Legit Security vs Veracode comparison

Legit Security and Veracode are both solutions in the Application Security Posture Management (ASPM) category. Legit Security is ranked #15, while Veracode is ranked #2 with an average rating of 7.5. Legit Security holds a 2.5% mindshare in ASPM, compared to Veracode’s 9.7% mindshare. Additionally, 100% of Legit Security users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 13, 2024

Veracode and Legit Security compete in software security solutions, each having distinct advantages. Veracode leads in pricing and support, while Legit Security may have an edge with its robust features.

Features: Veracode offers a range of security testing options including static and dynamic analysis, and software composition analysis. It is recognized for its integration capabilities and extensive scanning suite. Legit Security is notable for its CI/CD security integrations and real-time risk assessment, appealing to organizations focused on continuous integration practices.

Room for Improvement: Veracode could enhance its user interface for better ease of use, reduce false positives, and improve the speed of its scans. Legit Security might benefit from refining its secret detection capabilities, addressing its false positive rate, and expanding its feature set for broader security coverage.

Ease of Deployment and Customer Service: Veracode's straightforward SaaS deployment model is complemented by dedicated support. It integrates well but follows a more traditional installation process. Legit Security also offers a SaaS model with quick deployment and personalized service, promising faster configuration and setup.

Pricing and ROI: Veracode provides competitive pricing with an ROI focus through a broad suite of security features, beneficial for larger enterprises. Legit Security’s pricing aligns with its focus on CI/CD pipelines, offering a specific ROI advantage for companies prioritizing pipeline security.

To learn more, read our detailed Legit Security vs. Veracode Report (Updated: June 2026).

Buyer's Guide

Legit Security vs. Veracode

June 2026

Download the complete report

Helped 908,834 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex Cloud by Palo Alto N...

Mindshare comparison

As of August 2026, in the Application Security Posture Management (ASPM) category, the mindshare of Cortex Cloud by Palo Alto Networks is 2.3%, up from 0.3% compared to the previous year. The mindshare of Legit Security is 2.5%, down from 2.7% compared to the previous year. The mindshare of Veracode is 9.7%, down from 19.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Posture Management (ASPM) Mindshare Distribution
Product	Mindshare (%)
Veracode	9.7%
Cortex Cloud by Palo Alto Networks	2.3%
Legit Security	2.5%
Other	85.5%

Application Security Posture Management (ASPM)

Featured Reviews

Sonali Jha

Technical Solutions Architect at IBM

Cloud security has improved as AI-driven runtime protection detects threats and reduces incidents

In my opinion, Cortex Cloud by Palo Alto Networks could be improved or enhanced in various ways. I don't have an idea about that yet because for that you actually need to use two or three different other tools to make a basic comparison. If you ask me how good the tool is, I would fairly rate it quite high. The tool is very popular, and customers can already see that it is one of the cloud leaders in the security space. The platform had a very good feature which provides documentation links about how to use a specific feature on the UI. It takes you to the proper documentation page where it suggests what to do and tells you about the steps that need to be done for a resource deployment. My thoughts about improving the product which I believe could greatly aid vendors is that it used to be a very user-friendly tool, but now they have incorporated everything under one umbrella. It has XDR, XSOAR, and Cortex Cloud by Palo Alto Networks. Before, we used to have separate modules and separate environments for each of these capabilities or features. Right now, it is a little complex and users would take their own time to know the tool better. This is something that would have been way better, but I would say there would be different opinions on this. Talking about user-friendliness, it has decreased now.

Read full review

Tim Crothers

CISO at Mandiant / FireEye

Provides strong visibility, straightforward integration, and reduces the risk of attacks

Legit Security is a product that hyper-focuses on the various aspects of the software development pipeline. For example, if an engineer spins off a new project and stands up a new Git project, Legit automatically detects it, connects Snyk and other tools, and ensures the engineering team doesn't have to think about it. This way, we stay on top of security from the beginning. On the other hand, Legit provides a clear view of the controls around repositories. We have standards requiring code reviews and similar practices, and Legit shows us whether these are being followed. Additionally, Legit helps us identify unmaintained repositories, which often arise when engineering teams try something and leave it behind. This knowledge allows us to determine the appropriate action for these neglected projects. One area where Legit falls short is secret detection. While it functions well overall, the feature has a 10-20 percent false positive rate, requiring some manual intervention. Almost everything else works flawlessly. The true value proposition of Legit lies not in its features but in its ability to support our product security program's focus on creating guardrails instead of toll gates. Unlike traditional programs that require security reviews at specific stages, hindering development flow, we strive to partner with the product engineering team to ship secure code seamlessly within their existing workflows. Legit plays a crucial role in this by automatically notifying us of new projects, eliminating the need for manual communication. This partnership approach, enabled by Legit, allows us to work much closer with our engineering teams than ever before.

