No more typing reviews! Try our Samantha, our new voice AI agent.

CAST Highlight vs Veracode comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Nov 5, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
9.4
CAST Highlight users saved time and costs significantly, boosting productivity by doubling report output without extra resources.
Sentiment score
6.5
Veracode boosts ROI by reducing security breaches and costs, enhancing compliance, and integrating effective vulnerability detection and automation.
In terms of time saved, it went from approximately 3.5 hours per insight report to around 40 minutes, which is 80% faster.
Senior Data Engineer at LTM
The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.
Senior Solutions Architect at IDS Comercial
Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
We did see a return on investment with Veracode, as we segregated our remediation efforts, which reduced our time to delivery as well as the number of engineers needed to help us in delivering a secure solution.
DevSecOps Engineer at a tech services company with 11-50 employees
 

Customer Service

Sentiment score
7.8
CAST Highlight's customer service receives mixed reviews, with effective technical support but issues in problem resolution and knowledge gaps.
Sentiment score
7.2
Veracode's support is praised for expertise and responsiveness, though some report delays, improvements noted with dedicated managers.
Some support team members are helpful, and others lack in-depth knowledge of the tool, which might cause challenges.
Technical Associate Manager at Accenture
I interacted with customer support regarding one of my project results related to vulnerabilities and license risks, and they explained everything clearly, leaving me very satisfied.
Senior Data Engineer at LTM
Access to the engineering team is crucial for faster feedback on the product fix process.
Principal Architect at a consultancy with 11-50 employees
I have communicated with the technical support of Veracode a couple of times, and this was a really great experience because these professionals know their material.
Application Security Specialist at Herrenknecht
They share detailed information via email, including screenshots or further clarification about the issue.
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
 

Scalability Issues

Sentiment score
7.3
CAST Highlight efficiently handles large codebases, supports many users, and seamlessly manages complex tasks across different environments.
Sentiment score
7.4
Veracode is praised for effective scalability across diverse needs, though costs and complexity can increase with scaling.
The processing time per new report stays consistent, experiencing no slowdowns even when we had over 200 new reports dropped in a week.
Senior Data Engineer at LTM
Cloud solutions are easier to scale than on-premise solutions.
Senior Solutions Architect at IDS Comercial
It has a good capacity to scale effectively.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
Implementing these features into our normal CI/CD was good, so I can say that scalability is really good.
Application Security Specialist at Herrenknecht
 

Stability Issues

Sentiment score
8.0
CAST Highlight is reliable with minor bugs, facing challenges in data transfer and complex .NET framework compatibility.
Sentiment score
7.8
Veracode is generally stable with minor glitches, but could improve speed and communication for enhanced reliability.
CAST Highlight proves reliable in nature.
Senior Data Engineer at LTM
If the Veracode server is down, we experience many issues during the scan.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
I have observed that it is not that reliable in terms of security because Veracode was not able to find some security threats in our application that existed since the product was developed.
Software Development Engineer II at Rocket Software
It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
 

Room For Improvement

CAST Highlight users seek better configuration, support, reporting, and integration while desiring enhanced abstraction, descriptions, and language insights.
Veracode is criticized for high costs, licensing rigidity, false positives, slow UI, and limited integration and language support.
Understanding only the OS-specific blockers means I would avoid resolving irrelevant issues, thus saving time.
Technical Associate Manager at Accenture
CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing.
Senior Data Engineer at LTM
If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.
We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.
Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees
A nice addition would be if it could be extended for scenarios with custom cleansers.
IT App Security Senior Analyst at a transportation company with 10,001+ employees
 

Setup Cost

CAST Highlight charges by scan number with optional support upgrades; costs vary in perception and are often compared to CAST AIP.
Veracode's pricing is high and complex, valued by enterprises but expensive for smaller businesses with flexible options.
It's not the most expensive solution.
Senior Solutions Architect at IDS Comercial
Overall, Veracode's pricing is lower and more scalable than many alternatives in the market.
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
If there's a security gap, you'll never know the cost or effect.
 

