OpenText Dynamic Application Security Testing vs Veracode comparison

OpenText Dynamic Applicatio...

Read 208 Veracode reviews

18,975 Views
2,846 Comparison Views

89% willing to recommend

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between OpenText Dynamic Application Security Testing and Veracode based on real PeerSpot user reviews.

Find out in this report how the two Dynamic Application Security Testing (DAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed OpenText Dynamic Application Security Testing vs. Veracode Report (Updated: December 2025).

OpenText Dynamic Application Security Testing vs. Veracode

December 2025

Download the complete report

Helped 881,707 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

OpenText Dynamic Applicatio...

Ranking in Dynamic Application Security Testing (DAST)

3rd

Average Rating

7.2

Reviews Sentiment

6.1

Number of Reviews

Ranking in other categories

DevSecOps (9th)

Veracode

Ranking in Dynamic Application Security Testing (DAST)

1st

Average Rating

8.0

Reviews Sentiment

6.9

Number of Reviews

208

Ranking in other categories

Application Security Tools (3rd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of February 2026, in the Dynamic Application Security Testing (DAST) category, the mindshare of OpenText Dynamic Application Security Testing is 11.0%, up from 9.5% compared to the previous year. The mindshare of Veracode is 18.2%, down from 30.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Dynamic Application Security Testing (DAST) Market Share Distribution
Product	Market Share (%)
Veracode	18.2%
OpenText Dynamic Application Security Testing	11.0%
Other	70.8%

Dynamic Application Security Testing (DAST)

Featured Reviews

ArnabPaul

Cyber Security Consultant at a tech vendor with 10,001+ employees

Enhancements in manual testing align with reporting and integration features

WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produces minimal findings, necessitating manual verification. The solution offers customization features for crawling and vulnerability detection. It includes various security frameworks and allows selection of specific vulnerability types to audit, such as OWASP Top 10 or JavaScript-based vulnerabilities. When working with APIs, we can select OWASP API Top 10. The tool also supports custom audit features by combining different security frameworks. For on-premises deployment, the setup is complex, particularly regarding SQL server configuration. Unlike Burp Suite or OpenText Dynamic Application Security Testing, which have simpler setup processes, WebInspect requires SQL server setup to function.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature is the static analysis."

"Reporting, centralized dashboard, and bird's eye view of all vulnerabilities are the most valuable features."

"The solution's technical support was very helpful."

"Good at scanning and finding vulnerabilities."

"It is scalable and very easy to use."

"The feature that has been most influential in identifying vulnerabilities is its ability to crawl the website, understand the structure, and analyze the network packets sent and received."

"The tool provides comprehensive vulnerability assessments which help ensure our deliverables are as free from vulnerabilities as possible. It has also streamlined our web application vulnerability assessments, assisting us in delivering secure applications to our clients."

"The user interface is ok and it is very simple to use."

More OpenText Dynamic Application Security Testing pros

"Tech support is outstanding. Best in class. Absolutely. They bend over backwards to help us. We'll come up with questions and within minutes, we'll get answers. It's amazing. It's truly amazing."

"We like the fact that all the issues are identified and that Veracode provides sufficient information on how to resolve them."

"The static scan is the most valuable feature."

"The good thing about Veracode is that when one scans the respective application code, all the people who are part of the transformation project can update their reviews. If there are any security flaws or vulnerabilities identified, they are able to provide sufficient justification or details about the security flaws."

"The most important features, I would say, are the scanning abilities and the remediation abilities within the product. Scanning because, obviously, we want to make sure that our application code is flaw-free. And the remediation tools are helpful to the developers to help them track and manage their flaws."

"I appreciate Veracode's SAST and SCA features, which help to find open-source vulnerabilities. I'd estimate it's about 98% accurate, though some false positives occasionally exist. Our team has been using it for a long time."

"The most valuable feature is detecting security vulnerabilities in the project."

"Code scanning is the most valuable feature."

More Veracode pros

Cons

"I would like WebInspect's scanning capability to be quicker."

"Fortify WebInspect could improve user-friendliness. Additionally, it is very bulky to use."

"Lately, we've seen more false negatives."

"Creating reports is very slow and it is something that should be improved."

"We have often encountered scanning errors."

"There are some file extensions, like .SER, that Fortify WebInspect doesn't scan."

"It requires improvement in terms of scanning. The application scan heavily utilizes the resources of an on-premise server. 32 GB RAM is very high for an enterprise web application."

"It took us between eight and ten hours to scan an entire site, which is somewhat slow and something that I think can be improved."

More OpenText Dynamic Application Security Testing cons

"It does nearly everything, but penetration testing."

