Veracode Reviews

We use Veracode for application scanning.

Veracode is able to prevent vulnerable code from going into production.

Veracode has helped us to identify the vulnerable code in our applications before we put them into production.

The solution allows us to ensure compliance with standards and regulations.

Veracode provides visibility into the application status at every phase of development which makes it easier for our DevSecOps to do their jobs.

I give a nine out of ten for Veracode's ability to identify false positives. The false positive rate has increased our developer's confidence.

Veracode has enhanced our capability to address flaws by identifying bugs that may not have been detected through static analysis data.

Veracode has had a positive impact on our organization by providing us with greater insight into our data.

Veracode helps our developers save approximately ten percent of their time by detecting code issues and enabling them to promptly fix bugs before releasing the information into production.

Veracode helps secure our private data which improves our overall security posture.

Being able to scan our applications and identify all codes and defects is an extremely valuable feature.

Scanning large amounts of code can be a time-consuming process and there is scope for improvement.

I have been using the solution for nine months.

Veracode is stable.

Veracode is scalable. We have between 300 to 500 users.

The technical support is responsive.

Positive

We previously used some open source solutions and the management teams decided to switch over to Veracode.

I give the solution an eight out of ten.

We have Veracode deployed in multiple locations.

Maintenance is only required when updating the solution.

You should evaluate multiple solutions, but I suggest considering Veracode if it aligns with the organization's requirements.

We used it for static and dynamic testing to check if there were any vulnerabilities in the code. If there were any vulnerabilities, we would check the report downloaded from the Veracode portal and try to fix the code before deploying it.

Veracode helped me remove errors, and it didn't take a long time to fix any issue because I had an answer regarding where the code needed to be fixed. That feature helped us test our cases and get them deployed. It helped me fix vulnerabilities and any other errors before deployment to the applications.

The SAST and DAST scans—we used it both before code was deployed and after it was deployed—helped us run through the issues and keep track of their status. It was deployed in the pipelines, through Jenkins, and checked the logs in Kubernetes.

The solution also saved us time. I really liked the automatic scanning because there was no way to know where an issue was. Human tendency is to make mistakes, but Veracode helped us find the exact spot where an error was and change it. The reporting helped us do that in a short amount of time.

For our team, it had a very good impact. My manager used to suggest that before taking code to the next level, it was a really good idea to scan it.

I liked that I could easily find out where my errors were. Instead of going through the whole code and the scripts, it showed me where the errors were and gave me an idea of how to fix them.

The reporting was detailed, but there were some things that were missing. It showed us on which line an error was found, but it could have been more detailed.

Also, with upgrades, we had quite a difficult time tracking the reports, so there was some maintenance around that.

I used Veracode for 13 months.

I had a situation that was due to a slow network, and I couldn't get results within a specific time. Because of that, there was a lag in production; we couldn't deploy the code on time. There was a crash, and because of that, we couldn't meet our production deadline.

The downtime happened two or three times. I thought it was due to a network issue when it happened once, but then I came to understand that it was a maintenance issue.

Veracode is really not difficult or complex to understand. The whole concept is simple. It takes some time to get used to the tool, but it is a very simple tool to work with.

It was quite fast. Scanning my code took 25 to 30 minutes, which was quite good.

We use Veracode to identify and detect security vulnerabilities in our applications before they are uploaded, deployed, or used. This gives us greater confidence in the security of our applications, which leads to positive feedback from our clients.

The solution's ability to prevent vulnerable code from going into production is a good thing because we have not upgraded to detect any variable code before deployment. Therefore, it is a good way to start our campaign.

Using SBOM to manage risks is straightforward and faster because it does not require technical skills. This makes it easy and straightforward to implement and use to prevent vulnerabilities and ensure compliance with any policy in any industry. Creating reports using SBOM is easy.

Veracode is helping us by providing alerts to ensure that we are providing a good application that does not have security vulnerabilities. This means that any client using our application or software can be confident that it is stable, secure, and risk-free. As a result, our organization is benefiting from cost savings and increased sales.

Veracode's policy reporting for enabling compliance with industry standards and regulations can be a bit complex for beginners, but it is much easier and quicker for experienced users.

Veracode provides visibility into application status throughout the development process. It is easy to understand the severity of a threat, thanks to their clear and concise documentation. This documentation can be used to understand code, security, vulnerabilities, and project management. Veracode also helps ensure compliance with all industry standards.

Veracode's visibility helps our DevSecOps team because it supports multiple programming languages. This means that teams with different programming languages can use Veracode to remotely collaborate and develop a stable solution. As a result, our developer team is not affected and can continue to provide high-quality, bug-free products on time, which is beneficial to our current and future clients.

Veracode's false positive rate is low.