Valuable Features

CAST Highlight excels in user-friendliness, integration, fast automation, and insightful code analysis, enhancing productivity with intuitive tools.
Veracode offers effective security analysis, CI/CD integration, multi-language support, and detailed reports for secure, compliant software development.
Smart deduplication groups similar quotes and picks the strongest and most significant one. It stops insights from showing eight variations of great UI, giving diverse voices instead of repetition.
Senior Data Engineer at LTM
In cloud migration, I use CAST highlight to identify blockers, which are the negative road patterns, and also the boosters, which are positive code patterns.
Technical Associate Manager at Accenture
It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.
Site Leader (India) at Industrial Scientific
The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.
It fixes issues directly in the IDE while you're doing it.
IT App Security Senior Analyst at a transportation company with 10,001+ employees
 

Categories and Ranking

CAST Highlight
Ranking in Software Composition Analysis (SCA)
19th
Average Rating
7.8
Reviews Sentiment
7.3
Number of Reviews
8
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Software Composition Analysis (SCA)
2nd
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Container Security (12th), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

As of June 2026, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 1.2%, up from 0.9% compared to the previous year. The mindshare of Veracode is 5.9%, down from 9.5% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Software Composition Analysis (SCA) Mindshare Distribution
ProductMindshare (%)
Veracode5.9%
CAST Highlight1.2%
Other92.9%
Software Composition Analysis (SCA)
 

Featured Reviews

Nishant Chauhan - PeerSpot reviewer
Senior Data Engineer at LTM
Automated code insights have improved security checks and made review workflows more consistent
If I talk about improvements for CAST Highlight, I would suggest three things. The first is better understanding or niche understanding. Right now, the intent matching is strong for general topics such as ease of use, but for niche B2B terms such as HIPAA compliance or multi-tenant architecture, it sometimes misses context. Improving the domain-specific models would make highlights more accurate for these verticals. The second improvement is more control over the deduplication logic. CAST Highlight's deduplication is great for avoiding spam, but sometimes we want two similar quotes if they are from very different company sizes, such as SMB versus enterprise perspectives on pricing. A slider to adjust deduplication strictness would help. The third suggestion I would like to give is deeper sentiment and outcome tagging. While it has core sentiment capabilities, it does not tag outcomes automatically. For instance, if a quote mentions saved $50,000 per year, tagging that as cost savings $50,000 would let us build ROI charts instantly instead of reading each quote manually. Regarding user experience, integrations, and reporting, I think there is room to enhance those aspects. Regarding user experience, I would suggest improving user actions in terms of bulk actions and keyboard shortcuts. Day-to-day analysts review 50-plus suggested quotes, and currently it is mostly clicking to approve one by one. Adding bulk approve or reject options and keyboard shortcuts would significantly reduce the time taken. A small UX change can lead to a big speed boost. The second point is integrations when pushing to the CMS and Slack alerts. Right now, we export approved highlights manually from CAST Highlight. If CAST Highlight could push directly to our CMS or send Slack alerts for high-strength quotes that hit trending topics, it would close the loop faster, reducing copy-pasting. The third improvement relates to reporting, specifically custom insight dashboards. The tool displays which topics have the most highlights, but we cannot build custom dashboards yet. For example, showing all security quotes from healthcare companies with more than 1,000 employees over the last 90 days would enable better filtering, and exportable dashboards would streamline quarterly reviews.
reviewer2753535 - PeerSpot reviewer
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
Integrates security into the development process and improves team collaboration
Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.
report
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Outsourcing Company
8%
Government
8%
Computer Software Company
8%
Financial Services Firm
16%
Manufacturing Company
12%
Computer Software Company
9%
Construction Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business2
Midsize Enterprise1
Large Enterprise6
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise46
Large Enterprise114
 

Questions from the Community

What is your experience regarding pricing and costs for CAST Highlight?
The pricing of CAST Highlight was not considered expensive or cheap, and no specific comment was made about the setup cost.
What needs improvement with CAST Highlight?
The solution provides agnostic blockers for platforms as well as for containerization. Within that containerization, it offers generic blockers. However, my project might require it to provide Wind...
What is your primary use case for CAST Highlight?
For CAST, I use it in cloud migration roadmap and in open source safety issues. These are my two main use cases.
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about CAST Highlight vs. Veracode and other solutions. Updated: June 2026.
900,644 professionals have used our research since 2012.