Read full review

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

Integrates security into the development process and improves team collaboration

Veracode helps organizations develop software by reducing the risk of security vulnerabilities through developer enablement and applications focused on governance. You can utilize different levels of processes to achieve better performance or a more scalable service. Since I started working with it in 2022, I’ve found it to be cost-effective as well. Overall, Veracode is a user-friendly security tool. It includes features such as Static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Software Composition Analysis (SCA). During the development phase, we can identify vulnerabilities in the application. This process occurs in the staging environment during development. When we're ready to go to production, we conduct a final check. Essentially, this tool helps identify vulnerabilities during the code development stage, including both high-level vulnerabilities and those related to open-source software composition. We utilize specific methodologies for this purpose. Additionally, it offers a feature that allows us to set up policies based on client requirements. This means we can customize the tool to meet the specific needs of our clients, ensuring that they receive the appropriate level of security in their applications. Veracode is user-friendly as well. Compared to other tools, their scans take 15 minutes or under. If you have a large scale of libraries or data, it might take longer, but based on my personal experience, the scan usually runs within fifteen minutes. For my case study using the Veracode tool, I worked on an internal project following industry standards. We used Veracode to improve our security posture and speed up the time to market by streamlining the development process. This enhanced collaboration between developers, operations, and security teams. The automated scanning process helped identify and fix vulnerabilities earlier in the development process. We maintained compliance with regulatory requirements, avoided fines, and built customer trust by integrating security into the development process. When we conduct this scan, we receive data on a list of vulnerabilities. This information improved our communication and increased transparency, which leads to better reports about the efforts being put in. This results in a more effective and efficient collaboration process, making it user-friendly for all involved. When considering costs, if we resort to manual processes, it can be time-consuming. Therefore, we utilize automated scans to identify and fix security issues. This allows us to address vulnerabilities early in the development process, as we discussed previously. This applies both to our in-house code and third-party libraries, using Software Composition Analysis (SCA) agent-based scans. In the future, we will also implement SCA agent-based scans as a separate feature within Veracode, which can help organizations avoid the expensive and time-consuming consequences of security issues. Furthermore, we have seen an increase in compliance, helping to maintain adherence to regulatory requirements and industry standards, thereby avoiding fines and reputational damage associated with noncompliance. Additionally, by integrating security into the development process, we enhance customer trust in our organization and its products.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Cortex Cloud by Palo Alto Networks' cloud runtime security in terms of stopping attacks in real time is impressive."

"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."

"From a technical standpoint or pricing, Cortex Cloud by Palo Alto Networks is a stronger solution in the market at the moment compared to other products from ConnectWise or Symantec."

"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."

"The most valuable features I have found in Cortex Cloud by Palo Alto Networks are those that we provided to customers in a stock environment, as we have done some POCs and tried to check how it can help different organizations, and this same solution has been positioned for multiple customers."

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."

"The capabilities of Cortex Cloud by Palo Alto Networks are valuable because it is the best product in the market."

"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."

More Cortex Cloud by Palo Alto Networks pros

"We implemented Legit Security to gain visibility into all development teams and ensure that consistent controls are in place and accounted for on every route."

"The true value proposition of Legit lies not in its features but in its ability to support our product security program's focus on creating guardrails instead of toll gates."

"Legit has increased my security posture to a level I couldn't achieve before. I don't need to worry as much about what's happening within my developer environments. I can rest assured that my vulnerabilities are being detected."

"Legit has had a positive effect on our overall security posture."

"I like Veracode's ease of integration with various cloud platforms and tools."

"The most valuable feature is the efficiency of the tool in finding vulnerabilities."

"The solution's ability to help create secure software is very valuable; we're a zero-trust networking company so we want to have the ability to say that we're practicing security seriously, and having something like Veracode allows us to have confidence when we're speaking to people about our product that we can back up what we're doing with a certification, with a reputable platform, and say, "This is what we're using to scan an application, here's the number of vulnerabilities that are on an application, and here's the risk that we're accepting.""

"Veracode has positively impacted my organization by helping secure our critical applications, and it has impacted very well."

"Their dashboard is really good, overall. In my opinion, it's one of the best in the market, and I say that because we have used other service providers."

"The time savings has been tremendous. We saw ROI in the first six months."

"The most valuable feature is the security and vulnerability parts of the solution. It shows medium to high vulnerabilities so we can find them, then upgrade our model before it is too late. It is useful because it automates security. Also, it makes things more efficient. So, there is no need for the security team to scan every time. The application team can update it whenever possible in development."

"We use it to get our scan results and see where our software is vulnerable or not vulnerable."

