Try our new research platform with insights from 80,000+ expert users

Tenable.io Web Application Scanning vs Veracode comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Tenable.io Web Application ...
Ranking in Application Security Tools
20th
Average Rating
7.8
Reviews Sentiment
5.8
Number of Reviews
18
Ranking in other categories
No ranking in other categories
Veracode
Ranking in Application Security Tools
3rd
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st), Application Security Posture Management (ASPM) (1st)
 

Mindshare comparison

As of March 2026, in the Application Security Tools category, the mindshare of Tenable.io Web Application Scanning is 1.4%, up from 1.2% compared to the previous year. The mindshare of Veracode is 4.6%, down from 10.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools Mindshare Distribution
ProductMindshare (%)
Veracode4.6%
Tenable.io Web Application Scanning1.4%
Other94.0%
Application Security Tools
 

Featured Reviews

GR
Project manager at Primus Software Corporation
Provides detailed reports that improve code maintainability while needing better coverage reports and technical support
Tenable.io Web Application Scanning provides a detailed report, identifying functions that are complex and need to be more maintainable and readable. It offers features such as generating an executive summary and detailed reports highlighting issues in specific lines of the code. However, it does not provide coverage reports in the free version, which is a limitation.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution's instant reports feature is the most effective for detecting threats."
"It is fully automated."
"The solution is stable."
"The most valuable features of Tenable.io Web Application Scanning are the integration into specific use cases and scanning. All of the features of the solution are useful."
"We can get detailed information about vulnerabilities."
"Tenable.io Web Application Scanning provides a detailed report, identifying functions that are complex and need to be more maintainable and readable."
"Our customers adopt this solution because of the replication testing and the vulnerability assessment it can do. It is a multi-faceted product."
"I think Tenable.io Web Application Scanning is the best option on the market at the moment."
"I like Veracode's static scanning and SCA. We use three static scans, software composition analysis, and dynamic scans. We haven't used dynamic scanning as much, but we're trying to integrate that into our environment more."
"It has improved the quality of code being delivered for test and its vulnerability resolutions timeline has improved."
"The security team can track the remediation and risk acceptance statistics."
"It gives feedback to developers on the effectiveness of their secure coding practices."
"In terms of application security best practices and guidance to our teams, their engineering staff is really excellent. They provide our developers with suggestions and they take those to heart. They've learned from the recommended remediation strategies provided by the Veracode security engineers. That makes all of their future code better."
"Code scanning is the most valuable feature."
"Scanning of .war and .jar is key for us."
"You can easily integrate it with Azure DevOps. This is an added value because we work with Azure DevOps. Veracode is natively supported and we don't have to work with APIs."
 

Cons

"The report customization needs to be better."
"We have encountered some problems with the technical support from Tenable; I would rate it a five out of ten. It is not efficacious, especially the first-level support."
"Tenable.io Web Application Scanning conducts a general scan, which wastes time. The scan needs to be specific."
"The market is standard for vulnerability scanning, however, the posture can be improved through Tenable's prioritization engine."
"The dashboard could be more user-friendly."
"The cloud and the on-premises versions have their own controllers, and there is no way to centrally manage controllers."
"Tenable.io Web Application Scanning could improve by offering faster fuzzing."
"I would like for them to add proxy filtering, where you can transfer and alter the package. It is fully automated. Other web application testers programs are actually proxy software, and the proxy software gives you the flexibility of modifying the outgoing package, which will actually help you in exploiting any vulnerability in detail."
"I would like to see these features: entering comments for internal tracking; entering a priority; reports that show the above."
"We tried to create an automatic scanning process for Veracode and integrate it into our billing process, but it was easier to adopt it to repositories based on GIT. Until now, our source control repository was Azure DevOps Server (Microsoft TFS) to managing our resources. This was not something that they supported. It took us some sessions together before we successfully implemented it."
"The JIRA integration automation aspect of it could be improved significantly. We want to have a way to create tickets that are going to allow people to work through those flaws that we're finding. We don't want people to feel like they're missing out on something or that they're not following directions in the right way."
"The policies you have, where you can tune the findings you get, don't allow you not to file tickets about certain findings. It will always report the findings, even if you know you're not that concerned about a library writing to a system log, for example. It will keep raising them, even though you may have a ticket about it. The integration will keep updating the ticket every time the scan runs."
"It needs to reach the level of Checkmarx's and Fortify Software's capabilities and service levels, or may further loosen the market share."
"In the future, I would like to see the RASP capability built-in."
"Veracode needs to improve its integration with other tools."
"It needs better controls to include/exclude specific sections when creating a report that can be shared externally with customers and prospects."
 

Pricing and Cost Advice

"It follows the same licensing scheme as Tenable.io and Tenable. sc."
"For Tenable.io Web Application Scanning, it comes to around 6,50,000 Indian rupees, plus taxes."
"I rate the product's pricing a four out of ten."
"The price of the solution is reasonable compared to the competitors. The license cost is based on the number of users and the annual usage."
"The application is extremely affordable. There are no additional costs involved with licensing. We switched to Tenable.io Web Application Scanning from other solutions due to pricing."
"The pricing is okay."
"Tenable.io Web Application Scanning is expensive for small businesses."
"Licensing is pretty flexible. It's a little bit weird, it's by the size of the binary, which is a strange way to license a product. So far they've been pretty flexible about it."
"We pay based on the number of developers working on a particular project."
"Veracode's price is reasonable."
"Veracode is a very expensive product."
"I think licensing needs to be changed or updated so that it works with adjustments. Pricing is expensive compared to the amount of scanning we perform."
"The cost of Veracode is high."
"Aside from the standard licensing fees, we also have to pay for a competent Success Manager."
"It's too expensive for the European market. That is why, in a big bank with 400 applications, we are able to use it only for 10 of them. But the other solutions are also expensive, so it wasn't a differentiator."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
884,873 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
12%
Computer Software Company
10%
Manufacturing Company
9%
Government
8%
Financial Services Firm
16%
Computer Software Company
12%
Manufacturing Company
11%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business7
Midsize Enterprise5
Large Enterprise7
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise45
Large Enterprise114
 

Questions from the Community

What needs improvement with Tenable.io Web Application Scanning?
If there were a solution, I would like to see automation and an integrated remediation solution for vulnerability or patch management.
What advice do you have for others considering Tenable.io Web Application Scanning?
I do not understand what API approach means; I do not understand this term. I think Tenable.io Web Application Scanning is the best option on the market at the moment. My review rating for this pro...
What is your experience regarding pricing and costs for Tenable.io Web Application Scanning?
I think the price is expensive. We do not have an idea of how much we have to pay approximately, but comparing to other products, Tenable.io Web Application Scanning is expensive.
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
 

Also Known As

No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

IMDEX
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Tenable.io Web Application Scanning vs. Veracode and other solutions. Updated: March 2026.
884,873 professionals have used our research since 2012.