Veracode
Enterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
Deployment
Cloud · Self-Hosted (partial)
Languages
35+
Pricing model
Quote-based
Free plan
No
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Veracode operates.
7 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | Greenlight gives instant in-IDE feedback as code is written, retiring 2026-12-31; Scan plugins run on demand. |
| AI Agent Guardrails | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Local Analysis (Pre-Commit) | Yes | Veracode CLI and Pipeline Scan JAR/Docker run locally; --allow-dirty re-verifies uncommitted changes |
| Inline PR Comments | Yes | Pipeline Scan posts results to PRs; Fix GitHub Action adds PR comments and annotations |
| Quality Gates (Merge Blocking) | Yes | Veracode checks configurable as required status checks; --fail_on_severity/--fail_on_cwe break builds |
| Full Repo Scan | Yes | Upload and Scan of packaged artifacts; repository scanning on push across all org repos |
| Scheduled Rescans | Yes | Policies enforce scan cadences - quarterly, semi-annual or annual - so repeat scans run on schedule. |
| Runtime Monitoring | Yes | DAST scans live apps/APIs; Quick scan safe in production; EASM discovers external assets |
Security scanning
10 yes 1 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Upload and Scan plus Pipeline Scan on compiled/packaged artifacts, CWE-mapped, 0-5 severity scoring |
| Taint Analysis (Data-Flow) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Secrets Detection | Yes | Container/IaC scanning detects secrets via configurable RE2 secret-rules; 60+ named provider key types |
| Secrets Validation | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| SCA | Yes | Agent-based scan with quick, full and vulnerable-methods depths; direct vs transitive dependency graph |
| Reachability Analysis | Yes | Vulnerable Methods scan (Level 3) checks whether first-party code calls vulnerable third-party methods |
| Malicious Package Detection | Yes | Veracode Package Firewall blocks malicious open-source packages at the registry level |
| License Compliance | Yes | License-risk ratings per component; policy rules block high-risk, non-OSS or unrecognized licenses |
| SBOM Generation | Yes | REST API and 'veracode sbom' CLI output CycloneDX 1.6, SPDX 2.3, Syft JSON; unbuilt Gradle limited |
| IaC Scanning | Yes | IaC misconfiguration scanning via repository integrations and CLI scan command with Rego custom policy |
| Container Scanning | Yes | Container image/archive scanning across nine base OS families for vulns, misconfigurations, secrets |
| CSPM | Partial | Veracode Risk Manager aggregates cloud infrastructure and security-tool findings; no native CSPM scanner documented |
| DAST | Yes | DAST covers web apps and REST/SOAP/OpenAPI/Postman APIs; Enterprise mode adds API spec management |
Code quality
1 yes 1 partial 7 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Yes | SAST reports a 'Code Quality' CWE finding category covering non-security maintainability defects. |
| Complexity Metrics | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Duplication Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Dead Code Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Test Coverage Tracking | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Diff Coverage (New Code) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Architecture Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Technical Debt Quantification | Partial | Security Quality Score, Veracode Levels VL1-VL5, open-flaw age and time-to-resolve dashboards; security debt only |
| Behavioral Code Analysis | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI review & fixes
2 yes 1 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| PR Summaries & Walkthroughs | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Autofix Suggestions | Yes | Veracode Fix suggests up to five RAG-matched patches per flaw in CLI and IDE; Pipeline Scan findings only |
| Autofix Pull Requests | Yes | Fix GitHub Action creates branch and PR; SCA auto-opens dependency-upgrade PRs on GitHub/GitLab |
| AI Triage (False-Positive Filtering) | Partial | Vulnerable-methods reachability and VRM dedup/correlation cut noise; mitigation workflow is manual, not AI triage |
Rules & repo support
1 yes 1 partial
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | Buyers author custom regex secret rules plus Rego container and IaC policies. |
| Monorepo Support | Partial | Multi-module build uploads let you choose which modules to scan, adjacent to monorepo scanning; repo-scanning docs never use the term "monorepo" or describe per-directory project scoping. |
AI capabilities
2 partial 5 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Partial | Veracode Fix uses ML plus RAG for remediation only; no AI reviewer that finds issues itself |