More Veracode pros

Cons

"Cortex Cloud by Palo Alto Networks is not the cheapest solution in the market, but I know that is the best solution for SOC and Cloud once have all tools to connect cloud issues with SOC procedures, because we are partners with T-Systems."

"As per my experience with Cortex Cloud by Palo Alto Networks, the UI could be simpler."

"From the commercial perspective, we have some limitations because Palo Alto has a minimum number of users of endpoints set at 200, which is quite high for the Italian market."

"In my opinion, Cortex Cloud by Palo Alto Networks can be improved by addressing forensic information collection and storage, although I cannot suggest specific things right now, based on what customers might need."

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."

"My thoughts about improving the product which I believe could greatly aid vendors is that it used to be a very user-friendly tool, but now they have incorporated everything under one umbrella."

"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."

"The negative aspects or areas for improvement in the product include the fact that the cost might be a bit high, which challenges commercials, but not technically."

More Cortex Cloud by Palo Alto Networks cons

"One issue is that engineering teams don't always embed secrets in the same way, making it difficult for the tool to consistently identify them."

"I would like them to have their own static code scanner, and I'd like them to have their own open-source software scanners."

"Legit Security could do a little better with detecting publicly exposed keys. It's not bad. The detections that they are running get to everything eventually, but it would be great if they could increase some of that awareness."

"The one we're working on right now is the ability to dynamically rerun development teams and groups."

"It does nearly everything, but penetration testing."

"The reports on offer are too verbose."

"We connected with Veracode's support a couple of times, and we got a different answer each time."

"Calypso (our application) is large and the results take up to two months. Further, we also have to package Calypso in a special manner to meet size guidelines."

"Veracode's container scanning could be improved. We containerize all the platforms we use inside a Docker image. For example, we create a Microsoft Docker image that we build our application on top of. I would like Veracode to implement IT scans before we commit the code."

"The language version support could be improved."

"From what we have seen of Veracode's SCA offering, it is just average."

"The solution recently doubled in price over the past year, which is why I've decided to move away from it."

More Veracode cons

Pricing and Cost Advice

Information not available

"The pricing is reasonable."

"We're very comfortable with their model. We think they're a good value. We worked very closely with Veracode on understanding their license model, understanding what comprises the fee and what does not. With their assistance in design, we decomposed our application in a way where we are scanning a very significant amount of code without wasting their capacity and generating redundant reported issues. You scan in profiles, per se. And we work with them, in their offices, to design the most effective approach. So the advice I would have for customers is, you can get up and live fast, but work closely with Veracode to refine the method you use for scanning and the way you compile the applications. There's a concept called entry-point scanning, and that's probably not used well by the rest of their customers. We see our licensing as a good value because we leverage it heavily."

"I recommend going for a one-year licensing with CA, because currently they are the leaders in this field with more features and a much better turn around time with a cheaper position, but there are a lot of new companies coming up in the market and they are building up their platforms."

"The pricing is a bit high."

"I know that Veracode is a semi-pricey solution. If you are serious about security, I would recommend that you use an open-source option to learn how the scanning process works and then look into Veracode if you want to really step up your game and have an all-in-one solution."

"Costs are reasonable. No special infrastructure is required and the license model is good."

"We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive."

"The cost of Veracode is high."

"Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Posture Management (ASPM) solutions are best for your needs.

See recommendations

908,834 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

17%

Construction Company

11%

Financial Services Firm

Outsourcing Company

University

13%

Financial Services Firm

11%

Construction Company

Educational Organization

Financial Services Firm

15%

Manufacturing Company

11%

Computer Software Company

Construction Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Midsize Enterprise	1
Large Enterprise	4

No data available

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	46
Large Enterprise	114

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?

I am not fully aware of the pricing and licensing of Cortex Cloud by Palo Alto Networks. The pricing is also based on...

See all answers

What needs improvement with Cortex Cloud by Palo Alto Networks?

In my opinion, Cortex Cloud by Palo Alto Networks could be improved or enhanced in various ways. I don't have an idea...

See all answers

What is your primary use case for Cortex Cloud by Palo Alto Networks?

The usual use cases for Cortex Cloud by Palo Alto Networks that I have been working with mostly are as simple as dete...

