automation. We actually have integrated Veracode into our software development cycle using their API. We actually are able to automatically, every time a new build of a software is completed, submit that application, kick off a scan, and we get results in a much more automated fashion. So the API is a huge thing that we use from Veracode, in addition to those two types of scans.

In terms of integrating Veracode into our existing software development life cycle, we heavily use JIRA today for bug tracking issues, time management, and the like, for our development team. When those scans kick, Veracode integrates back into our JIRA and actually open tickets with the appropriate development teams. We can use that as a measurement of vulnerabilities opened, closed; we can tie them to releases. So, we get a whole lot more statistical information about security in our software products. That's really what we use in measuring there, the integration back to JIRA in issues found.

View full review »
it_user877104 - PeerSpot reviewer
VP Worldwide Delivery Acceleration at a financial services firm

Because it is a SaaS offering, I do not have to support the infrastructure.

View full review »
it_user854049 - PeerSpot reviewer
Chief Compliance Officer at a financial services firm with 51-200 employees
  • Ad-hoc scanning during the development cycle
  • Reports for audits

In terms of integrating Veracode into our existing software development lifecycle, there are regular milestones in the SDLC to perform Veracode scans.

View full review »
it_user873348 - PeerSpot reviewer
VP at a non-tech company with 11-50 employees

For us, it's the partnership. We have always been very strong partners with Veracode. They provide excellent training to our sales team, so we are able to work with our customers to show them the value of secure code training.

View full review »
HB
Software Engineer at a tech services company with 1,001-5,000 employees

The most valuable features are the application analyses: 

  • Static Analysis
  • Dynamic Analysis
  • SCA, the software composition analysis, to scan all the models together. 

These are the three features we've mostly been using.

It is easy to use for us developers. It supports so many languages: C#, .NET Core, .NET Framework, and it even scans some of our JavaScript. You just need the extension to upload the files and the reports are generated with so much detail. 

You can detect which line is causing the issue and it gives you some insights about, for example, if you have a dependency problem in your inputs or some known vulnerabilities. It even gives you an article so that you can read about it and know how to mitigate it in some cases. Sometimes there are well-known flaws in third-parties and you should upgrade to another version to resolve your issues. Veracode guides you.

I haven't tried any other platforms, but from what I have seen, it is really fast. You just upload the files, which is easy to do, and you can follow the scanning progress on the platform. Once it's done you get an email and you just access the platform. I don't know what other tools are like, but for me, Veracode is user-friendly.

View full review »
it_user873345 - PeerSpot reviewer
Cyber Security Engineer at a consumer goods company with 1,001-5,000 employees

For me, at the program manager level, I'm not a developer. What I do is run applications through a security program. What's important for me, from Veracode, is the all-in-one metrics location. I can see where everything is across the entire portfolio of applications I have in this program, and I can report out on it. That is one of the more important pieces for me, at the compliance level.

View full review »
it_user846645 - PeerSpot reviewer
VP Development

We just use the static scan, it's all we got into as of now. We're happy with that, it seems to work very well for us.

View full review »
it_user837504 - PeerSpot reviewer
Information Technology at a insurance company with 51-200 employees

It is great to have such insight into code without having to upload the source code at all. It saves a lot of NDA paperwork. The Visual Studio plugin allows the developer to seamlessly upload the code and get results as he works, with no manual upload. The code review function is great. It allows you to find flaws in source code, but the source code never leaves your workstation, it is all client side, no NDA needed.

View full review »
AE
Enterprise Architect at a computer software company with 1-10 employees

The article scanning is excellent. 

The composition analysis and common CBEs attached to it are quite good.

The solution offers a lot of really great analysis. There's lots of good data support.

View full review »
it_user852402 - PeerSpot reviewer
Software Security Consultant at DXC Technology

Provides consistent evaluation and results without huge fluctuations in false positives or negatives. 

View full review »
it_user835104 - PeerSpot reviewer
Project Manager at a tech vendor with 501-1,000 employees

We use the results of the scan to identify vulnerabilities in the product.

