Veracode and Wiz have both received positive feedback on customer service and support. Wiz users have consistently praised data security and exposure prevention capabilities. Veracode users have found the pricing to be a key consideration, while Wiz users have focused on the ROI achieved. Both platforms have areas for improvement highlighted by users, with Veracode users mentioning the need for customizable reporting features, and Wiz users suggesting enhancements to advanced analytics tools.
The summary above is based on 190 interviews we conducted recently with Veracode and Wiz users. To access the review's full transcripts, download our report.
"It's not "one policy fits all." I really like that Veracode allows me to set up specific policies that I can apply to applications."
"The platform itself has a lot of AppSec best practices information, especially in the mitigation recommendation process."
"The capability to identify vulnerable code is the most valuable feature of Veracode."
"Veracode supports a broad range of code technologies, and it can analyze large applications. Fortify takes a long time and may not be able to generate the report for larger applications. We don't have these constraints with Veracode."
"Veracode's most valuable aspect is continuous integration. It helps us integrate with other applications so that it can monitor the security process."
"The coverage of the last vulnerabilities reported."
"Provides the ability to understand the black zones in our system."
"Provides consistent evaluation and results without huge fluctuations in false positives or negatives."
"The security baseline and vulnerability assessments is the valuable feature."
"The first thing that stood out was the ease of installation and the quick value we got out of the solution."
"The automation roles are essential because we ultimately want to do less work and automate more. The dashboards are easy to read and visually pleasing. You can understand things quickly, which makes it easy for our other teams. The network and infrastructure teams don't know as much about security as we do, so it helps to have a tool that's accessible and nice to look at."
"The product supports out-of-the-box reporting with context about the asset and allows us to perform complex custom queries on UI."
"Our most important features are those around entitlement, external exposure, vulnerabilities, and container security."
"The vulnerability management modules and the discovery and inventory are the most valuable features. Before using Wiz, it was a very manual process for both. After implementing it, we're able to get all of the analytics into a single platform that gives us visibility across all the systems in our cloud. We're able to correspond and understand what the vulnerability landscape looks like a lot faster."
"With Wiz, we get timely alerts for leaked data or any vulnerabilities already existing in our environment."
"Out of all the features, the one item that has been most valuable is the fact that Wiz puts into context all the pieces that create an issue, and applies a particular risk evaluation that helps us prioritize when we need to address a misconfiguration, vulnerability, or any issue that would put our environment into risk."
"Veracode does not support scans for .NET Blazor server applications."
"Scheduling can be a little difficult. For instance, if you set up recurring scheduled scans and a developer comes in and says, "Hey, I have this critical release that happened outside of our normal release patterns and they want you to scan it," we actually have to change our schedule configuration and that means we lose the recurring scheduling settings we had."
"I would love to be able to do a dynamic sandbox scan. I think that that would allow us to really get a lot more buy-in from the software development teams."
"The only notable problem we have had is that when new versions of Swift have come out, we have found Veracode tends to be a bit behind in updates to support the new language changes."
"Some features could be improved in terms of user-friendliness."
"The language version support could be improved."
"Veracode can improve the price model and how they bill the final offer to customers. It's based on the amount of traffic. For example, you can buy 1 gigabyte distributed across various applications, and each one can consume part of the whole allotment of traffic data."
"One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications."
"We would like to see improvements to executive-level reporting and data reporting in general, which we understand is being rolled out to the platform."
"We're looking at some of the data compliance stuff that they've got Jon offer. I know they're looking at container security, which we gonna be looking at next."
"The only thing that needs to be improved is the number of scans per day."
"The solution's container security could be improved."
"Wiz's reporting capabilities could be refined a bit. They are making headway on that, but more executive-style dashboards would be nice. They just implemented a community aspect where you can share documents and feedback. This was something users had been requesting for a while. They are listening to customer feedback and making changes."
"The remediation workflow within the Wiz could be improved."
"Given the level of visibility into all the cloud environments Wiz provides, it would be nice if they could integrate some kind of mechanism to better manage tenants on multiple platforms. For example, let's say that some servers don't have an application they need, such as an antivirus. Wiz could include an API or something to push those applications out to the servers. It would be great if you could remedy these issues directly from the Wiz platform."
"The reporting isn't that great. They have executive summaries, but it's only a compliance report that maps all current issues to specific controls. Whether you look at one subscription or project, regardless of the size, you will get a multipage report on how the issues in that account map to that control. Our CSO isn't going to read through that. He won't filter that out or show that to his leadership and say, "Here's what we're doing." It isn't a helpful report. They're working on it, but it's a poor executive summary."
Veracode is ranked 4th in Container Security with 194 reviews while Wiz is ranked 2nd in Container Security with 11 reviews. Veracode is rated 8.2, while Wiz is rated 9.2. The top reviewer of Veracode writes "Helps to reduce false positives and prevent vulnerable code from entering production, but does not support incremental scanning ". On the other hand, the top reviewer of Wiz writes "Multiple features help us prioritize remediation, and agentless implementation reduces overhead". Veracode is most compared with SonarQube, Checkmarx One, Fortify on Demand, Snyk and OWASP Zap, whereas Wiz is most compared with Prisma Cloud by Palo Alto Networks, Orca Security, Microsoft Defender for Cloud, AWS Security Hub and Lacework. See our Veracode vs. Wiz report.
See our list of best Container Security vendors.
We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.