Veracode Reviews

AkashKhurana - PeerSpot reviewer
Senior Software Engineer at Publicis Sapient
Real User
Top 10
Easy to configure, stable, and good vulnerability detection
Pros and Cons
  • "The most valuable feature is detecting security vulnerabilities in the project."
  • "The scanning process for records could be faster and there is room for improvement in Veracode's performance."

What is our primary use case?

In our company, we have various projects, and before beginning the development process, we utilize Veracode to scan the repository for any potential security issues. For instance, if we are using a third-party API or client dependency, such as a payment system, we require a third-party dependency. Once we have implemented this feature and scanned it using Veracode, any security vulnerabilities or code issues are highlighted. It is imperative that we resolve any Veracode issues to ensure our build is successful. To solve these issues, we may need to upgrade the version of our dependencies or investigate any security issues with the versions we are currently using.

The code is checked for any security issues, as well as any potential code issues or code smells that could cause major critical blockers. In this context, blockers have the highest priority, and if any are identified, they must be addressed urgently. The bugs or code smells are analyzed, and priority or severity is assigned accordingly. Dependencies used in the code are also checked for security issues.

How has it helped my organization?

Veracode's ability to prevent vulnerable code from being deployed into production is crucial. Typically, if a dependency we use has security issues or concerns, Veracode suggests upgrading to a more secure version. For example, if we're using a PayPal dependency with version 1.3 and it has a security bug, Veracode suggests upgrading to version 1.4 which fixes the issue. We usually make our project compatible with version 1.4, but sometimes Veracode recommends removing the dependent code altogether and adding the updated dependency from another repository. Veracode provides suggestions for resolving security issues and we implement them in our code after resolving any conflicts. We run the Veracode scan again and if it fails, we do not deploy the code to production. This is critical as it ensures that security issues such as bugs and fixes are addressed.

Veracode consistently assists us in identifying security issues in third-party dependencies, while also ensuring the maintenance of code quality. Preventing security bugs and threats in our code improves the overall code quality of our company, which is essential given the significant concerns surrounding security today.

Veracode's policy reporting is helpful for ensuring compliance with industry standards and regulations. Veracode's solution plays a major role in achieving compliance, including HIPAA compliance. Without Veracode scans, identifying security threats and third-party dependencies would be a tedious task for DevOps professionals.

Veracode provides visibility into the status of our application during every phase of development, including continuous integration and continuous development CI/CD pipeline stages. This includes builds, package creation for deployment, and various enrollment stages such as develop, queue, stage, above, and production enrollment. Prior to each stage, a Veracode scan is run. This can be accessed through Jenkins or the CI/CD pipeline by clicking on the Veracode scan option, which provides a detailed report highlighting any security issues and concerns.

Veracode performs statistical analysis, dynamic analysis, software composition analysis, and manual penetration tests throughout our software development life cycle. Veracode scans not only for third-party security issues but also for possible issues in our own code. This occurs in every phase of development, including the SDLC. For example, if we use an encryption algorithm with a private or public key that is easy to decode, Veracode will identify this as an error or warning in the report and suggest using multiple layers of encryption for the keys.

The entire CI/CD process is part of DevOps. Therefore, the responsibility of configuring the Veracode tool usually falls on the DevOps professional. It is essential to integrate Veracode with the CI/CD pipeline within the project to ensure it is always incorporated. Whenever there is a priority or mandatory check required before deployment, Veracode should run beforehand. This integration is carried out by our DevSecOps team.

Veracode's false positive rate is good, as it helps us identify possible security concerns in our code. In my opinion, it is advisable to run a Veracode scan on all codes. I have worked in the IT industry for five years, and I have observed that Veracode has been implemented in every project I have worked on. If a tool is improving our code quality and providing us with insights into potential security issues, it is always beneficial to use it.

The false positive rate boosts our developers' confidence in Veracode when addressing vulnerabilities. Veracode also provides suggestions when there is a security issue with a dependency in version 1.7, prompting us to consider using version 1.8, which does not have security issues. This process involves the developers, and it leaves a positive impression on our managers and clients, demonstrating our commitment to security. We can show them that we were previously using version 1.7 but updated to version 1.8 after identifying the security issue with Veracode's help. Unfortunately, there is no centralized platform to check for network issues or problems with dependencies and versions. Veracode provides a centralized solution where we can scan our project and receive results.