Veracode's low false positive rate increases our developers' confidence. Some developers may have used a different solution in the past or may have had a different experience with another vendor. Therefore, I believe that initially, they may not be confident in Veracode when some vulnerable code is found in their primary code. This can sometimes make them feel unprofessional, but ultimately, since we are using a professional solution, their confidence will grow and become positive. This is because they will realize that if this code has vulnerabilities, the next time they release a project or application, they need to be very transparent and careful to avoid any problems. Therefore, the initial confidence may be shaken, but as developers get used to Veracode, it becomes much easier and their confidence in developing improves.

Regarding time, static analysis's false positive rate has reduced the amount of time we would have spent using other solutions or the cost of using a high-tech team to do it. Additionally, the cost of accessing running machines in this era is quite expensive. However, if we have the opportunity to use Veracode with its multiple features, I think it is a very good setting for any company during the learning process of using machines.

With Veracode, we can perform multiple scans simultaneously in different programming languages. This is different from other solutions, where we would manually or independently scan each application or programming language. Veracode allows us to scan more quickly and easily. The time it takes to detect flaws in the code is not comparable to the previous solution, because Veracode speeds up the process and makes it easier to create reports. We can share these reports with other developers to create free call-to-action campaigns and improve the user experience. By the time we deploy our applications, we can be confident that they are secure.

Veracode helped our developers save time by providing a solution that can be integrated with other IDEs, such as Visual Studio Code. This allows developers to use a tool that they are familiar with and that is readily available. This, in turn, helps them to develop faster because the interactivity tools support every programming language. This means that developers do not have to create a lot of code before they can start using Veracode. Instead, they can focus on adding more logic and functionality to their code. Veracode can then help them to test and secure their code more quickly. Overall, Veracode has helped our developers save an average of 30 percent of the time they would have otherwise spent on security testing.

Veracode has had a positive impact on our security posture. We are now able to create secure and stable solutions more quickly because of their transparency, speed, and visibility.

Veracode reduced the cost of our DevSecOps by around eight percent.

Veracode is very easy to use. I use it to scan my Java Micro Service, and it is easy to configure. It does not require any software to be installed, and it can access data files and scan them quickly. This makes it very user-friendly.

Scanning progress is highly dependent on the speed of the Internet. This can create confusion about the completion of scanning tasks. For example, a static scan may detect all vulnerabilities during a single scan, but when static scanning is disabled, some vulnerabilities may be detected during one scan, but not during the next scan or a subsequent scan. This inconsistency can make it difficult to track vulnerabilities. Additionally, The solution does not make it easy to mitigate vulnerabilities that are not detected by static scanning.

The price of the solution has room for improvement.

I have been using Veracode for three years.

Veracode is stable as long as we have a good internet connection. The stability of Veracode is based on the internet speed.

Veracode is scalable. We use Veracode in multiple departments. Ten people in our organization use the solution.

The initial deployment was straightforward and took two of us five days to complete the deployment.

We implemented the solution in-house.

With Veracode, we are developing more secure, scalable, and stable applications on a faster track. Our clients know that they can trust us to deliver secure applications that meet their expectations. This led to increased sales, even though our products are priced higher than our competitors. We are able to charge a premium because our products meet the Swedish standard for security, compliance, and risk. As a result, we have seen a 65 percent return on investment.

Veracode is expensive.

I give Veracode an eight out of ten.

Veracode is not a cost-effective solution for small businesses, but it is a good solution for medium and enterprise businesses.

Veracode does not require any maintenance.

I recommend Veracode to organizations that need a static code security analysis. Veracode is simple to understand and supports all programming languages.

I use Veracode to ensure the projects I deliver don't have vulnerabilities. 

Veracode provides insight into vulnerabilities at every stage, so your team can progress through the development cycle more efficiently. It improves developer confidence by showing us our capabilities and the potential of our code. 

Our developers improve and become more efficient using Veracode. Once we identify issues in our code, it's much easier to avoid the same mistakes in future projects. It teaches them how to overcome those vulnerabilities and errors while reducing costs.

Veracode saves a lot of time compared to traditional methods for identifying vulnerabilities. We save around $500 a month using Veracode because we don't need to hire experts. 

Veracode has improved our overall security posture. We feel assured that applications we deliver to clients or use internally are highly secure. It has helped us develop strategies to create stable, secure platforms.

I like the static scanning, and Veracode's interface is excellent. The dashboard is easy to navigate. I love the Software Bill of Materials (SBOM) feature because it helps you explore various industries and understand what to do to minimize risks and maintain compliance. It's straightforward and ensures my applications are compliant. 

It's easy to create reports using the SBOM feature because it has templates that you can customize depending on the reporting requirements. It gives me a report of the compliance requirements for any industry. It helps us internally and improves the services we provide to our clients.

Veracode is great for preventing vulnerable code from going into production because it covers various programming languages like JavaScript and PHP. You can be confident that your code is secure no matter which language you use.

Static scanning takes a long time, so you need to patiently wait for the scan to achieve. I also think the software could be more accurate. It isn't 100 percent, so you shouldn't completely rely on Veracode. You need to manually verify its findings. 