See all answers

Ask a question

Earn 20 points

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed Ap...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Wiz vs Cortex Cloud by Palo Alto Networks

Compared 11% of the time

Prisma Cloud by Palo Alto Networks vs Cortex Cloud by Palo Alto Networks

Compared 10% of the time

SentinelOne Singularity Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 8% of the time

WithSecure Elements Exposure Management (XM) vs Cortex Cloud by Palo Alto Networks

Compared 7% of the time

CrowdStrike Falcon Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 5% of the time

More Cortex Cloud by Palo Alto Networks Competitors

Docker vs Legit Security

Compared 19% of the time

Ox Security vs Legit Security

Compared 13% of the time

Ivanti Autonomous Endpoint Management vs Legit Security

Compared 9% of the time

Heeler vs Legit Security

Compared 9% of the time

More Legit Security Competitors

Checkmarx One vs Veracode

Compared 5% of the time

SonarQube vs Veracode

Compared 5% of the time

Invicti vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

GitLab vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Cortex Cloud by Palo Alto Networks

August 2026

Cortex Cloud by Palo Alto Networks report

Download Cortex Cloud by Palo Alto Networks product report

Buyer's Guide

Legit Security

August 2026

Download Legit Security product report

Buyer's Guide

Veracode

July 2026

Download Veracode product report

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

Cortex Cloud by Palo Alto Networks enhances cloud security with features like AI/ML threat detection and automated remediation, ensuring real-time protection and efficient management across cloud environments.

Cortex Cloud by Palo Alto Networks offers comprehensive cloud security posture management and runtime protection. It reduces manual tasks and accelerates incident investigation through advanced threat detection and AI-driven anomaly detection. With integration to the MITRE ATT&CK framework, it boosts threat response while reducing incident resolution time. Although users find the UI complex and pricing high, its capabilities in securing AWS, Azure, and other environments, as well as its potential integration with CyberArk, emphasize its enterprise-ready design for cloud transformation across diverse industry sectors.

What are the key features of Cortex Cloud by Palo Alto Networks?

Runtime Protection: Ensures real-time security for workloads.
AI/ML-powered Threat Detection: Identifies threats using AI/ML technology.
Automated Remediation: Streamlines threat response through automation.
Comprehensive Detection Coverage: Offers extensive detection capabilities with unified data.
Integration with MITRE ATT&CK: Enhances threat response efficiency.

What benefits or ROI should users consider?

Enhanced Security Visibility: Provides dashboards for better security insights.
Reduced Manual Tasks: Automates processes for efficiency gains.
Improved Threat Response: Accelerates incident resolution with AI-driven anomaly detection.
Seamless Cloud Integration: Supports APIs and multi-cloud environments.

Cortex Cloud by Palo Alto Networks is deployed across industries like telecom, BFSI, and manufacturing for robust cloud security. It's leveraged for detecting misconfigurations and vulnerabilities, aiding cloud transformation and compliance with standards such as GDPR and NIST. The integration across cloud infrastructures, including AWS and Azure, supports policy creation and threat management strategies for diverse enterprises.

Palo Alto Networks

Legit Security offers comprehensive solutions for managing software security risks, ensuring efficient code integration, risk reduction, and policy adherence through centralized controls and robust integration with existing tools.

Legit Security provides organizations with a powerful platform for enhancing software security. It offers a unified control panel that highlights high-risk findings and enhances security posture with risk scoring. By facilitating seamless integration with existing tools, it promotes a security shift-left approach. Centralized management helps enforce policy adherence while secret management capabilities add another layer of security. Despite some false positives in secret detection, Legit collaborates with engineering teams to ensure secure code integration.

What are the key features of Legit Security?

Noise Reduction: Minimizes noise from scanning tools for increased efficiency.
Risk Scoring: Highlights high-risk findings to prioritize security efforts.
Unified Control Panel: Centralizes oversight for improved policy enforcement.
Seamless Integration: Works with existing tools to reduce security risks.
Secret Management: Ensures secure handling of sensitive information.

What benefits should be considered when evaluating Legit Security?

Comprehensive Visibility: Offers end-to-end insights into the software development lifecycle.
Security Shift-left: Facilitates early security integration for proactive risk management.
Partnership with Engineering Teams: Promotes collaborative secure code implementation.
Responsive Enhancement Requests: Reflects adaptability to user feedback for continuous improvement.

In industries dealing with sensitive data and complex code deliveries, Legit Security is implemented to manage the entire software development lifecycle. Organizations utilize it for compliance, integrating it with other scanning tools to bolster code supply chain security and application security management. In the wake of incidents like the SolarWinds breach, the importance of securing the software delivery pipeline has been underscored, positioning Legit Security as a crucial component in protecting against similar threats.

Legit Security

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

Google, NYSE, Kraft-Hienz, Takeda Pharmaceuticals, and many other large enterprise and Fortune 500 customers. Learn more by going to: https://www.legitsecurity.com/...

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Legit Security vs. Veracode

June 2026

Free Report: Legit Security vs. Veracode

Find out what your peers are saying about Legit Security vs. Veracode and other solutions. Updated: June 2026.

DOWNLOAD NOW

908,834 professionals have used our research since 2012.

See our Legit Security vs. Veracode report.

See our list of best Application Security Posture Management (ASPM) vendors.

We monitor all Application Security Posture Management (ASPM) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.