Veracode has helped our organization address flaws in our software and automation processes. Its positive impact has been reflected in our ROI, which increased when we started using Veracode. Without Veracode, we would be susceptible to security issues and potential hacking. However, after implementing Veracode scans, we have not encountered any such problems. It is critical for us to use Veracode because we capture sensitive data such as pharmacy information for real-time users, including patient prescriptions and refill schedules. This sensitive data could pose a significant problem if our code or software has security vulnerabilities. Fortunately, Veracode scans allow us to prevent such issues.

Veracode has helped our developers save time by providing a solution that eliminates the need to manually check for dependencies or search the internet for information on which dependencies have issues. Instead, Veracode provides a detailed report that identifies the issues and recommends the appropriate version to use. Using Veracode ensures the quality of our code and also saves time for our developers. In my career of five years, Veracode has helped me resolve code issues eight times.

Veracode has reduced our SecOps costs by identifying security vulnerabilities in our code. Without Veracode, if we were to go live with these issues, it could result in a breach of our encrypted data, potentially causing significant harm to our organization. This would require significant time and cost to resolve the issue and restore the data. Veracode has improved the quality of our code and reduced the risk of such incidents occurring, thereby minimizing their impact on our organization.

What is most valuable?

The most valuable feature is detecting security vulnerabilities in the project. This is especially important when choosing third-party dependencies since we may not be aware of any potential security concerns or issues in the code. Veracode can help identify security issues in third-party dependencies, including code fixes and bugs. By focusing on our own security issues, we can also address potential security issues in third-party dependencies. Before going into production, we typically conduct a record scan in each department to ensure security measures are in place. 

What needs improvement?

The scanning process for records could be faster and there is room for improvement in Veracode's performance. Currently, it takes around 25 to 30 minutes to scan a standard repository, even for a small one. This is not ideal, especially since we are using a microservice architecture with eight repositories. If each repository takes 25 minutes to scan, it would take a significant amount of time to scan all of them. Therefore, I would like to see some performance improvements in Veracode to reduce the time it takes to scan our code and generate detailed reports.

For how long have I used the solution?

I have been using the solution for two years.

What do I think about the stability of the solution?

The solution is stable.

What do I think about the scalability of the solution?

Veracode is scalable but the performance can be slow when running scans so the larger we scale the slower it can be.

How was the initial setup?

The initial setup, including Veracode configuration, is straightforward. During setup, we only need to provide the repository path and specify the type of project, based on the chosen technology. We also need to indicate where the project dependencies are located, with prioritization for Java projects and placement in the NPMRC file for node.js or Java security projects. Overall, the process is simple and straightforward.

What about the implementation team?

The implementation was completed in-house.

What was our ROI?

We have seen a return on investment.

What other advice do I have?

I give the solution a nine out of ten.

All coders should have Veracode since it helps prevent security issues in applications, thereby safeguarding critical data. As we know, all applications contain sensitive information. If we only store some of our data online, we have to rely on applications that meet industry standards and compliance requirements. Veracode can help achieve these standards and compliance. To ensure this, Veracode must be set up to scan and integrate with the Jenkins CI/CD pipeline.

We capture the health and pharmacy data of users, so Veracode is deployed in various countries and running live. We have over ten million users.

Which deployment model are you using for this solution?

On-premises
Disclosure: PeerSpot contacted the reviewer to collect the review and to validate authenticity. The reviewer was referred by the vendor, but the review is not subject to editing or approval by the vendor.
Flag as inappropriate

Veracode Questions

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Oct 11 2023

If you were talking to someone whose organization is considering Veracode Static Analysis, what would you say?

How would you rate it and why? Any other tips or advice?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Oct 11 2023

How do you or your organization use this solution?

Please share with us so that your peers can learn from your experiences.

Thank you!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot
Oct 11 2023

Please share with the community what you think needs improvement with Veracode Static Analysis.

What are its weaknesses? What would you like to see changed in a future version?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot
Oct 11 2023

Hi,

We all know it's really hard to get good pricing and cost information.

Please share what you can so you can help your peers.

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot
Oct 11 2023

Hi Everyone,

What do you like most about Veracode Static Analysis?

Thanks for sharing your thoughts with the community!