"The one thing I'd like to be able to do is schedule dynamic scans. Today we're kicking those off manually, but I believe that it's something have on their roadmap."

"I think if they could improve the operations around accepted vulnerabilities, we would see improvements in our productivity."

"It would be nice if Veracode were bundled with some preferred vendors like Salesforce and offered at a discount."

"The solution should include monthly guidelines, a calendar, or a newsletter highlighting the top vulnerabilities and how to resolve them using Veracode. Its policies should be up-to-date with NIST standards and OWASP policies."

"It is not as fast as Snyk."

"There are certain shortcomings in Veracode's static analysis engine. I would improve Veracode's static analysis engine to make it capable of identifying vulnerabilities with low false positives."

"The scanning process for records could be faster and there is room for improvement in Veracode's performance."

More Veracode cons

Pricing and Cost Advice

"It’s a fair price for the solution."

"The price is okay."

"Fortify WebInspect is a very expensive product."

"This solution is very expensive."

"The pricing is not clear and while it is not high, it is difficult to understand."

"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."

"Our licensing is such that you can only run one scan at a time, which is inconvenient."

"Compared to the typical software composition analysis solutions, Veracode is not so costly, although the static analysis part of it is a little costlier."

"The pricing is a little on the high side but since we combine our product into one suite, it is easy to do and works well for us."

"It can be expensive to do this, so I would just make sure that you're getting the proper number of licenses. Do your analysis. Make sure you know exactly what it is you need, going in."

"Get a license at the beginning of a project. Don't wait until the end, because you want to use the product throughout the entire software development lifecycle, not just at the end. You could be surprised, and not in a positive way, with all the vulnerabilities there are in your code."

"For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization."

"The pricing is pretty high."

"The price of Veracode Static Analysis is expensive. There is an annual fee to use the solution and the company is upfront with the pricing model and fees."

"Users in some forums mentioned that pricing for this solution can be quite high."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.

See recommendations

881,707 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Government

15%

Financial Services Firm

14%

Manufacturing Company

10%

Computer Software Company

Financial Services Firm

17%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Midsize Enterprise	1
Large Enterprise	15

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	44
Large Enterprise	115

Questions from the Community

What is your experience regarding pricing and costs for Fortify WebInspect?

While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...

What needs improvement with Fortify WebInspect?

What is your primary use case for Fortify WebInspect?

I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

PortSwigger Burp Suite Professional vs OpenText Dynamic Application Security Testing

Comparisons

Compared 21% of the time

Checkmarx One vs OpenText Dynamic Application Security Testing

Compared 7% of the time

OWASP Zap vs OpenText Dynamic Application Security Testing

Compared 5% of the time

Acunetix vs OpenText Dynamic Application Security Testing

Compared 5% of the time

Invicti vs OpenText Dynamic Application Security Testing

Compared 5% of the time

More OpenText Dynamic Application Security Testing Competitors

SonarQube vs Veracode

Compared 11% of the time

Checkmarx One vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 5% of the time

OWASP Zap vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

OpenText Dynamic Application Security Testing

January 2026

OpenText Dynamic Application Security Testing report

Download OpenText Dynamic Application Security Testing product report

Download Veracode product report

January 2026

Also Known As

Micro Focus WebInspect, WebInspect

Crashtest Security , Veracode Detect

Overview

OpenText Dynamic Application Security Testing offers robust scalability, ease of use, and high accuracy in scanning, making it a valuable tool for enterprises.

This security testing platform is known for its centralized dashboard, guided scans, and comprehensive reporting. It integrates seamlessly with tools like Fortify code scanner and supports extensive vulnerability detection and analysis, enhancing efficiency in security management. Despite its strengths, users suggest improvements in cloud integration, cost-effectiveness, and installation processes. Faster scans, reduced false positives, and improved mobile testing features are also desired.

What are the key features of OpenText Dynamic Application Security Testing?

Scalability: Easily adapts to changing enterprise needs.
Ease of Use: User-friendly interface with guided scans.
Comprehensive Reporting: Detailed vulnerability analysis and reporting.
Integration Capabilities: Works with Fortify code scanner and user authentication scanning.
Wide Vulnerability Detection: Identifies extensive security vulnerabilities.

What benefits should users expect from reviews?

Efficient Vulnerability Management: Streamlines security management in development environments.
Detailed Analysis: Provides in-depth insights into security issues.
Quick Setup: Easy to deploy within existing systems.
Enterprise Preference: Supports enterprise environments efficiently.

In industries like BFSI, OpenText Dynamic Application Security Testing is employed for performance network application testing, dynamic and static application security testing, and code checks. Security and QA teams use it in development processes to ensure application security prior to release, proving integral in both enterprise and testing environments.

OpenText

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Aaron's

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.