Veracode Reviews & Insights

Score8.7 out of 10

213 Reviews and Ratings

Community insights

TrustRadius Insights for Veracode are summaries of user sentiment data from TrustRadius reviews and, when necessary, third party data sources.

Pros

Customer Support Effectiveness: Users have consistently praised Veracode's customer support for being responsive, helpful, and quick to address their needs. This level of support has been instrumental in resolving issues efficiently and maintaining user satisfaction.

Ease of Use and Integration: Reviewers appreciate the platform's user-friendly interface, well-documented steps for administration, and seamless integration with code repositories, making it easy to navigate and work with. This simplicity contributes to a smoother workflow for users across different tasks.

Comprehensive Analysis and Suggestions: Many users highlight the static code analysis platform for providing in-depth information, valuable suggestions for flaw mitigation across various programming languages, and aiding developers in promptly resolving issues. The actionable insights offered by the platform significantly enhance the development process for organizations.

Veracode Reviews

29 Reviews

Engineering

Detailed Analysis: Impact and Efficiency of Veracode on Cybersecurity Posture of an Organization

Rating: 8 out of 10

Incentivized

August 12, 2024

Use Cases and Deployment Scope

We use Veracode for performing Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST) and Software Composition Analysis (SCA) scans for all of our products. These scans help us find and address security vulnerabilities early in the Secure Development Life Cycle (SDLC) of every product. We have also automated the SAST, DAST and SCA scans by adding the Veracode scan step in our CI/CD pipelines.

Pros

Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.

Cons

Veracode sometimes marks some findings as fixed and then in subsequent scans, it reopens the finding. All of this happens even when there is no change in the source code.
Triaging SCA and License risk findings on Veracode UI is very difficult when you compare it with the SAST findings. I think the "Triage Findings" UI should be same for all the types of findings for better user experience.
Veracode's integration with ticketing tools is unidirectional, meaning it only syncs the status from Veracode to the ticketing tool and not the other way around. If the integration is bidirectional, triaging findings could be very convenient.

Likelihood to Recommend

Veracode is a very powerful tool for performing Static Application Security Testing (SAST) and Software Composition Analysis (SCA) for any application. It gives very few false positives from the get go, so less work for the AppSec team for filtering out the false positives.

However, it is not very good at performing Dynamic Application Security Testing (DAST). So, its not a one-stop scanning tool that fulfills all the needs.

Verified User

Engineer in Engineering (Computer Software company, 501-1000 employees)

Vetted Review

1 year of experience

Veracode, a great security tool for everyone

Rating: 8 out of 10

Incentivized

March 18, 2024

Use Cases and Deployment Scope

To be SoC2 and ISO compliant and also to protect our SaaS, we are using this tool to scan every component that we build for SA and SCA.
we also have an obligation regarding the fix time and we use the dashboards to keep track of it.

Pros

Integrates with any CI CD tool like Jenkins
Shows result in a simple way using dashboards
allows mitigations in a clear manner

Cons

Scans fail if another scan is already in progress using the Java CLI
Module selection is slow to load when it comes to big applications
Module selection is sometimes not clear on what is scannable and what is not and why
remediation actions for SCA issue. you can recommend on how to fix it in a clear way and not forcing the user to click many times to understand it.

Likelihood to Recommend

Integrate Veracode Java CLI with Jenkins and run it on every component build pipeline

Alternatives

FOSSA and Mend SCA

Veracode is easier to integrate and faster than Fossa although Mend has more visual features

Verified User

Director in Engineering (Internet company, 201-500 employees)

Vetted Review

2 years of experience

Great products; + Great price.

Rating: 10 out of 10

Incentivized

February 15, 2024

Use Cases and Deployment Scope

We wanted a secure scan method for static, dynamic, and manual PEN testing. We wanted to make sure that we could "shift left" with our development and have security scans done at the beginning of the development process. Not at the end when it is already in the field and more challenging to update.

Pros

Static Scan
Dynamic Scan
Manual PEN testing
Open source scans with Software Composition Analysis

Cons

Dynamic DAST fails every once in a while and creates problems during release completion.

Likelihood to Recommend

We wanted a secure scan method for static, dynamic and also manual PEN testing. We wanted to make sure that we could "shift left" with our development and have security scans done at the beginning of the development process. Not at the end when it is already in the field and more difficult to update. Veracode allows us to do all this in our CI/CD pipeline early and also in the development IDE (static scans).