Meri Harutyunyan - PeerSpot reviewer
Meri Harutyunyan
DevSecOps Engineer at a financial services firm with 1,001-5,000 employees
Sep 13 2023

Hello community, 

After the first full scan with Veracode SAST, when the programmer changes something in the code, does he scan the code again completely or only the changes?

Thank you.

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 31 2023

Hi Everyone,

What do you like most about Veracode?

Thanks for sharing your thoughts with the community!

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 31 2023

Hi Everyone,

What advice do you have for others considering Veracode?

Thanks for sharing your thoughts with the community!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot
Aug 31 2023

Hi Everyone,

What is your experience regarding pricing and costs for Veracode?

Thanks for sharing your thoughts with the community!

Karen Meohas - PeerSpot reviewer
Karen MeohasVeracode is expensive. Some of its products are expensive. I don't think it's… more »
66 Answers
Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot
Aug 31 2023

Hi Everyone,

What is your primary use case for Veracode?

Thanks for sharing your thoughts with the community!

SeshagiriSriram - PeerSpot reviewer
SeshagiriSriramWe used it for performing security checks. We have many Java applications and… more »
94 Answers
Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 31 2023

Hi Everyone,

What needs improvement with Veracode?

Thanks for sharing your thoughts with the community!

it_user842937 - PeerSpot reviewer
it_user842937From a technical standpoint, I'm pretty happy with everything. The one thing I'd… more »
Elina Petrovna - PeerSpot reviewer
Elina Petrovna* Management of false positives * Agile best practices: Violation detection. *… more »
Michael Stricklen - PeerSpot reviewer
Michael Stricklen* More timely support for newer languages and framework versions. * Integration… more »
98 Answers
Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 14 2023

Hi,

We all know it's really hard to get good pricing and cost information.

Please share what you can so you can help your peers.

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 14 2023

Please share with the community what you think needs improvement with Veracode Software Composition Analysis.

What are its weaknesses? What would you like to see changed in a future version?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 14 2023

How do you or your organization use this solution?

Please share with us so that your peers can learn from your experiences.

Thank you!

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 14 2023

If you were talking to someone whose organization is considering Veracode Software Composition Analysis, what would you say?

How would you rate it and why? Any other tips or advice?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot
Aug 14 2023

Hi Everyone,

What do you like most about Veracode Software Composition Analysis?

Thanks for sharing your thoughts with the community!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

If you were talking to someone whose organization is considering Veracode Manual Penetration Testing, what would you say?

How would you rate it and why? Any other tips or advice?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

How do you or your organization use this solution?

Please share with us so that your peers can learn from your experiences.

Thank you!

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

Please share with the community what you think needs improvement with Veracode Manual Penetration Testing.

What are its weaknesses? What would you like to see changed in a future version?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

Hi Everyone,

What do you like most about Veracode Manual Penetration Testing?

Thanks for sharing your thoughts with the community!

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

Hi Everyone,

What do you like most about Veracode Security Labs?

Thanks for sharing your thoughts with the community!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

Hi,

We all know it's really hard to get good pricing and cost information.

Please share what you can so you can help your peers.

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

Please share with the community what you think needs improvement with Veracode Security Labs.

What are its weaknesses? What would you like to see changed in a future version?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

How do you or your organization use this solution?

Please share with us so that your peers can learn from your experiences.

Thank you!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

If you were talking to someone whose organization is considering Veracode Security Labs, what would you say?

How would you rate it and why? Any other tips or advice?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

Hi,

We all know it's really hard to get good pricing and cost information.

Please share what you can so you can help your peers.

Grzegorz Grabarczyk - PeerSpot reviewer
Grzegorz Grabarczyk
Project / Delivery Manager at Spyrosoft

Is there anyone here that has used the trial version of Veracode Security Labs? Did you decide to go with a different option and why?

CristobalRodriguez - PeerSpot reviewer
CristobalRodriguezVeracode was running a few monthly competitions in 2021 from Jan-July.  The… more »
1 Answer
Netanya Carmi - PeerSpot reviewer
Netanya Carmi
Content Manager at PeerSpot (formerly IT Central Station)

Why is one better than the other?

