Veracode has good support for microservices, and I also like the sandbox environment. For example, when introducing a new component, we can scan it in a sandbox environment. It will not impact the main environment. When our team fixes it, they. can push it to the production environment when the results are acceptable.
The SCA, agent-based analysis, is valuable. SAST and DAST take time, while this is quite fast. It gives the results very quickly. We have implemented it into our CI/CD pipeline.
It has provided what we were looking for in such an application, meaning static application security testing functionality. That was what we were interested in.
Junior Developer Intern at a insurance company with 10,001+ employees
Real User
Oct 4, 2023
What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode.
DevOps Engineer at a consultancy with 10,001+ employees
Real User
Top 20
Sep 18, 2023
Before Veracode, the application was deployed to the production server and there would be a lot of bugs and issues. Once we implemented the Veracode scan, the full deployment issues were drastically reduced.
Veracode is easy to use even if you're not a security professional. I like the dynamic analysis feature, which offers a lot of cost savings when used in production.
ML engineer at a consultancy with 10,001+ employees
Real User
Sep 4, 2023
The most valuable feature is Veracode SDP, which allows for something related to third-party vulnerabilities. When we build a product, we use a lot of third-party libraries instead of building everything from scratch. We just use a library which is already been built; we just use that component in our product. Sometimes, these libraries may have bugs or issues, and it's hard to keep track of them because we use thousands of them.
Director - Product Solution/Architecture at a tech vendor with 10,001+ employees
MSP
May 26, 2022
It scans for the OWASP top-10 security flaws at the dynamic level and, at the static level, it scans for all the warnings so that developers can fix the code before we go to UAT or the next phase.
Sr. Cloud Solution Architect - SAP on Azure at Accenture
Real User
May 2, 2022
Veracode supports a broad range of code technologies, and it can analyze large applications. Fortify takes a long time and may not be able to generate the report for larger applications. We don't have these constraints with Veracode.
Product Security Engineer at a tech services company with 5,001-10,000 employees
Real User
Mar 31, 2022
With the pipeline scanner, it's easier for developers to scan their products, as they don't have to export anything from their computers. They can do everything with the command line on their computer.
Lead Security Architect at a comms service provider with 1,001-5,000 employees
Real User
Mar 9, 2021
It is a cloud-based platform, so every organization or every security team in the organization is concerned about uploading their code because ultimately the code is intellectual property. The most useful thing about Veracode is that if you want to upload the code, they accept only byte code. They do not accept the plain source code as an input. The code is converted into binary code, and it is uploaded to Veracode. So, it is quite secure. It also has the automation feature where you can integrate security during the initial stages of your software development life cycle. It is pretty much easy with Veracode.
Veracode provides integration with multiple tools and platforms, such as Visual Studio, Java, and Eclipse. Developers can integrate with those tools by using Jenkins. The security consultation or the support that they provide is also really good.
Its user management is also good. You can restrict the users for a particular application so that only certain developers will be able to see the code that has been scanned.
Their reporting model is really good. For each customer, they provide a program manager. Every quarter, they have their reviews about how much it has scanned. They also ensure that the tool has been used efficiently.
Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.
Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis...
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
The integration capabilities with our existing development tools are very good.
The most valuable feature of Veracode is the binary scan feature for auditing, which allows us to audit the software without the source code.
This static analysis helps ensure a secure application rollout across all environments.
I like Veracode's API. You can put it into a simple bash script and run your own security testing from your MacBook in less than 15 minutes.
Veracode has good support for microservices, and I also like the sandbox environment. For example, when introducing a new component, we can scan it in a sandbox environment. It will not impact the main environment. When our team fixes it, they. can push it to the production environment when the results are acceptable.
The automation of Veracode is great because we no longer have to run manual testing.
The integration with DevOps pipelines is seamless.
The innovative features offered by Veracode are excellent.
The SCA, agent-based analysis, is valuable. SAST and DAST take time, while this is quite fast. It gives the results very quickly. We have implemented it into our CI/CD pipeline.
It has provided what we were looking for in such an application, meaning static application security testing functionality. That was what we were interested in.
We like the fact that all the issues are identified and that Veracode provides sufficient information on how to resolve them.
The product’s policy reporting for ensuring compliance with industry standards and regulations is great.
What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode.
The source composition analysis had very good reporting.
Before Veracode, the application was deployed to the production server and there would be a lot of bugs and issues. Once we implemented the Veracode scan, the full deployment issues were drastically reduced.
Veracode is easy to use even if you're not a security professional. I like the dynamic analysis feature, which offers a lot of cost savings when used in production.
The most valuable feature is Veracode SDP, which allows for something related to third-party vulnerabilities. When we build a product, we use a lot of third-party libraries instead of building everything from scratch. We just use a library which is already been built; we just use that component in our product. Sometimes, these libraries may have bugs or issues, and it's hard to keep track of them because we use thousands of them.
I contacted the solution's technical support during the automation part, and it went well, after which I never faced any issues.
The most valuable features of the solution are its extensive reporting capabilities and user-friendly interface.
The most valuable feature of Veracode Static Analysis is the scanning.
What I found most valuable in Veracode Static Analysis is that it categorizes security vulnerabilities.
It scans for the OWASP top-10 security flaws at the dynamic level and, at the static level, it scans for all the warnings so that developers can fix the code before we go to UAT or the next phase.
Veracode supports a broad range of code technologies, and it can analyze large applications. Fortify takes a long time and may not be able to generate the report for larger applications. We don't have these constraints with Veracode.
With the pipeline scanner, it's easier for developers to scan their products, as they don't have to export anything from their computers. They can do everything with the command line on their computer.
Stable and scalable, with good reporting features.
Helps in detecting and managing vulnerabilities and risks.
It is a cloud-based platform, so every organization or every security team in the organization is concerned about uploading their code because ultimately the code is intellectual property. The most useful thing about Veracode is that if you want to upload the code, they accept only byte code. They do not accept the plain source code as an input. The code is converted into binary code, and it is uploaded to Veracode. So, it is quite secure. It also has the automation feature where you can integrate security during the initial stages of your software development life cycle. It is pretty much easy with Veracode.
Veracode provides integration with multiple tools and platforms, such as Visual Studio, Java, and Eclipse. Developers can integrate with those tools by using Jenkins. The security consultation or the support that they provide is also really good.
Its user management is also good. You can restrict the users for a particular application so that only certain developers will be able to see the code that has been scanned.
Their reporting model is really good. For each customer, they provide a program manager. Every quarter, they have their reviews about how much it has scanned. They also ensure that the tool has been used efficiently.