Tenable.io Web Application Scanning vs Veracode comparison

Tenable.io Web Application ...

Read 200 Veracode reviews

14,613 Views
9,530 Comparison Views

90% willing to recommend

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Veracode and Tenable.io Web Application Scanning are leading solutions in the web application security space. Users favor Tenable.io for its range of features, highlighting its value for the price.

Features: Veracode offers comprehensive vulnerability findings, detailed analysis, and seamless reporting. Tenable.io Web Application Scanning provides adaptive scanning capabilities, integration with existing security tools, and flexible feature variety, giving it a performance edge.

Room for Improvement: Veracode could enhance its reporting features, increase scan speed, and improve user interface. Improvements for Tenable.io Web Application Scanning include documentation clarity, dashboard functionalities, and enhanced customer support materials, although these areas are less critical to satisfaction.

Ease of Deployment and Customer Service: Veracode is known for seamless integration and helpful customer assistance. Tenable.io Web Application Scanning boasts a quick deployment process but garners mixed reviews on customer service reliability.

Pricing and ROI: Veracode has a high initial setup cost but offers good long-term ROI through effective risk management. Tenable.io Web Application Scanning provides competitive pricing with a favorable ROI, largely due to its robust features, making its cost-effectiveness compelling.

To learn more, read our detailed Tenable.io Web Application Scanning vs. Veracode Report (Updated: June 2025).

Tenable.io Web Application Scanning vs. Veracode

June 2025

Download the complete report

Helped 858,945 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Tenable.io Web Application ...

Ranking in Application Security Tools

19th

Average Rating

7.8

Reviews Sentiment

6.7

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Application Security Tools

2nd

Average Rating

8.2

Reviews Sentiment

7.0

Number of Reviews

200

Ranking in other categories

Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (2nd)

Mindshare comparison

As of June 2025, in the Application Security Tools category, the mindshare of Tenable.io Web Application Scanning is 1.3%, down from 1.5% compared to the previous year. The mindshare of Veracode is 9.2%, down from 10.8% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Harshal Deshmukh

CEO and Managing Director at Digidata Infsystems Private Limited

Simple tool to use, good dashboard capabilities and offers asset criticality ratings

It has good dashboard capabilities and gives good results with priority ratings, asset criticality ratings, and exposure scores for vulnerabilities. It also provides automated web application scanning, which customers appreciate because it doesn't disturb the web application or hamper the business. While testing the web application, sometimes it happens that the website or application goes down. But with Tenable.io Web Application Scanning, it doesn't affect the business. It has good unified web application scanning and exposure management.

Read full review

David-Robertson

Director Enterprise Architecture at Exeter Finance Corp.

Static scanning and software composition analysis are very helpful, but the usability needs improvement

Static scanning and software composition analysis are very helpful. My colleagues and I don't need to be experts on all of those ancillary things, so we can focus more on the business deliverables. They have a pretty good tool that allows me to run scans of my local integrated development environment. I can find a lot of those flaws a lot sooner than I would if I had to wait for these cloud-based scans. They've come out with some sort of automated fix feature. I haven't used it, but they gave us a demo of it, and that one looks promising. I don't know if it's ready for prime time yet.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We use the tool for our websites. We have a vulnerable subdomain. The tool helps to scan it for vulnerabilities."

"I would recommend Tenable.io Web Application Scanning to others."

"The most valuable feature is the reporting, which provides a good level of detail with respect to vulnerabilities."

"It is fully automated."

"The initial setup is straightforward."

"The solution is stable."

"Now that the license is centralized, it's a significant feature to manipulate assets based on their functions."

"The most effective feature of the product is the ability to scan the entire environment."

More Tenable.io Web Application Scanning pros

"We like the fact that all the issues are identified and that Veracode provides sufficient information on how to resolve them."

"The platform itself has a lot of AppSec best practices information, especially in the mitigation recommendation process."

"Integrations into our developer's IDE (Greenlight) and the DevOps Pipeline SAST / SourceClear Integrations has particularly increased our time to market and confidence."

"I like Veracode's static scanning and SCA. We use three static scans, software composition analysis, and dynamic scans. We haven't used dynamic scanning as much, but we're trying to integrate that into our environment more."

"I like the sandbox, the ability to upload compiled code, and how easy it is."

"Scanning of .war and .jar is key for us."

"Being able to scan our applications and identify all codes and defects is an extremely valuable feature."

"I like Veracode's API. You can put it into a simple bash script and run your own security testing from your MacBook in less than 15 minutes."

More Veracode pros

Cons

"The market is standard for vulnerability scanning, however, the posture can be improved through Tenable's prioritization engine."

"The cloud and the on-premises versions have their own controllers, and there is no way to centrally manage controllers."

"I would like for them to add proxy filtering, where you can transfer and alter the package. It is fully automated. Other web application testers programs are actually proxy software, and the proxy software gives you the flexibility of modifying the outgoing package, which will actually help you in exploiting any vulnerability in detail."

"Tenable.io Web Application Scanning conducts a general scan, which wastes time. The scan needs to be specific."

"Tenable.io Web Application Scanning is not very user-friendly and you need a lot of information to get proper reports. The tool's support is not very responsive."

