Try our new research platform with insights from 80,000+ expert users

CAST Application Intelligence Platform vs Veracode comparison

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

CAST Application Intelligen...
Average Rating
7.0
Reviews Sentiment
8.0
Number of Reviews
4
Ranking in other categories
Software Development Analytics (3rd)
Veracode
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

While both are Application Lifecycle Management solutions, they serve different purposes. CAST Application Intelligence Platform is designed for Software Development Analytics and holds a mindshare of 7.6%, down 9.2% compared to last year.
Veracode, on the other hand, focuses on Application Security Tools, holds 5.4% mindshare, down 10.5% since last year.
Software Development Analytics Market Share Distribution
ProductMarket Share (%)
CAST Application Intelligence Platform7.6%
SonarQube42.1%
Snyk32.8%
Other17.5%
Software Development Analytics
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Veracode5.4%
SonarQube17.9%
Checkmarx One10.2%
Other66.5%
Application Security Tools
 

Featured Reviews

reviewer2315901 - PeerSpot reviewer
Senior Consultant at a consultancy with 51-200 employees
Helps identify and correct software flaws effectively
CAST AIP supports software process improvement by providing insights into code quality, security, and architecture, aiding in the enhancement of development processes. CAST AIP helps identify and correct software flaws and it is one of the main strengths of the solution. The automated code review process in CAST AIP is beneficial and can contribute to the digital transformation of IT shops. Integrating AIP with existing development tools and ecosystems is challenging but beneficial. With proper support and technical assistance, the process becomes smoother. I would recommend CAST AIP for organizations with well-established and clear software processes. However, for organizations with complex or less-defined processes, it may not be the best fit. Overall, I would rate CAST AIP as a seven out of ten.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of the CAST Application Intelligence Platform is its security dashboard which is a dedicated dashboard that's pretty helpful because it gives compliance checks based on some of the leading frameworks in the industry, such as ISO 5055, OWASP, CWE Top 25, and NIST security guidelines. I find the security dashboard of the solution and the information it provides pretty useful. The security dashboard of the CAST Application Intelligence Platform is a feature that stands out."
"CAST's risk and security flow detection capabilities are highly effective, particularly in identifying security vulnerabilities. It is one of the most important and valuable features of the platform."
"Used for controlling the technical debt and code quality."
"Our clients use CAST Highlight for cloud migration. This allows them to remove or remediate the blockers which are highlighted. This part of the solution shows improvement in quality and captures feedback for our clients."
"It supports most programming languages."
"The integration with DevOps pipelines is seamless."
"For use cases where our company buys a product with the source code, but only the final executables or the binaries, only Veracode is able to work on that type of tool."
"The solution can scan old databases and old code written 20 years back."
"The CI/CD integration is the most valuable feature of Veracode."
"The SAST and DAST modules are great."
"It pinpoints the errors. Its accuracy is very interesting. It also elaborates on flaws, meaning it provides you with details about what is valid or not and how something can be fixed."
"Veracode saves us a lot in terms of security, ensuring that external users or others cannot easily hack our system, which is the main motive for using Veracode."
"When we do have errors, Veracode is always available, their consultants, to help us either mitigate the error, or provide technical assistance on pointing exactly where the problem is and how we could probably fix it. I'm always amazed at how knowledgeable they are."
 

Cons

"The integration of this solution could be improved."
"It has very few plugins to access different code repositories, so source code has to be fed."
"The overall coverage of rules could be improved in the CAST Application Intelligence Platform because it does not cater to or cover all. For example, 2022 CWE coverage is still not available in the CAST Application Intelligence Platform. The solution also covers some NIST rules, but it does not cater to all rules. An additional feature I'd like to see in the next update of the CAST Application Intelligence Platform is for it to provide source code developer and contributor details, especially information on which areas of code were touched. This would be a good insight as the CAST Application Intelligence Platform looks into the source code."
"Implementation could be made more simpler as it is complex."
"Areas for improvement in CAST AIP include enhancing support for implementation in complex environments and improving technical support to address organizational challenges alongside engineering issues."
"I've found that Veracode is not particularly suitable for Dynamic Application Security Testing."
"Sometimes we get a lot of false positives even after configuring our policies, so that could be improved."
"On-premise implementation is not available."
"Veracode should include the feature to run multiple scales at a time."
"There are few languages that take time for scanning. It covers the majority of languages from C to Scala, but it doesn't support certain languages and the newer versions of certain languages. For example, it doesn't support SAP and new JavaScript frameworks such as Node.js and React JS. They can include support for these. If you go to their website, you can see the list of languages that are currently supported. The false-positive rates are also something they can work on."
"It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback."
"It's very expensive for a small organization."
"Some important languages are not supported."
 

Pricing and Cost Advice

"I do know how the CAST Application Intelligence Platform is licensed, but I'm not able to give the cost because the price is not listed. My company works with individual vendors, so pricing is on a case-to-case basis, but the vendors give specialized pricing because of the enterprise deployment, though my team is aware of product pricing based on lines of code, based on the number of applications, etc., I'm unable to give the exact licensing costs of the CAST Application Intelligence Platform. My company doesn't have to pay extra for some features or services because all are included as part of the enterprise license. On a scale of one to five, with five being very cheap and one being very expensive, I would rate the CAST Application Intelligence Platform as three out of five."
"It is very reasonably priced compared to what we were paying our previous vendor. For the same price, we are getting much more value and reducing our AppSec costs from 40 to 50 percent."
"To my knowledge, licensing for Veracode Static Analysis is paid yearly by my company."
"It is an expensive solution, but it's the best solution available on the market. If you want something at the top, you have to pay a bit more than the average."
"Pricing/licensing is complicated."
"I have not examined Veracode's pricing in detail, but from an industry perspective, I see that there is a tendency toward Veracode, which suggests competitive pricing."
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"Its cost for what we needed it for was too high. It wasn't too high for other companies and it was competitively priced, but for us, it just didn't fit. We did plan to use it and increase the usage. In the end, it may have been abandoned because of the cost, but I'm not a hundred percent sure. So, even though we had planned on using it more and more, because of the cost and the business conditions of things, we didn't have the opportunity to really use it more."
"Its complexity makes it quite expensive, but it’s all worth it, with all the engineering in the background."
report
Use our free recommendation engine to learn which Software Development Analytics solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
14%
Government
9%
Healthcare Company
6%
Financial Services Firm
17%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise44
Large Enterprise115
 

Questions from the Community

What do you like most about CAST Application Intelligence Platform?
CAST's risk and security flow detection capabilities are highly effective, particularly in identifying security vulnerabilities. It is one of the most important and valuable features of the platfor...
What needs improvement with CAST Application Intelligence Platform?
Areas for improvement in CAST AIP include enhancing support for implementation in complex environments and improving technical support to address organizational challenges alongside engineering iss...
What is your primary use case for CAST Application Intelligence Platform?
CAST AIP is a valuable solution for quality metrics and application security. It is beneficial for software architecture detection.
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Also Known As

CAST AIP
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Steria, T-Systems MMS, Atos Origin, Accenture, Capgemini
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.