Alternatives

Snyk

Veracode is much cheaper and does more: SAST, SCA, DAST, and now PEN as a service.

Krishna Bala

Sr. VP Engineering in Engineering at Proscia (Health, Wellness and Fitness, 51-200 employees)

Vetted Review

4 years of experience

View profile

A normal review of Veracode

Rating: 8 out of 10

Incentivized

March 27, 2023

Use Cases and Deployment Scope

We use the Veracode software platform to look for vulnerabilities in our code as well as in the third party libraries we were using. We are in the medical software industry, so the data we deal with is very sensitive in nature so we take security and privacy very seriously.

Pros

Very good customer support
Visual Studio Add Ons
Quick responses to questions

Cons

Microsoft ADO pipeline support for other scan features
Reports that can be generated outside of the website
Summary of multiple reports at the user level and not administrative level

Likelihood to Recommend

Having detailed reports generated by Veracode that highlights code vulnerabilities as well as security issues with third party libraries are features that are important in our industry. It is well suited for providing software teams all of the outstanding issues they may exist so that time is saved in not having to do all of that research ourselves.

Alternatives

We used Accunetix as well mainly for web site security testing. We used Veracode for code and third party analysis.

Verified User

Engineer in Engineering (Medical Device company, 1001-5000 employees)

Vetted Review

Veracode makes your life easy and safe.

Rating: 9 out of 10

Incentivized

December 20, 2022

Use Cases and Deployment Scope

Veracode is used to find any flaws that can affect the application in production even before the product is deployed in any environment. Almost all types of scans can be performed using Veracode. Veracode is famous for its SAST and SCA scan, which attracts users due to its transparency and security.

Pros

SAST Scan
SCA
DAST

Cons

Flagging false positive.
Linking of SCA and SAST Scan.
Needed to see an aggregated score for all the modules in an application.

Likelihood to Recommend

I will say it is a nine because the aggregated score of all the modules in an application is not shown anywhere in the Veracode. Otherwise, it's good for the easiness and stability of the application that a developer and an organization are keen to see in a penetration application, respectively.

Alternatives

HCL AppScan

Verified User

Engineer in Engineering (Information Technology & Services company, 10,001+ employees)

Vetted Review

1 year of experience

One Stop Security Solution for your apps

Rating: 8 out of 10

Incentivized

September 9, 2022

Use Cases and Deployment Scope

Veracode is an amazing tool that enabled us to identify several security loopholes, especially through dynamic analysis. Static analysis was helpful in plugging gaps as well. It's one of the best out there. One of the things we really loved about Veracode was the level of detail provided to identify issues and help resolve them. especially given we used several platforms such as .Net, .Net Core and Windows.

Pros

Identify security loopholes
Gives us detailed issue reports
provide a sense of confidence for the developers. We plugged some critical ones with this
provide summary reports that we can share with clients as well

Cons

Dynamic Analysis sometimes took a lot of time to run
The user interface especially accessing reporting was difficult to find
Provide direct integration with DevOps pipelines in the future if possible to run the static analysis for commits if required

Likelihood to Recommend

Best Case Scenario:
1. Review your source code and security patching on the code.
2. Run real time test and penetration testing with dynamic data
3. Instill confidence with the customers

Not so well

1. timeout on the app is annoying
2. UI is not so great

Alternatives

Appium, Apache JMeter, Katalon Studio and Selenium

One Stop solution for security evaluation. Others were not so accurate and covering all the scenarios we were looking to plug.

Verified User

Manager in Engineering (Information Technology & Services company, 1-10 employees)

Vetted Review

1 year of experience

Quick review after using Veracode for 1 month

Rating: 10 out of 10

Incentivized

June 7, 2022

Use Cases and Deployment Scope

We use Veracode to perform a static scan of our application after we build it. As per the scan result, we upgrade the security and coding standards of our application. Until we meet the standards as per the Veracode scan, our application code will not be approved. By using Veracode we can learn many new things about software development and coding standards. We can use those in the near future to maintain industry standards.

Pros

We use Veracode to perform a static scan of our application after we build it. As per the scan result, we upgrade the security and coding standards of our application. Until we meet the standards as per the Veracode scan, our application code will not be approved.
By using Veracode we can learn many new things about software development and coding standards. We can use those in the near future to maintain industry standards.

Cons

More examples of how to solve the issue with some real-life examples would be better to figure out the issue.
The exact reason/line number would be great to find the actual code block which is causing the issue.

