No more typing reviews! Try our Samantha, our new voice AI agent.

Kiuwan vs Veracode comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Kiuwan
Ranking in Application Security Tools
34th
Ranking in Static Application Security Testing (SAST)
29th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
23
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Application Security Tools
3rd
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Container Security (14th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (3rd)
 

Mindshare comparison

As of November 2026, in the Application Security Tools category, the mindshare of Kiuwan is 1.2%, up from 1.1% compared to the previous year. The mindshare of Veracode is 4.2%, down from 6.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Veracode4.2%
Kiuwan1.2%
Other94.6%
Application Security Tools
 

Featured Reviews

Mustufa Bhavnagarwala - PeerSpot reviewer
CyberRisk Solution Advisor at a consultancy with 10,001+ employees
Though a stable tool, the UI needs improvement
Kiuwan can improve its UI a little more. The user experience can be made better. Kiuwan offers a user interface that is similar to the one offered by Windows 7 or Windows 98, which I saw when I ran the tool and tried to scan the repository to find the security issues. The product's UI has certain shortcomings, where improvements are required.
YS
Software Development Engineer II at Rocket Software
Monthly scans have provided baseline security but still miss critical vulnerabilities
Veracode can improve to stand in this market. They do not have to do much; they just need to improve their UI experience and add more documentation within the application rather than just creating documentation pages on different websites. They need to ensure their web application guides whoever uses it. Since whoever uses Veracode must be a technical person, they just need to guide them to the actual points. They can also improve their security capabilities by adding more filters to identify what vulnerabilities their application has. They need to improve their scanning engine to scan for more critical defects. Also, the integration part can be enhanced by adding features to integrate with a CLI, such as introducing a CLI version or a Jenkins plugin. If such features exist, they should show it as a pop-up, signaling that they have a new feature. Currently, it feels Veracode from two years ago is still the same, so that is something Veracode needs to improve. They can improve the security part. Some of the severe security issues were never caught by Veracode in the reports. In fact, I have never seen any high or critical severity issues pop up in my Veracode report. That is one thing they can improve on their scanning ability to catch high severity issues. Next is integration; Veracode does not provide any tools to integrate with Jenkins or CLI. I do not even know if there is any CLI for Veracode that I can use to automate in my pipeline. The last thing is the UI interface that they have, as it is a bit confusing. I remember we did not have the capability to handle authentications of our internal application. We had to write Selenium code using a Selenium IDE. To write a Selenium script for a Veracode scan, you have to download a Selenium IDE, record it, and then paste that file into Veracode. I can see that Selenium IDE is already decommissioned, so it is no longer used by anyone. Still, we have to use it because Veracode only supports that kind of file for Selenium to automate. They can add more ways to authenticate our application using normal JavaScript or Python or Shell script. I feel these are the four main points. They can document it more by adding tooltips into the application that explain why a parameter is required and what other options are available. For the same example with the Selenium script, they can add a link to their documentation that explains what other kinds of scripts can be written for authentication. I feel they can also make the UI more intuitive so that whoever uses it can guide themselves, as whoever uses Veracode is already a technical person.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable feature of the solution stems from the fact that it is quick when processing and giving an output or generating a report."
"I advise using Kiuwan because it's very straightforward and totally easy to understand."
"The technical support is very good, and we have received valid answers to our questions."
"The most valuable feature is the time to resolution, where it tells you how long it is going to take to get to a zero-base or a five-star security rating."
"The solution offers very good technical support."
"In our digital marketing efforts, our app is in continuous integration and having introduced this tool ensures we are always delivering safe code."
"​We use Kiuwan to locate the source of application vulnerabilities."
"From the tool itself, the developer can run an analysis with the same quality, and with this tool, every developer has the opportunity to do an unlimited analysis."
"You can easily integrate it with Azure DevOps. This is an added value because we work with Azure DevOps. Veracode is natively supported and we don't have to work with APIs."
"The most valuable feature is the efficiency of the tool in finding vulnerabilities."
"Valuable features for us are the static scanning of the software, which is very important to us; the ability to set policy profiles that are specific to us; the software composition analysis, to give us reports on known vulnerabilities from our third-party components."
"Implementing such a high-quality tool like Veracode immediately made us aware of a lot of issues, and the new release that we have is according to our policy, which is an important thing for us and definitely helps in reducing the risk of a security breach, which is rather important for us for providing our customers with a secure product."
"Veracode is a valuable tool in our secure SDLC process."
"Tech support is outstanding. Best in class. Absolutely. They bend over backwards to help us. We'll come up with questions and within minutes, we'll get answers. It's amazing. It's truly amazing."
"Overall, we've never had any problem with vulnerable code going into production."
"We have used the results of scans to train our people and make them more sensitive to security issues during development, and our customers benefit from the fact that the application is more secure."
 