| Bring Your Own Model | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| MCP Server | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| AI Code Governance | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Conversational Review | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Learning From Feedback | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Code Excluded From Training | Partial | A Veracode Fix whitepaper states customer code is never used to further train that model, but the commitment is scoped to Fix only; a platform-wide statement is gated behind Veracode's Trust Center. |
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | User activity log and audit trails documented for enterprise governance |
| SSO (SAML) | Yes | SSO/SAML documented, including a SAML gateway for standalone Security Labs accounts |
| Role-Based Access Control | Yes | Named roles including Security Lead, Reviewer, Security Labs admin/manager/user, Free Trial Admin |
| Compliance Reporting & Exports | Yes | Pre-built analytics dashboards, PDF/JUnit/CSV DAST reports, SARIF export, REST API report retrieval |
Certifications
FedRAMP (distinct compliance environment with feature restrictions)
Standards mapping
OWASP Top 10 (including OWASP Top 10:2025)OWASP MobileOWASP API Security Top 10CWE Top 25CWE (full catalog, updated within 90 days of new versions)CERTPCI DSS (including PCI DSS 11.3 and PCI 3.2.1 policy)GDPR Article 32NIST (password/IAM guidance)
Integrations
5 yes 2 partial 3 no
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | No |
| GitLab | Partial |
| GitLab Self-Managed | No |
| Bitbucket | Partial |
| Bitbucket Data Center | No |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Yes |
CI/CD systems
GitHub ActionsGitLab CIAzure PipelinesJenkins/HudsonAtlassian BambooJetBrains TeamCityCircleCICodeshipTravis CIApache AntApache MavenGradleAWS CodeStarTerraform CloudHygieiaBroadcom Automic
IDEs
Visual Studio CodeJetBrains IDEsEclipseVisual Studio 2019Visual Studio 2022Visual Studio 2017 (historical)
Issue trackers
Jira Server/Data CenterJira CloudAzure DevOpsBugzillaAsanaServiceNowDefectDojo
Languages
Languages and frameworks named in Veracode's documentation.
Java (Java SE, Java EE, Jakarta)C#VB.NETASP.NETC++/CLIJavaScriptTypeScriptPHPScalaGroovyKotlinAndroidApple platforms (iOS, iPadOS, watchOS, tvOS, visionOS)Dart & FlutterRuby on RailsApexPL/SQLT-SQLClassic ASPColdFusionPerl (CGI)Python 2.x/3.xGoXamarin.NET MAUIPhoneGap/CordovaIonicTitaniumReact NativeC/C++ (preprocessed source, Linux binaries, Windows binaries)COBOL (COBOL-74, COBOL-85, COBOL 2002)RPG (RPG III, RPG IV, RPGLE)Visual Basic 6Objective-C (SCA)Swift (SCA)
Pricing & plans
Trial: Two documented 14-day trials only: DAST in the Veracode Platform (self-serve sign-up) and Security Labs (no Veracode account needed). A Free Trial Admin role allows up to nine extra users and four extra teams in a trial org.
Who it's for
Best for enterprises and regulated organizations with legacy code that need policy-driven security testing.
A good fit if
- Your code includes legacy languages such as COBOL, RPG, PL/SQL or Visual Basic 6
- You need policies that gate releases, including PCI templates
- You want SAST, SCA, DAST and manual penetration testing from one vendor
Consider alternatives if
- Your code is on GitHub Enterprise Server or GitLab Self-Managed
- You want published pricing or a free tier
Similar tools
Other Code Security Platform tools in the directory.
AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.Checkmarx OneApplication Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.GitHub Advanced SecurityGitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.
FAQ
When should you choose Veracode?
Veracode is best for enterprises and regulated organizations with legacy code that need policy-driven security testing. It's a good fit if:
- Your code includes legacy languages such as COBOL, RPG, PL/SQL or Visual Basic 6
- You need policies that gate releases, including PCI templates
- You want SAST, SCA, DAST and manual penetration testing from one vendor
Consider alternatives if:
- Your code is on GitHub Enterprise Server or GitLab Self-Managed
- You want published pricing or a free tier
What languages does Veracode support?
Veracode supports 35+ languages and frameworks, including Java (Java SE, Java EE, Jakarta), C#, VB.NET, ASP.NET, C++/CLI, JavaScript, TypeScript, PHP, Scala, Groovy, and 25 more.
What does Veracode integrate with?
Veracode integrates with:
- Source control: GitHub, GitLab (partial), Bitbucket (partial) and Azure DevOps
- CI systems: GitHub Actions, GitLab CI/CD, Azure Pipelines, Jenkins, Bamboo and 11 more
- IDEs: VS Code, JetBrains IDEs, Eclipse, Visual Studio 2019, Visual Studio 2022 and 1 more
What tools are similar to Veracode?
Other code security platforms tracked here:
What are Veracode's plans and pricing?
Veracode is priced by quote, with no published price list.
Opens www.veracode.com in a new tab. Review Radar is not affiliated with Veracode.