

Veracode and Pentera compete in the cybersecurity field, offering a range of security testing solutions. Veracode has a slight edge due to its comprehensive integration capabilities and cloud-based flexibility.
Features: Veracode offers a comprehensive static and dynamic code analysis for multiple programming languages. It integrates SAST, DAST, and Greenlight to support secure DevOps cycles. Its cloud-based deployment allows for seamless code assessment and automatic security updates. Pentera focuses on continuous automated vulnerability assessment, emphasizing credential and vulnerability management. Its simulation of attack scenarios reveals real-time vulnerabilities, with real-world exploitability demonstrations.
Room for Improvement: Veracode needs to reduce false positives and simplify its interface for better usability. Enhancements in support for modern languages like Ruby could also be beneficial. Pentera requires improvements in dashboards for clearer reporting and scalability for smaller networks. It also needs transparency in handling compromised credentials and virtual patching capabilities.
Ease of Deployment and Customer Service: Veracode provides flexible deployment across private, public, and hybrid clouds, backed by highly rated technical support. Pentera primarily employs an on-premises or hybrid cloud approach, offering reliable support but facing issues with feature licensing clarity.
Pricing and ROI: Veracode's pricing is considered expensive and more suitable for larger enterprises. Its ROI is driven by comprehensive security features improving developer efficiency. Pentera is generally more affordable, appealing to companies requiring automated penetration testing, despite high costs for some features.
Some customers consider the ROI favorable, but facing difficulties now due to changes in the licensing model, which has made it more expensive compared to last year.
The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.
Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.
We did see a return on investment with Veracode, as we segregated our remediation efforts, which reduced our time to delivery as well as the number of engineers needed to help us in delivering a secure solution.
Access to the engineering team is crucial for faster feedback on the product fix process.
I have communicated with the technical support of Veracode a couple of times, and this was a really great experience because these professionals know their material.
They share detailed information via email, including screenshots or further clarification about the issue.
Cloud solutions are easier to scale than on-premise solutions.
It has a good capacity to scale effectively.
Implementing these features into our normal CI/CD was good, so I can say that scalability is really good.
If the Veracode server is down, we experience many issues during the scan.
I have observed that it is not that reliable in terms of security because Veracode was not able to find some security threats in our application that existed since the product was developed.
It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.
When the IP is imported into a system, we cannot withdraw or revoke the license.
If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.
We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.
A nice addition would be if it could be extended for scenarios with custom cleansers.
It's not the most expensive solution.
Overall, Veracode's pricing is lower and more scalable than many alternatives in the market.
If there's a security gap, you'll never know the cost or effect.
We can automate the Pentera processes by automatically creating scenarios to validate the system.
It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.
The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.
It fixes issues directly in the IDE while you're doing it.
| Product | Market Share (%) |
|---|---|
| Pentera | 24.1% |
| Cymulate | 15.9% |
| The NodeZero Platform by Horizon3.ai | 13.6% |
| Other | 46.4% |
| Product | Market Share (%) |
|---|---|
| Veracode | 4.9% |
| SonarQube | 16.9% |
| Checkmarx One | 9.9% |
| Other | 68.30000000000001% |

| Company Size | Count |
|---|---|
| Small Business | 5 |
| Midsize Enterprise | 1 |
| Large Enterprise | 4 |
| Company Size | Count |
|---|---|
| Small Business | 69 |
| Midsize Enterprise | 44 |
| Large Enterprise | 115 |
Pentera is the category leader for Automated Security Validation, allowing every organization to evaluate its security readiness, to know its real security risk at any given moment. Test all cybersecurity layers across the attack surface – inside and out – by safely emulating attacks & prioritize patching with a risk-based remediation roadmap.
Thousands of security professionals and service providers around the world use Pentera to guide remediation and close security gaps before they are exploited. For more info visit: pentera.io
Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.
Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.
What are the key features of Veracode?
What benefits should users consider in Veracode reviews?
Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.
Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.
We monitor all Breach and Attack Simulation (BAS) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.