"The platform's technical support services could be better."

"Sometimes it lags with different cloud environments."

"The technical support should be improved. Currently, some attacks are detected while others are not."

More Tenable.io Web Application Scanning cons

"The static analysis is prone to a lot of false positives. But that's how it is with most static analysis tools... Also, the static analysis can sometimes take a little while. The time that it takes to do a scan should be improved."

"The area with the most room for improvement is the speed and responsiveness of the query, as it is usually very slow."

"If you schedule two parallel scans under the same project, one of them will be a failure."

"I would like to see improvement on the analytics side, and in integrations with different tools. Also, the dynamic scanning takes time."

"Sometimes Veracode gives us results about small glitches in the necessary packages. For example, we recently found issues with Veracode's native libraries for .NET 6 that were fixed in the next versions of those libraries. But sometimes you do not know which version of the library particular components are using. The downside of that is that one day, the solution found some issues in that library for the necessary package we spent. Another day, it found the same issues with another library. It will clearly state that this is the same stuff you've already analyzed. This creates some additional work, but it isn't significant. However, sometimes you see the same issue for two or three days in a row."

"The dynamic scanning feature works, but it doesn't work properly for some of our applications. It doesn't allow us to skip. They claim that we can do this, but it doesn't work when we're scanning the applications in real-time."

"A nice addition would be if it could be extended for scenarios with custom cleansers."

"The triage indicator was kind of hard to find. It's a very small arrow and I had no idea it was there."

More Veracode cons

Pricing and Cost Advice

"Tenable.io Web Application Scanning is expensive for small businesses."

"The price of the solution is reasonable compared to the competitors. The license cost is based on the number of users and the annual usage."

"For Tenable.io Web Application Scanning, it comes to around 6,50,000 Indian rupees, plus taxes."

"I rate the product's pricing a four out of ten."

"It follows the same licensing scheme as Tenable.io and Tenable. sc."

"The pricing is okay."

"The application is extremely affordable. There are no additional costs involved with licensing. We switched to Tenable.io Web Application Scanning from other solutions due to pricing."

"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."

"Licensing cost is on a yearly basis and there are no additional costs, the pricing is straightforward."

"For enterprises, Veracode has done a fairly good job, but its pricing is not suitable for startups. The microservice distributed architecture for a startup is very small. I had to do a lot of discussions on the pricing initially. I previously worked in an enterprise organization where I used Veracode, and that's how I got to know about Veracode, but that was a big organization with more than a thousand employees. So, the cost is very different for them because the size of the application is different. Its pricing makes sense there, but when we try to onboard this solution for the startup ecosystem, pricing is not friendly. Because I knew the product and I knew its value, I onboarded it, but I don't think any other startup at our scale will onboard it."

"Depending on the number of users, my company makes payments toward the solution's licensing costs."

"The pricing of the product depends upon the number of codes or the number of applications."

"I think licensing needs to be changed or updated so that it works with adjustments. Pricing is expensive compared to the amount of scanning we perform."

"For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization."

"It is very reasonably priced compared to what we were paying our previous vendor. For the same price, we are getting much more value and reducing our AppSec costs from 40 to 50 percent."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

858,945 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

14%

Computer Software Company

12%

Government

11%

Retailer

Computer Software Company

17%

Financial Services Firm

16%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Tenable.io Web Application Scanning?

The most effective feature of the product is the ability to scan the entire environment.

What needs improvement with Tenable.io Web Application Scanning?

Improvements could include providing coverage reports in the free version and features related to security reports. Also, enhancing technical support would be beneficial as there is room for improv...

What advice do you have for others considering Tenable.io Web Application Scanning?

I would recommend Tenable.io Web Application Scanning as it provides us with good reports, which help improve our code base, despite the lack of financial benefits. Overall, I would rate it seven o...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode?

The SAST and DAST modules are great.

What is your experience regarding pricing and costs for Veracode?

The product’s price is a bit higher compared to other solutions. However, the tool provides good vulnerability and database features. It is worth the money.

Acunetix vs Tenable.io Web Application Scanning

Comparisons

Compared 26% of the time

PortSwigger Burp Suite Professional vs Tenable.io Web Application Scanning

Compared 12% of the time

Qualys Web Application Scanning vs Tenable.io Web Application Scanning

Compared 11% of the time

OpenText Core Application Security vs Tenable.io Web Application Scanning

Compared 9% of the time

SonarQube Server (formerly SonarQube) vs Tenable.io Web Application Scanning

Compared 7% of the time

More Tenable.io Web Application Scanning Competitors

SonarQube Server (formerly SonarQube) vs Veracode

Compared 18% of the time

Checkmarx One vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 7% of the time

OpenText Core Application Security vs Veracode

Compared 5% of the time

Snyk vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Application Security Tools

June 2025

Tenable.io Web Application Scanning report

Download Tenable.io Web Application Scanning product report

Download Veracode product report

May 2025

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

Tenable.io Web Application Scanning safely, accurately and automatically scans your web applications, providing deep visibility into vulnerabilities and valuable context to prioritize remediation.

Tenable

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

IMDEX

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.