Veracode
Enterprise application risk management with SAST, DAST, SCA, container scanning and AI fixes.
Updated · AppBreakup editorial · Web
Is Veracode free?
No, it's a paid product
5 alternatives with a free optionSwitch from Veracode to
All 7- Verified facts
- 4 of 4
- Alternatives ranked
- 7
- Approved reviews
- 0
- Visits sent from here
- 0
About Veracode
Veracode is a veteran enterprise application security vendor. Its platform includes static analysis (SAST) that scans compiled code or source, dynamic testing (DAST) for running web apps, software composition analysis for open-source dependencies, a package firewall that blocks malicious packages before they reach a build, and container scanning. Veracode Fix uses AI to suggest code changes for flaws, and Risk Manager provides application security posture management across tools. Beyond scanners it sells secure-coding eLearning, hands-on security labs, penetration testing as a service and consulting, which suits organisations that need to prove compliance as well as find bugs. It integrates with IDEs, source control and CI pipelines. Pricing is not published and is sold through sales on annual contracts. Veracode is mostly chosen by large enterprises and regulated industries; smaller teams often find developer-first tools quicker to adopt.
Best for: Regulated enterprises that want scanning, training and pen-testing services from one vendor.
Pros and cons
What works
- SAST, DAST, SCA and container scanning in one platform
- Developer training and security labs included in the portfolio
- Package firewall blocks malicious dependencies early
Why people leave
- No published pricing or self-serve free tier
- Cloud-only platform
- Geared to large organisations and compliance programmes
Veracode vs SonarQube, Checkmarx and Semgrep
From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.
| Attribute | Veracode | SonarQube | Checkmarx | Semgrep |
|---|---|---|---|---|
| Pricing | Paid | Free plan + paid | Paid | Free plan + paid |
| Verified price | — | $34/month (Team plan, up to 100k LOC) | — | $30 per contributor/month (Teams) |
| Free plan | No | Private projects up to 50k LOC | No | Yes, up to 10 contributors |
| Open source | No | Yes | No | Yes |
| Self-hostable | No | Yes | No | No |
| Platforms | Web | Web, Self-hosted | Web | Web, Windows, macOS, Linux |
Top Veracode alternatives
See all 7- 1
SonarQube76.8Code quality plus security rules, with a free self-hosted edition.
- 2
Checkmarx68.8Similar enterprise suite with posture management and API and IaC scanning.
- 3
Semgrep64.8Lighter, developer-first scanning with a free tier and easy custom rules.
- 4
CodeQL59.4GitHub's semantic code analysis, free for public repositories.
- 5
Snyk57.5Developer-first scanning for code, open-source dependencies and containers, with a free tier and IDE plugins.
Why people left Veracode
In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.
No switching stories yet. If you moved away from Veracode, review the app you switched to and tell us why.
Reviews
No approved reviews yet. How we verify reviewers
Write a review of Veracode
Veracode: common questions
What is Veracode?
Veracode: Enterprise application risk management with SAST, DAST, SCA, container scanning and AI fixes. Best for regulated enterprises that want scanning, training and pen-testing services from one vendor. Available for Web.
Is Veracode free?
No, Veracode is a paid product.
Is Veracode open source?
No, Veracode is not open source. Open-source alternatives include SonarQube and Semgrep.
What platforms does Veracode run on?
Veracode is available for Web.
What are the best alternatives to Veracode?
The highest-ranked Veracode alternatives right now are SonarQube, Checkmarx and Semgrep. See the full ranked list for pricing, platforms and verified facts.
Veracode vs SonarQube: what's the difference?
Veracode is a paid product; SonarQube is free with paid plans. SonarQube is open source and Veracode is not. Both run on Web.