Try our new research platform with insights from 80,000+ expert users

Apiiro vs Veracode comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex Cloud by Palo Alto N...
Sponsored
Ranking in Application Security Posture Management (ASPM)
9th
Average Rating
8.6
Reviews Sentiment
5.4
Number of Reviews
5
Ranking in other categories
Vulnerability Management (38th), Cloud Workload Protection Platforms (CWPP) (17th), Cloud Security Posture Management (CSPM) (23rd), Cloud-Native Application Protection Platforms (CNAPP) (16th), Data Security Posture Management (DSPM) (14th), Software Supply Chain Security (14th), Cloud Infrastructure Entitlement Management (CIEM) (7th), Cloud Detection and Response (CDR) (9th)
Apiiro
Ranking in Application Security Posture Management (ASPM)
6th
Average Rating
8.0
Reviews Sentiment
6.4
Number of Reviews
3
Ranking in other categories
Static Application Security Testing (SAST) (24th), Software Composition Analysis (SCA) (14th), API Security (15th), Software Supply Chain Security (7th), Risk-Based Vulnerability Management (17th)
Veracode
Ranking in Application Security Posture Management (ASPM)
1st
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st)
 

Featured Reviews

Nuno-Santos - PeerSpot reviewer
Cybersecurity Analyst at a tech services company with 11-50 employees
Has improved real-time threat detection and unified cloud protection through AI and automation
Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent. They changed the names of the products and are now clarifying their offer. The family of the products is not easy to follow because it's very recent. Regarding the generative AI security tool, I know for sure it's Agentic. Based on my experience with Palo Alto, I can suggest what Cortex Cloud by Palo Alto Networks could make better or what additional functions could be added. This is the best tool in the market. It's not the time to tell what they could do better because it's a recent tool. The market is now adopting it. Our experience doesn't show that they need to do more.
Kunal M - PeerSpot reviewer
Capability Center Leader, ETRM Platforms at Shell
Comprehensive risk analysis helps identify key performance trends but report access needs improvement
My first feedback for Apiiro is that it is very slow, extremely slow. The moment I select from the entire list of repositories in my vertical, which is almost more than 400 repositories, it takes a lot of time for me to load the report. Sometimes it fails. I do not have Role-Based Access Control (RBAC). It's only given to the application security team, and Apiiro as a vendor does not have the rollback access control enabled for the clients, so that would have given me access to the reports tab, which would have made my life easier. Currently, I have to go to the risks tab to pull out all this information. I started exploring dashboards with Copilot. I need to reach out to the Apiiro teams to see if I can get an access token so that I can pull out a Power BI dashboard. I think Apiiro definitely has its own capabilities, but if there are access tokens that teams can use to build a custom dashboard, that would be great. This might already exist, but that is something which will ease the vulnerability management day-to-day activities.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."
"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."
"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."
"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."
"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."
"The workflow automation is likely the best aspect of the solution."
"The positive impact I have seen from working with Apiiro for my company includes the metrics that we get from Apiiro, which have been extremely helpful."
"Apiiro's secrets detection feature has saved us several times, which we appreciate greatly."
"The static scan is the most valuable feature."
"The source composition analysis had very good reporting."
"The static scan is the feature that we use the most, as it gives us insight into our source code. We have it integrated with our continuous integration, continuous delivery system, so we can get insight quickly."
"Wide range of platforms and technology assessments."
"One benefit is that we have automated the scanning process."
"It eases integration into our workflow. Veracode is part of our Jenkins build, so whenever we build our software, Jenkins will automatically submit the code bundle over to Veracode, which automatically kicks off the static analysis. It sends an email when it's done, and we look at the report."
"Scanning of .war and .jar is key for us."
"Stable and scalable, with good reporting features. Helps in detecting and managing vulnerabilities and risks."
 

Cons

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."
"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."
"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."
"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."
"User management is a little bit clunky."
"I would like support for our self-hosted Git server, other than GitHub, just regular Git."
"I would like to see expanded coverage for supporting more platforms, frameworks, and languages."
"Veracode is costly, and there is potential for improvement in its pricing."
"One of the most important areas that need improvement for Veracode is its DaaS. Veracode's DAST engines are primitive."
"The documentation is poor and the technical support isn't helpful."
"The GUI requires significant simplification, as its current complexity creates a steep learning curve for new users."
"It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback."
"When we engaged Veracode to conduct the manual penetration testing, they were extremely slow in completing the task and delivering the report, causing a delay of two to three weeks for us."
"The language version support could be improved."
 

Pricing and Cost Advice

Information not available
Information not available
"The pricing and licensing are reasonable, and relatively straightforward, and different licensing and subscription models are available."
"Veracode is expensive. But the solution is worth it."
"Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode."
"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."
"The pricing is fair."
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works."
"The price of Veracode Static Analysis is expensive. There is an annual fee to use the solution and the company is upfront with the pricing model and fees."
"It's too expensive for the European market. That is why, in a big bank with 400 applications, we are able to use it only for 10 of them. But the other solutions are also expensive, so it wasn't a differentiator."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Performing Arts
10%
Financial Services Firm
10%
Manufacturing Company
9%
Computer Software Company
8%
Computer Software Company
19%
Financial Services Firm
13%
Outsourcing Company
9%
University
8%
Financial Services Firm
17%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
No data available
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise44
Large Enterprise115
 

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?
The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...
What needs improvement with Cortex Cloud by Palo Alto Networks?
Regarding areas for improvement, the tool performs its functions well, but frequent name changes across Palo Alto Net...
What is your primary use case for Cortex Cloud by Palo Alto Networks?
Cortex Cloud by Palo Alto Networks serves as our primary tool for understanding our assets and performing API integra...
What needs improvement with Apiiro?
My first feedback for Apiiro is that it is very slow, extremely slow. The moment I select from the entire list of rep...
What is your primary use case for Apiiro?
My only use case is the reporting, which is correct. My role is limited because this is an additional role that I do ...
What advice do you have for others considering Apiiro?
I haven't explored Apiiro's advanced risk analysis features. I have not used the compliance monitoring feature of Api...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Also Known As

No data available
Apiiro Control Plane (ASOC), Apiiro API Security (SAST), Apiiro Open Source (SCA)
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Information Not Available
Morgan Stanley, Rakuten, Jack Henry, SoFi, Colgate, Navan
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Apiiro vs. Veracode and other solutions. Updated: December 2025.
881,082 professionals have used our research since 2012.