Try our new research platform with insights from 80,000+ expert users

Veracode vs Xygeni comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex Cloud by Palo Alto N...
Sponsored
Ranking in Application Security Posture Management (ASPM)
9th
Average Rating
8.6
Reviews Sentiment
5.4
Number of Reviews
5
Ranking in other categories
Vulnerability Management (38th), Cloud Workload Protection Platforms (CWPP) (17th), Cloud Security Posture Management (CSPM) (23rd), Cloud-Native Application Protection Platforms (CNAPP) (16th), Data Security Posture Management (DSPM) (14th), Software Supply Chain Security (14th), Cloud Infrastructure Entitlement Management (CIEM) (7th), Cloud Detection and Response (CDR) (9th)
Veracode
Ranking in Application Security Posture Management (ASPM)
1st
Average Rating
8.0
Reviews Sentiment
6.9
Number of Reviews
208
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Dynamic Application Security Testing (DAST) (1st)
Xygeni
Ranking in Application Security Posture Management (ASPM)
11th
Average Rating
9.0
Reviews Sentiment
6.6
Number of Reviews
3
Ranking in other categories
Application Security Tools (22nd), Software Composition Analysis (SCA) (13th), Software Supply Chain Security (13th)
 

Featured Reviews

Nuno-Santos - PeerSpot reviewer
Cybersecurity Analyst at a tech services company with 11-50 employees
Has improved real-time threat detection and unified cloud protection through AI and automation
Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent. They changed the names of the products and are now clarifying their offer. The family of the products is not easy to follow because it's very recent. Regarding the generative AI security tool, I know for sure it's Agentic. Based on my experience with Palo Alto, I can suggest what Cortex Cloud by Palo Alto Networks could make better or what additional functions could be added. This is the best tool in the market. It's not the time to tell what they could do better because it's a recent tool. The market is now adopting it. Our experience doesn't show that they need to do more.
reviewer2703864 - PeerSpot reviewer
Head of Security Architecture at a healthcare company with 5,001-10,000 employees
Onboarding developers successfully while improving code security through IDE integration
Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.
AI
Business development manager at RSsecurity
Unified monitoring has reduced alert noise and provides accurate, proactive application security
Xygeni was highly effective for us, but there are areas where improvements could be made. More customization options for dashboards and reports would help teams tailor the platform to their specific metrics and workflows. I also occasionally encounter DevOps tools that are not yet supported natively. Expanded coverage for niche or emerging tools would make onboarding even smoother. These points, however, are minor compared to the overall value the platform delivers, especially given the strength of its AI-driven detection, remediation, and supply chain protection capabilities. It would also be an improvement for licensing with regard to on-premise variants. Perhaps we could have an on-premise option for standard subscription.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."
"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."
"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."
"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."
"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."
"The most valuable feature is the dynamic application security testing."
"Scanning of .war and .jar is key for us."
"Ad-hoc scanning during the development cycle and reports for audits are valuable features."
"The most valuable feature is the static scan that checks for security issues."
"Veracode supports a broad range of code technologies, and it can analyze large applications. Fortify takes a long time and may not be able to generate the report for larger applications. We don't have these constraints with Veracode."
"Informs me of code security vulnerabilities. Bamboo build automation with Veracode API calls are used.​"
"When we do have errors, Veracode is always available, their consultants, to help us either mitigate the error, or provide technical assistance on pointing exactly where the problem is and how we could probably fix it. I'm always amazed at how knowledgeable they are."
"The most valuable feature is the seamless automation of Veracode via the pipeline, in comparison to other solutions like Fortify SSC, which are complex to integrate through the pipeline."
"Xygeni provides a comprehensive and developer-friendly approach to securing the entire software supply chain."
"The visibility of our open-source supply chain dependencies and real-time detection of vulnerabilities have been invaluable."
"Since using Xygeni, the time to review vulnerabilities has decreased."
 

Cons

"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."
"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."
"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."
"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."
"There are many times when their product goes to check my code and it dies, and I don't know why. I've contacted support and they're not really helpful with this particular problem. I go to the logs and I look at what I can but I can't tell why the check process has essentially just died in the middle of checking."
"Mitigation review isn't always super easy."
"The one thing I'd like to be able to do is schedule dynamic scans. Today we're kicking those off manually, but I believe that it's something have on their roadmap."
"From what we have seen of Veracode's SCA offering, it is just average."
"Veracode is a little costly. It's cost-effective for a large enterprise, but it may be too expensive for small businesses."
"When it comes to the speed of the pipeline scan, one of the things we have found with Veracode is that it's very fast with Java-based applications but a bit slow with C/C++ based applications. So we have implemented the pipeline scan only for Java-based applications not for the C/C++ applications."
"Veracode doesn't really help you so much when it comes to fixing things. It is able to find our vulnerabilities but the remediation activities it does provide are not a straight out-of-the-box kind of model. We need to work on remediation and not completely rely on Veracode."
"The runtime code analysis could be improved so that we can see every element in one place."
"Xygeni was highly effective for us, but there are areas where improvements could be made."
"There should be more configuration options that make it easier to target the issues that are more important in your organization's context."
"Xygeni could be improved if on-premise options were available starting from the starter packages, not only the enterprise models."
 

Pricing and Cost Advice

Information not available
"The price of Veracode Static Analysis is expensive. There is an annual fee to use the solution and the company is upfront with the pricing model and fees."
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works."
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"It is an expensive solution, but it's the best solution available on the market. If you want something at the top, you have to pay a bit more than the average."
"I don't really know about the pricing, but I'd say it's worth whatever Veracode is charging, because the solution is that good."
"I think it's a great value. It's at a price point that a small company like mine can afford to use versus, if it was too exorbitant, I wouldn't be able to use this product. The cost of the license is small in comparison to the value it brings"
"Pricing seems fair for what is offered, and licensing has been no problem. All developers are able to get the access they need."
"Veracode is affordable for large organizations, but its pricing may be out of reach for small and medium companies."
Information not available
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
881,082 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Performing Arts
10%
Financial Services Firm
10%
Manufacturing Company
9%
Computer Software Company
8%
Financial Services Firm
17%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
Comms Service Provider
32%
Security Firm
17%
Retailer
15%
Outsourcing Company
8%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise44
Large Enterprise115
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?
The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...
What needs improvement with Cortex Cloud by Palo Alto Networks?
Regarding areas for improvement, the tool performs its functions well, but frequent name changes across Palo Alto Net...
What is your primary use case for Cortex Cloud by Palo Alto Networks?
Cortex Cloud by Palo Alto Networks serves as our primary tool for understanding our assets and performing API integra...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...
What is your experience regarding pricing and costs for Veracode Static Analysis?
My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.
What is your experience regarding pricing and costs for Xygeni?
The setup is very easy. I highly recommend Xygeni to any organization looking to bolster its SDLC security.
What needs improvement with Xygeni?
There should be more configuration options that make it easier to target the issues that are more important in your o...
What is your primary use case for Xygeni?
We use Xygeni to harden our CI/CD pipelines in Azure DevOps. Our software is mainly in Python, but we also use Javasc...
 

Also Known As

No data available
Crashtest Security , Veracode Detect
No data available
 

Interactive Demo

Demo not available
Demo not available
 

Overview

 

Sample Customers

Information Not Available
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
BKool, Onum, Napptive, Fintonic, Adaion, Metricool, Arexdata, ...
Find out what your peers are saying about Veracode vs. Xygeni and other solutions. Updated: January 2026.
881,082 professionals have used our research since 2012.