Cons

"The configuration hasn't been that good."
"We faced a lot of problems with the initial setup and support gave us difficulties around the installation."
"The next release should include more flexibility in the reporting."
"I would like to see better integration with the Visual Studio and Eclipse IDEs."
"The pricing and licensing models are poor."
"DIfferent languages, such Spanish, Portuguese, and so on."
"More languages and frameworks would enhance this tool."
"Improvement could be made with the integration of the programming tools."
"We tried to create an automatic scanning process for Veracode and integrate it into our billing process, but it was easier to adopt it to repositories based on GIT. Until now, our source control repository was Azure DevOps Server (Microsoft TFS) to managing our resources. This was not something that they supported. It took us some sessions together before we successfully implemented it."
"It would be better if we had a channel for direct communication with the engineering team to speed up the process of providing feedback."
"There should be more APIs, especially in SCA, to get some results or automate some things."
"The technical support service has room for improvement."
"I would also like to see some improvement in the speed. Our developers are saying, "It takes 72 hours to scan it.""
"The scanning on the UI portion of our applications is straightforward, but folks were having challenges with scans that involved microservices. They had to rope in an expert to have it sorted."
"It does not have a reporting structure for an OS-based vulnerability report, whereas its peers such as Fortify and Checkmarx have this ability. Checkmarx also provides a better visibility of the code flow."
"It could have better integration with our pipeline. If we could have better integration with our application pipeline, e.g., Jira, Bamboo, or Azure DevOps, then that will be very helpful. Right now, it is quite hard to integrate the solution into our existing pipeline."
 

Pricing and Cost Advice

"This solution is cheaper than other tools."
"I recommend contacting a sales person who will create the best plan payment plan for you, as we did."
"Check with your account manager."
"Kiuwan is an open-source solution and free to use."
"It follows a subscription model. I think the price is somewhere in the middle."
"The price of Kiuwan is lower than that of other tools on the market."
"Nothing special. It's a very fair model."
"Its cost for what we needed it for was too high. It wasn't too high for other companies and it was competitively priced, but for us, it just didn't fit. We did plan to use it and increase the usage. In the end, it may have been abandoned because of the cost, but I'm not a hundred percent sure. So, even though we had planned on using it more and more, because of the cost and the business conditions of things, we didn't have the opportunity to really use it more."
"For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization."
"It has good, fair licensing. If the price could depend on the scope of its scanning or the languages supported, then that would be better."
"The pricing of the product depends upon the number of codes or the number of applications."
"The pricing is reasonable compared to other tools."
"The cost of Veracode is high."
"Costs are reasonable. No special infrastructure is required and the license model is good."
"The cost of scanning code is cheaper. It's typically $0.50 per line of code. However, it's expensive to run a high-level process that would normally require a human security expert. For example, penetration testing costs about $1,000 per application for penetration testing. The cost of these features may be too high for smaller organizations. On the other hand, Veracode's interactive application security testing is fast and cheaper compared to other software."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
920,929 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
12%
Manufacturing Company
10%
Financial Services Firm
9%
University
7%
Financial Services Firm
15%
Manufacturing Company
12%
Outsourcing Company
9%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise4
Large Enterprise6
By reviewers
Company SizeCount
Small Business70
Midsize Enterprise46
Large Enterprise114
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

DHL, BNP Paribas, Zurich, AXA, Ernst & Young, KFC, Santander, Latam, Ferrovial
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Kiuwan vs. Veracode and other solutions. Updated: November 2026.
920,929 professionals have used our research since 2012.