View full review »
VV
Senior Project Manager at a computer software company with 501-1,000 employees

The SAST feature is the most valuable aspect of the solution.

The stability has been quite good overall. The performance is reliable. 

The scalability on offer is good. I don't see any constraints.

From a usability standpoint and the way it can be integrated into the pipelines, etc., it's very good.

It's comprehensive from a feature standpoint. 

View full review »
Raj Nachiappan - PeerSpot reviewer
Director of Solutions Architecture at VetsEZ

The most valuable feature is the dynamic application security testing.

View full review »
AK
Global Presales Head - Security Assurance at Wipro Technologies

Veracode provides faster scans compared to other static analysis security testing tools.

View full review »
it_user833553 - PeerSpot reviewer
CISSP, CISM at a tech services company with 1,001-5,000 employees

SAST, DAST, and Greenlight are the most important features because today it's important for our regulatory compliance law to keep our product coding relatively secure.

For our rapid, secure DevOps cycle, we have integration of the Vericode API into our build tool, and Greenlight into our IDE.

View full review »
it_user697020 - PeerSpot reviewer
Software Developer/Architect at a insurance company with 201-500 employees

We used the application for the web. Static, dynamic, and manual scan features were all very useful for us. All of them helped us fix many security flaws.

View full review »
reviewer1359297 - PeerSpot reviewer
Software Engineer at a financial services firm with 501-1,000 employees

The source composition analysis component is great because it gives our developers some comfort in using new libraries.

View full review »
it_user854052 - PeerSpot reviewer
Head of Technology. at a tech services company with 11-50 employees

Static and dynamic scans of the code. It is part of our release cycle.

View full review »
it_user542859 - PeerSpot reviewer
Security Consultant at a tech company with 501-1,000 employees

Allows developers to run their own scans.

View full review »
it_user841116 - PeerSpot reviewer
Information Security Lead Analyst at a consumer goods company with 10,001+ employees

Catching coding flaws before they go live.

Regarding integrating Veracode into our software development lifecycle, we started out with it being used only as a web interface, and now developers are starting to use it right in their IDE on the desktop.

View full review »
JB
Team Lead / Architect at a tech services company with 1,001-5,000 employees
  • I have found the user interface extremely helpful in prioritizing issues.
  • It allows me to prioritize the work to help resolve an issue.
View full review »
it_user873405 - PeerSpot reviewer
Lead Security Engineer at a tech vendor with 201-500 employees

Scanning of .war and .jar.

View full review »
it_user920715 - PeerSpot reviewer
Managing Principal Consultant at a tech vendor with 11-50 employees

The most valuable feature comes from the fact that it is cloud-based, and I can scale up without having to worry about any other infrastructure needs.

View full review »
AC
Associate Consultant at a comms service provider with 201-500 employees

The most valuable feature is the efficiency of the tool in finding vulnerabilities.

View full review »
it_user833550 - PeerSpot reviewer
VP of Services at a tech vendor with 51-200 employees

The ability to run scans. It's a critical piece of why we use the platform. We use it to get our scan results and see where our software is vulnerable or not vulnerable.

It's part of our SDLC now.

View full review »
it_user802140 - PeerSpot reviewer
Product Manager at GMS

I use the SAST feature the most.

View full review »
it_user854046 - PeerSpot reviewer
DevOps Release Engineer at a tech services company with 51-200 employees

Informing me of application security vulnerabilities. Bamboo build-automation with Veracode API calls are used.

View full review »
reviewer1360623 - PeerSpot reviewer
VP Engineering at a tech services company with 201-500 employees

Source code composition analysis for vulnerabilities and license compliance is the most valuable feature.                                                                                                 

View full review »
it_user712167 - PeerSpot reviewer
General Manager - Application Security at a tech consulting company with 51-200 employees
  • Application testing
  • False positives challenges
  • Wide range of platforms and technology assessments
View full review »
Buyer's Guide
Veracode
March 2024
Learn what your peers think about Veracode. Get advice and tips from experienced pros sharing their opinions. Updated: March 2024.
765,234 professionals have used our research since 2012.