No more typing reviews! Try our Samantha, our new voice AI agent.

Kiuwan vs Veracode comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Kiuwan
Ranking in Application Security Tools
29th
Ranking in Static Application Security Testing (SAST)
27th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
23
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Application Security Tools
3rd
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Container Security (12th), Software Composition Analysis (SCA) (2nd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

As of June 2026, in the Application Security Tools category, the mindshare of Kiuwan is 1.2%, up from 1.2% compared to the previous year. The mindshare of Veracode is 4.3%, down from 9.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Veracode4.3%
Kiuwan1.2%
Other94.5%
Application Security Tools
 

Featured Reviews

Mustufa Bhavnagarwala - PeerSpot reviewer
CyberRisk Solution Advisor at a consultancy with 10,001+ employees
Though a stable tool, the UI needs improvement
Kiuwan can improve its UI a little more. The user experience can be made better. Kiuwan offers a user interface that is similar to the one offered by Windows 7 or Windows 98, which I saw when I ran the tool and tried to scan the repository to find the security issues. The product's UI has certain shortcomings, where improvements are required.
reviewer2753535 - PeerSpot reviewer
DevSecOps Engineer at a tech services company with 1,001-5,000 employees
Integrates security into the development process and improves team collaboration
Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Saving time and money by automatically identifying problems is unbelievable."
"The solution will measure your development team, give a KPI for the CISO, reduce the time it takes to find and correct coding errors, and more."
"With Kiuwan, we were able to help our clients get a better visibility of their development activities and to mitigate risks."
"I've tried many open source applications and the remediation or correction actions that were provided by Kiuwan were very good in comparison."
"I personally like the way it breaks down security vulnerabilities with LoC at first glance."
"​We use Kiuwan to locate the source of application vulnerabilities."
"We have had an improvement of 20% in our time to market and it significantly improved the quality of our code."
"The solution offers very good technical support."
"The time savings has been tremendous. We saw ROI in the first six months."
"I like the static scanning, and Veracode's interface is excellent. The dashboard is easy to navigate."
"All of the Veracode applications operate as one platform, and with Veracode, you get a single pane of glass and reporting that you can combine with the different scan types to look at compliance."
"Within SCA, there is an extremely valuable feature called vulnerable methods. It is able to determine within a vulnerable library which methods are vulnerable. That is very valuable, because in the vast majority of cases where a library is vulnerable, none of the vulnerable methods are actually used by the code. So, if we want to prioritize the way open source libraries are updated when a library is found vulnerable, then we want to prioritize the libraries which have vulnerable methods used within the code."
"One thing we like is the secret detection feature. It has helped us to discover keys stored in our settings file as a TXT document. We can address that vulnerability by using encryption. We can even scan Docker images for vulnerabilities. Static analysis is another good feature of Veracode because we can run a security scan during development to identify the vulnerabilities."
"Veracode has impacted our overall security posture because we are from a security background. Every week, we review the dashboards of open findings."
"It gives feedback to developers on the effectiveness of their secure coding practices."
"I contacted the solution's technical support during the automation part, and it went well, after which I never faced any issues."
 

Cons

"More languages and frameworks would enhance this tool."
"The solution seems to give us a lot of false positives. This could be improved quite a bit."
"The QA developer and security could be improved."
"Kiuwan's support has room for improvement. You can only open a ticket is through email, and the support team is outside of our country. They should have a support number or chat."
"I would like to see better integration with the Visual Studio and Eclipse IDEs."
"It could improve its scalability abilities."
"Improvement could be made with the integration of the programming tools."
"The next release should include more flexibility in the reporting."
"Once your report has been generated, you need to review the report with consultation team, especially if it is too detailed on the development side or regarding the language. Then, you need some professional help from their end to help you understand whatever has been identified. Scheduling consultation takes a longer time. So, if you are running multiple reports at the same time, then you need to schedule a multiple consultation times with one of their developers. There are few developers on their end who work can work with your developers, and their schedules are very tight."
"The documentation is poor and the technical support isn't helpful."
"I think if they could improve the operations around accepted vulnerabilities, we would see improvements in our productivity."
"We have approximately 900 people using the solution. The solution is scalable, but there is a high cost attached to it."
"The Web portal, at times, is not necessarily intuitive. I can get around when I want to but there are times when I have to email my account manager on: "Hey, where do I find this report?" Or "How do I do this?" They always respond with, "Here's how you do it." But that points to a somewhat non-intuitive portal."
"For one or two particular applications, the dynamic code analysis can take too much time. Sometimes, it takes three days or more."
"I would love to be able to do a dynamic sandbox scan."
"Scheduling can be a little difficult. For instance, if you set up recurring scheduled scans and a developer comes in and says, "Hey, I have this critical release that happened outside of our normal release patterns and they want you to scan it," we actually have to change our schedule configuration and that means we lose the recurring scheduling settings we had."
 

Pricing and Cost Advice

"The price of Kiuwan is lower than that of other tools on the market."
"Check with your account manager."
"Kiuwan is an open-source solution and free to use."
"I recommend contacting a sales person who will create the best plan payment plan for you, as we did."
"Nothing special. It's a very fair model."
"This solution is cheaper than other tools."
"It follows a subscription model. I think the price is somewhere in the middle."
"Veracode has been fair. We use their SaaS solution and it's just an annual subscription."
"Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive."
"No issues, the pricing seems reasonable."
"Veracode is costly. They have different license models for different customers. What we had was based on the amount of code that has been analyzed. The license that we had was capped to a certain amount, for example, 5 Gig. There would be an extra charge for anything above 5 Gig."
"Veracode is a very expensive product."
"The Veracode price model is based on application profiles, which is how you package your components for scanning."
"Negotiate some, but their prices are reasonable."
"Veracode's pricing is competitive."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
900,644 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Construction Company
11%
University
11%
Manufacturing Company
8%
Computer Software Company
8%
Financial Services Firm
16%
Manufacturing Company
12%
Computer Software Company
9%
Construction Company
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise4
Large Enterprise6
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise46
Large Enterprise114
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Comparisons

 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

DHL, BNP Paribas, Zurich, AXA, Ernst & Young, KFC, Santander, Latam, Ferrovial
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Kiuwan vs. Veracode and other solutions. Updated: June 2026.
900,644 professionals have used our research since 2012.