Mauro Verderosa - PeerSpot reviewer
Mauro VerderosaThey are mainly two different products.  If your goal is to set the quality on… more »
Vishal-Goyal - PeerSpot reviewer
Vishal-GoyalWe have used SonarQube quite a lot and this is great to check code quality… more »
6 Answers
Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

If you were talking to someone whose organization is considering Veracode Developer Training, what would you say?

How would you rate it and why? Any other tips or advice?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

Hi Everyone,

What do you like most about Veracode Developer Training?

Thanks for sharing your thoughts with the community!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

Please share with the community what you think needs improvement with Veracode Developer Training.

What are its weaknesses? What would you like to see changed in a future version?

Miriam Tover - PeerSpot reviewer
Miriam Tover
Senior Delivery Ops Manager
PeerSpot

How do you or your organization use this solution?

Please share with us so that your peers can learn from your experiences.

Thank you!

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Kenna.AppSec or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick CodeSonar or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Veracode or Waratek ARMR?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Semmle QL or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Frontline WAS or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Veracode or w3af?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Sonatype Nexus Lifecycle or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Polyspace Code Prover or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Fortify Application Defender or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Sonatype Nexus Firewall or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Coverity or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Klocwork or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

When looking for a Application Security solution, are you more likely to pick Micro Focus Fortify on Demand or Veracode?

What are the advantages and disadvantages of each?

Are there specific use cases where one provides a better solution than the other?

Green Day - PeerSpot reviewer
Green Day
User

We are currently researching application security solutions.

From your experience, would you recommend Veracode? What are some of your use cases? 

Thanks! I appreciate the help.

SanthoshKumar3 - PeerSpot reviewer
SanthoshKumar3I would recommend Veracode. Our uses cases included removing vulnerable code… more »
Swapna Ragi - PeerSpot reviewer
Swapna RagiIt depends on whether Veracode is recommended or not completely based on the… more »
Donovan Greeff - PeerSpot reviewer
Donovan GreeffI would recommend them. They have the ability to cover multiple languages and… more »
3 Answers
William Hayes - PeerSpot reviewer
William Hayes
User at Securities America
I am looking for pros and cons for the Checkmarx vs SonarQube, in particular regarding: false positives tuning Sonarqube to reduce false positives without introducing false negatives.  I am also wondering if SonarQube could allow developers to delint their code before submitting it to SAS...
Read More »
Donovan Greeff - PeerSpot reviewer
Donovan GreeffMy opinions are my own and do not represent any other entities that I may be or… more »
Durga Gudimetla - PeerSpot reviewer
Durga GudimetlaSonarQube can be used for SAST. However, based on our internal analysis, our… more »
Swapna Ragi - PeerSpot reviewer
Swapna RagiSonarQube depends on completely what you configure the Rules. You will have the… more »
3 Answers
Julia Miller - PeerSpot reviewer
Julia Miller
PeerSpot

Hi,

We all know it's really hard to get good pricing and cost information.

Please share what you can so you can help your peers.

JaeLee - PeerSpot reviewer
JaeLee
User

We are evaluating application security solutions. What is the biggest difference between Veracode and Checkmarx? Which would you recommend? 

Thanks! I appreciate the help. 

Russell Rothstein - PeerSpot reviewer
Russell RothsteinJaeLee, check out our comparison page hereof Veracode vs Checkmarx… more »
Vincent Hu - PeerSpot reviewer
Vincent HuCheckmarx can be deploy on private , Veracode only support the Saas Model . But… more »
it_user1162671 - PeerSpot reviewer
it_user1162671Veracode is very new in DAST and IAST, Checkmarx is offering that since longer… more »
6 Answers
Almir Menezes - PeerSpot reviewer
Almir Menezes
Sales Director at a tech company with 1-10 employees
I have more than 20 years of experience in IT, having worked in technical, commercial and business areas. I am currently researching Veracode and Checkmarx. What is the total cost of ownership for the two? Are there big differences between them? Thanks! I appreciate your help....
Read More »
Ariel Lindenfeld - PeerSpot reviewer
Ariel Lindenfeld
Sr. Director of Community
PeerSpot

Has anyone done a comparison between Checkmarx and Veracode application security testing?

What are the main pros and cons of each solution?

What else do we need to consider when evaluating these two products?

it_user318207 - PeerSpot reviewer
it_user318207As someone who has been long using HP Fortify, I've been actively looking at… more »
2 Answers