Try our new research platform with insights from 80,000+ expert users

OpenText Dynamic Application Security Testing vs Veracode comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

OpenText Dynamic Applicatio...
Average Rating
7.2
Reviews Sentiment
6.1
Number of Reviews
22
Ranking in other categories
Dynamic Application Security Testing (DAST) (3rd), DevSecOps (8th)
Veracode
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
204
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

While both are Application Lifecycle Management solutions, they serve different purposes. OpenText Dynamic Application Security Testing is designed for Dynamic Application Security Testing (DAST) and holds a mindshare of 17.7%, down 21.6% compared to last year.
Veracode, on the other hand, focuses on Application Security Tools, holds 7.7% mindshare, down 10.3% since last year.
Dynamic Application Security Testing (DAST) Market Share Distribution
ProductMarket Share (%)
OpenText Dynamic Application Security Testing17.7%
HCL AppScan14.0%
Checkmarx One13.0%
Other55.3%
Dynamic Application Security Testing (DAST)
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Veracode7.7%
SonarQube Server (formerly SonarQube)20.5%
Checkmarx One10.4%
Other61.4%
Application Security Tools
 

Featured Reviews

Navin N - PeerSpot reviewer
Effective scanning of diverse file extensions with fast reporting and issue resolution
We develop software packages for clients, and these clients are mostly in the BFSI sector. The packages need to be scanned, and we engage Fortify WebInspect for this.  Customers typically perform their own application pen tests, but in some cases, we have engagements where customers want us to scan…
Kv Rao - PeerSpot reviewer
Integrates pipelines smoothly and fortifies code against vulnerabilities
I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"It's a well-known platform for doing dynamic application scanning."
"Guided Scan option allows us to easily scan and share reports."
"The solution is able to detect a wide range of vulnerabilities. It's better at it than other products."
"The transaction recorder within WebInspect is easy to use, which is valuable for our team."
"Good at scanning and finding vulnerabilities."
"The solution is easy to use."
"Technical support has been good."
"I'm sorry, but there is no review content provided to extract a quote from."
"The solution is a specialist in SAST that you can rely on. Code scanning is fast with current, updated algorithms​."
"In terms of application security best practices and guidance to our teams, their engineering staff is really excellent. They provide our developers with suggestions and they take those to heart. They've learned from the recommended remediation strategies provided by the Veracode security engineers. That makes all of their future code better."
"We have found the static analysis to be useful in Veracode Static Analysis. However, we are in the process of testing."
"Within SCA, there is an extremely valuable feature called vulnerable methods. It is able to determine within a vulnerable library which methods are vulnerable. That is very valuable, because in the vast majority of cases where a library is vulnerable, none of the vulnerable methods are actually used by the code. So, if we want to prioritize the way open source libraries are updated when a library is found vulnerable, then we want to prioritize the libraries which have vulnerable methods used within the code."
"We used it for performing security checks. We have many Java applications and Android applications. Essentially it was used for checking the security validations for compliance purposes."
"Each time I raise a ticket regarding something, they are very quick about the responses and get connected instantly."
"The article scanning is excellent."
"Code analysis tool to help identify code issues before entered into production."
 

Cons

"We have had a problem with authentification."
"Fortify WebInspect's shortcoming stems from the fact that it is a very expensive product in Korea, which makes it difficult for its potential customers to introduce the product in their IT environment."
"The scanner could be better."
"Not sufficiently compatible with some of our systems."
"Our biggest complaint about this product is that it freezes up, and literally doesn't work for us."
"There are some file extensions, like .SER, that Fortify WebInspect doesn't scan."
"I want to enhance automation. Currently, Fortify WebInspect can scan and find vulnerabilities, but users with specific skills need to interpret the results and understand how to address them."
"We have often encountered scanning errors."
"I would like to see expanded coverage for supporting more platforms, frameworks, and languages."
"Raw file scans and dynamic scans would be an improvement, instead of dealing with code binaries."
"The only notable problem we have had is that when new versions of Swift have come out, we have found Veracode tends to be a bit behind in updates to support the new language changes."
"The technical support service has room for improvement."
"I've seen slightly better static analysis tools from other companies when it comes to speed and ease of use."
"An area for improvement in Veracode is the time that it takes to scan large projects, as that makes it difficult to fit into our CI/CD pipelines."
"If the dynamic scan is improved, then the speed might go up. That is somehow not happening. We have raised this concern. It might also help if they could time limit scans to 24 hours instead of letting them go for three days. Then, whatever results could be shared, even if the scan is not complete, that would definitely help us."
"There is also a size limit of 100 MB so we cannot upload files that are larger than that. That could be improved. Also, the duration of the scan is a bit too long."
 

Pricing and Cost Advice

"The pricing is not clear and while it is not high, it is difficult to understand."
"Our licensing is such that you can only run one scan at a time, which is inconvenient."
"Its price is almost similar to the price of AppScan. Both of them are very costly. Its price could be reduced because it can be very costly for unlimited IT scans, etc. I'm not sure, but it can go up to $40,000 to $50,000 or more than that."
"This solution is very expensive."
"The price is okay."
"Fortify WebInspect is a very expensive product."
"It’s a fair price for the solution."
"To my knowledge, licensing for Veracode Static Analysis is paid yearly by my company."
"Negotiate some, but their prices are reasonable."
"There is a fee to scale up the solution which I consider expensive."
"As compared to others, it is a costly solution. It is overpriced, and many organizations with a limited budget cannot afford it. That is why they are going for other tools, but those tools are not that effective. Veracode is better in terms of quality. If you want good service, you have to pay for it."
"Licensing cost is on a yearly basis and there are no additional costs, the pricing is straightforward."
"The pricing is reasonable compared to other tools."
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works."
"The licensing cost for Veracode is fair."
report
Use our free recommendation engine to learn which Dynamic Application Security Testing (DAST) solutions are best for your needs.
868,759 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
15%
Government
15%
Manufacturing Company
12%
Computer Software Company
10%
Financial Services Firm
16%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise1
Large Enterprise15
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise43
Large Enterprise112
 

Questions from the Community

What is your experience regarding pricing and costs for Fortify WebInspect?
While I am not directly involved with licensing, I can share that our project's license for 1-9 applications costs between $15,000 to $19,000. In comparison, Burp Suite costs approximately $500 to ...
What needs improvement with Fortify WebInspect?
WebInspect works efficiently with Java-based or .NET based applications. However, it struggles with Salesforce applications, where it requires approximately 20-24 hours to crawl and audit but produ...
What is your primary use case for Fortify WebInspect?
I am currently working with several tools. For Fortify, I use SCA and WebInspect. Apart from that, I use Burp Suite from PortSwigger. For API testing, I use Postman with Burp Suite or WebInspect fo...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers nearly five security testing features within its own service, making it a compet...
 

Also Known As

Micro Focus WebInspect, WebInspect
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Aaron's
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about OpenText Dynamic Application Security Testing vs. Veracode and other solutions. Updated: May 2022.
868,759 professionals have used our research since 2012.