Try our new research platform with insights from 80,000+ expert users

Veracode vs Xygeni comparison

Sponsored
 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex Cloud by Palo Alto N...
Sponsored
Ranking in Application Security Posture Management (ASPM)
9th
Average Rating
10.0
Reviews Sentiment
8.7
Number of Reviews
1
Ranking in other categories
Vulnerability Management (34th), Cloud Workload Protection Platforms (CWPP) (19th), Cloud Security Posture Management (CSPM) (22nd), Cloud-Native Application Protection Platforms (CNAPP) (16th), Data Security Posture Management (DSPM) (13th), Software Supply Chain Security (14th), Cloud Infrastructure Entitlement Management (CIEM) (7th), Cloud Detection and Response (CDR) (8th)
Veracode
Ranking in Application Security Posture Management (ASPM)
1st
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
204
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st)
Xygeni
Ranking in Application Security Posture Management (ASPM)
10th
Average Rating
9.0
Reviews Sentiment
7.2
Number of Reviews
1
Ranking in other categories
Application Security Tools (22nd), Software Composition Analysis (SCA) (13th), Software Supply Chain Security (15th)
 

Featured Reviews

PG
Identifies vulnerabilities and enables proactive remediation through AI/ML capabilities
The solution helps me to understand misconfigurations in AWS or Azure cloud environments. It detects misconfigurations, suggests remedial actions, and helps identify vulnerabilities across cloud platforms. It provides action recommendations for CVEs against particular vulnerabilities The tool…
Kv Rao - PeerSpot reviewer
Integrates pipelines smoothly and fortifies code against vulnerabilities
I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…
Óscar Jesús García Pérez - PeerSpot reviewer
Provides us with efficient security management without sacrificing operational speed
Xygeni offers a powerful combination of features: * ASPM with its centralized view and prioritization * Open-source security features help us identify and manage vulnerabilities in real time within our open-source dependencies. This proactive approach prevents security breaches that could originate from third-party code. * Secrets security, its secrets management features prevent accidental exposure of sensitive data, such as API keys or passwords, within our codebase. This eliminates a major security risk and protects our infrastructure from unauthorized access. Xygeni provides us with efficient security management without sacrificing operational speed. This empowers our team to build secure software with confidence and focus on core development activities.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."
"It changes the DevSecOps process because we find flaws much earlier in the development life cycle, and we also spot third-party software that we don't allow on developers' machines."
"The pricing is worth it."
"Veracode has good support for microservices, and I also like the sandbox environment. For example, when introducing a new component, we can scan it in a sandbox environment. It will not impact the main environment. When our team fixes it, they. can push it to the production environment when the results are acceptable."
"The time savings has been tremendous. We saw ROI in the first six months."
"The most valuable feature is Veracode SDP, which allows for something related to third-party vulnerabilities. When we build a product, we use a lot of third-party libraries instead of building everything from scratch. We just use a library which is already been built; we just use that component in our product. Sometimes, these libraries may have bugs or issues, and it's hard to keep track of them because we use thousands of them."
"Regarding Software Composition Analysis, an exceptional feature is that during a SAST scan, SCA is seamlessly conducted in the background."
"It helps me to detect vulnerabilities."
"The centralized view of different testing types helps reduce our risk exposure. The development teams have the freedom to choose their own libraries and languages. What happens is sometimes developers feel like a particular library is okay to use, then they will start using it, developing some functionality around it. However, as per our mandate, for every new repository that gets added and scanned, a report gets published. Based on that report, we decide if we can continue. In the past, we have found, by mistake, some developers have used copyleft licenses, which are a bit risky to use. We immediately replace these with more permissive, open-source licenses, so we are safe in the end."
"The visibility of our open-source supply chain dependencies and real-time detection of vulnerabilities have been invaluable."
 

Cons

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."
"Veracode is costly, and there is potential for improvement in its pricing."
"Veracode isn't important to the organization's shift-left security strategy itself. It's a tool."
"We connected with Veracode's support a couple of times, and we got a different answer each time."
"Maybe the pipeline scanning doesn't support enough languages. It might only support Java and Python only, so that could be improved."
"The zip file scanning has room for improvement."
"It's taking too much time to do a quality scan."
"Another problem we have is that, while it is integrated with single sign-on—we are using Okta—the user interface is not great. That's especially true for a permanent link of a report of a page. If you access it, it goes to the normal login page that has nothing that says "Log in with single sign-on," unlike other software as a service that we use. It's quite bothersome because it means that we have to go to the Okta dashboard, find the Veracode link, and log in through it. Only at that point can we go to the permanent link of the page we wanted to access."
"The technical support service has room for improvement."
"There should be more configuration options that make it easier to target the issues that are more important in your organization's context."
 

Pricing and Cost Advice

Information not available
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"The pricing is really fair compared to a lot of other tools on the market."
"The pricing is reasonable compared to other tools."
"Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive."
"Veracode's pricing is on the higher end, but it is acceptable."
"The licensing cost for Veracode is fair."
"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."
"Its complexity makes it quite expensive, but it’s all worth it, with all the engineering in the background."
Information not available
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
868,787 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Performing Arts
15%
Computer Software Company
12%
Comms Service Provider
8%
Financial Services Firm
8%
Financial Services Firm
16%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
6%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise43
Large Enterprise112
No data available
 

Questions from the Community

Ask a question
Earn 20 points
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...
What is your experience regarding pricing and costs for Veracode Static Analysis?
When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers ...
What is your experience regarding pricing and costs for Xygeni?
The setup is very easy. I highly recommend Xygeni to any organization looking to bolster its SDLC security.
What needs improvement with Xygeni?
There should be more configuration options that make it easier to target the issues that are more important in your o...
What is your primary use case for Xygeni?
We use Xygeni to harden our CI/CD pipelines in Azure DevOps. Our software is mainly in Python, but we also use Javasc...
 

Also Known As

No data available
Crashtest Security , Veracode Detect
No data available
 

Overview

 

Sample Customers

Information Not Available
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Information Not Available
Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: September 2025.
868,787 professionals have used our research since 2012.