Likelihood to Recommend

Alternatives

SonarQube

My organization use veracode.

Verified User

Consultant in Engineering (Information Technology & Services company, 10,001+ employees)

Vetted Review

1 year of experience

Veracode

Rating: 7 out of 10

Incentivized

May 1, 2022

Use Cases and Deployment Scope

We do SAST, DAST, and SCA using Veracode. The software composition part does a pretty solid job of identifying all the components involved in our applications. Being able to check for use of vulnerable methods also saves quite a bit of time in assessing the actual risk of any findings. SAST works well enough, but as is usual for such things there are a lot of false positives that need manual review. DAST can use more work, especially with single-page applications

Pros

SCA
customer support
2fa

Cons

DAST
bulk user management
SSO configuration

Likelihood to Recommend

Well suited: Monitoring application security throughout its development Not well suited: Fully automatic security assessments

Verified User

Professional in Engineering (Computer Software company, 1001-5000 employees)

Vetted Review

2 years of experience

You don't need a security team anymore!

Rating: 10 out of 10

Incentivized

December 22, 2021

Use Cases and Deployment Scope

Veracode helps in providing solutions to fix flaws as early as possible through their portfolio of scans. We run multiple scans during the lifecycle of our softwares to not only identify but also remediate these issues. Veracode helps us in making sure the apps are always secure before they are released to the production environment. We have regular reviews from the security team for our applications and Veracode helps us in clearing them without any issues.

Pros

The pipeline scan is a very fast way to scan code and inform developers if a new flaw is introduced by their pull requests.
Upload & Scan provides an in-depth analysis of the codebase, which features like reporting being made easy.
SCA Scans help us not only identify the vulnerabilities but also in helping fix them and in identifying if our application is using that part of the vulnerable library or not.
Veracode is very easy to integrate into the CI/CD pipelines (especially Jenkins)

Cons

It was very difficult for me to navigate around on their Dashboard. There's certainly room to improve on that and make it more intuitive.
The Agent-based SCA scan can have a feature for adding a baseline file (like Pipeline Scan)

Likelihood to Recommend

Veracode is well-suited for companies making sure their products are always flawless. Through their portfolio of products, one can make sure every application is free from any vulnerabilities at the earliest in its development lifecycle. It may not suit companies having legacy codebases and applications written in languages that Veracode doesn't support.

Alternatives

Checkmarx and SonarQube

Veracode has a very good integration within its products, which makes it easy for a developer. Veracode helps in providing support both actively and through resources on their platform to remediate and fix the issues found in one's application. The reporting section being handled by Veracode makes it easy for the developers in big-tech companies to easily share analysis of the scan results with the concerned authorities and thus saves a lot of the developer's time.

Verified User

Engineer in Engineering (Internet company, 5001-10,000 employees)

Vetted Review

1 year of experience

Safety first with Veracode

Rating: 10 out of 10

Incentivized

December 21, 2021

Use Cases and Deployment Scope

We use this for static analysis as well as with agent-based scan and this combination helps us detect potential vulnerabilities at the development phase only and address them.

Pros

Find and tell us find packages those are out of date
Tell us venerability's in CSS, JS and third party components
Recommends coding improvements based in better coding practices

Cons

Sometimes static scan gets stuck for days which otherwise takes 3-4 hours most of the times

Likelihood to Recommend

I won't recommend it for smaller products.

Alternatives

Tenable.io

Verified User

Project Manager in Engineering (Information Technology & Services company, 201-500 employees)

Vetted Review

1 year of experience

Loading Reviews List....

Video reviews

View playlist

Detailed Analysis: Impact and Efficiency of Veracode on Cybersecurity Posture of an Organization

Rating: 8 out of 10

Incentivized

August 12, 2024

Use Cases and Deployment Scope

Pros

Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.

Cons

Veracode sometimes marks some findings as fixed and then in subsequent scans, it reopens the finding. All of this happens even when there is no change in the source code.
Triaging SCA and License risk findings on Veracode UI is very difficult when you compare it with the SAST findings. I think the "Triage Findings" UI should be same for all the types of findings for better user experience.
Veracode's integration with ticketing tools is unidirectional, meaning it only syncs the status from Veracode to the ticketing tool and not the other way around. If the integration is bidirectional, triaging findings could be very convenient.

Likelihood to Recommend

Verified User

Engineer in Engineering (Computer Software company, 501-1000 employees)

Vetted Review

1 year of experience