Veracode
Application security as a service, with policy enforcement and compliance attestation.
What it is
Veracode runs SAST, DAST, SCA and manual penetration testing as a managed service, with a policy engine that determines whether an application may be released and produces the attestation reports required in regulated procurement. It scans compiled binaries, which suits organisations that receive software from suppliers.
Best for
Where it is strong
- Binary scanning works on third-party and supplier software where source is unavailable.
- Policy engine and attestation reports satisfy regulated procurement directly.
- Managed service model suits organisations without a security engineering team.
Where it falls short
- Slow feedback compared with developer-first tools — poor fit for per-commit scanning.
- Expensive per application.
- Developer experience lags Snyk and Semgrep considerably.
Pricing
Quote on request
Quote onlyFree tier: No free tier.
What drives the bill: Enterprise annual subscriptions priced by application count and scan types.
Check current pricing on Veracode’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use Veracode say
No reviews of Veracode yet. If you have used it in anger, yours would be the first.
Alternatives to Veracode
If Veracode is not the right fit, these solve the same problem differently.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
Mend.io
Security Testing
Software composition analysis with automated remediation and licence compliance.