I've used Veracode for three years.

Veracode is stable. I've been working with it for a long time. 

I rate Veracode support 10 out of 10. They're friendly and responsive. 

Positive

Deploying Veracode is straightforward. I did it with one other colleague. 

We can afford Veracode, but it's too expensive for small enterprises. If you're concerned about the price, you should weigh the benefits you can achieve. It has saved us a lot of money on DevOps. We save about $500 a month by not outsourcing this work to experts.  

I rate Veracode eight out of 10.

It's an excellent product for developing a secure platform that will benefit your company and its customers while helping you build a sustainable development team. Before implementing Veracode, you need to prepare and have at least one person who understands how to use the product. 

Our primary use case for Veracode is to secure our software development lifecycle. It's deployed in a couple of countries and connected to multiple applications. It's used by five development teams, each of which has a different focus, such as digital channels, CRM, ERP, backend deployment, and billing. We also have a team that coordinates all of the efforts of the secure development policies. That team sets the guidelines and policies. The entire development team has about 20-30 people. 

Veracode has sped up the development cycle, helping us bring products to the market faster. I work at an IT services company with hundreds of customers who have various needs for different kinds of tools. That doesn't mean we use Veracode for all our customers, but for certain customers, it's critical because the solution reduces the amount of time needed to prevent and detect issues. Bringing secure applications into production is essential. 

We can't just rely on our development teams to make, test, and manually review the code. We need powerful tools that provide a strong framework for detecting vulnerabilities and scanning application components. Penetration testing is the most important because hackers break into the application and access the information. 

Dynamic analysis is also crucial for web applications, which can be risky. Veracode can dynamically detect vulnerabilities and block traffic. It is sometimes hard to differentiate real users from hackers. Dynamic analysis must be implemented with a user-sensitive perspective. 

I work in Latin America, and there are regulations on information security and the use of customer information. The most vital areas are things like health information and finance. You can face penalties for failing to protect customer information, so it's critical for us to secure our code during development. Any vulnerable code or application component can risk disclosing customer information from customers and allowing an outsider to penetrate the systems or databases.

Veracode offers visibility throughout the entire development lifecycle. SecOps is an essential framework inside the organization currently because we need to deliver applications to market faster while improving code quality. It's crucial to be careful when using code generated by community sources. We need to test the final applications and also the components and packages in any code repository we use. 

We're deploying complex pipelines and utilizing CI/CD. For example, Veracode is important when connecting management tools, code repositories, and various cloud components. Having that integration and capacity to connect to various tools in the DevOps framework is vital for the DevOps team. Every business must decide its risk tolerance and set a threshold of vulnerability permissions in the application to detect. It's really powerful if you can configure the threshold correctly. 

Developer confidence depends on their capacity to understand, and Veracode has to detect vulnerabilities and provide suggestions for correcting them. Sometimes it's an upgrade; sometimes not. It also provides different kinds of information to the developers. 

Veracode has had an enormous impact on our ability to detect flaws. It's risky if we don't have the capacity to detect vulnerabilities in the earliest stage of development before the applications go into production. It's also an important time-saving tool. It reduces the time spent manually addressing vulnerabilities by about 20-30 percent. 

I like Veracode's static analysis. It was one of the core development tools when I worked with a telecommunication company where we were delivering new features for various applications and purposes each week, such as CRM, data channels, compliance, traffic data, etc. 

Most of the time, the key thing was to ensure the security of digital channels and reduce the risk of any breach that could cause a security issue. It's critical to maintain the security of sensitive information transferred from our customers to the sales staff. Keeping that data secure is important for the customer relationship and also for compliance and recurring sales.

I rate Veracode 10 out of 10 for its ability to prevent vulnerable code from entering production. It has a lot of useful and intuitive features. In previous settings, static analysis was one of the primary use cases, but dynamic analysis is also helpful. Veracode is highly valuable because one vulnerability could result in service downtime or worse: a leak of customer information. 

The investment in the tool is justified because we can detect and prevent vulnerabilities much earlier in the process. Software composition analysis is also vital when we use open-source middleware or backend components for business-critical functions like bringing information from one source to another or connecting one application to another. 

Veracode can improve the price model and how they bill the final offer to customers. It's based on the amount of traffic. For example, you can buy 1 gigabyte distributed across various applications, and each one can consume part of the whole allotment of traffic data. 

You pay for all of the time that the tool is running, not for the number of scans. There are specific rules governing the amount of traffic applications can consume from the allotment you have. I would like the pricing to be more personalized. For example, some companies don't have a large budget for this kind of tool, whereas a large enterprise can acquire this kind of solution and pay for it. However, I'm an IT consultant working with various types of customers in different industries, including finance, insurance, and telecommunications.

I started using Veracode at least three years ago.

Veracode is a highly stable platform. I haven't experienced any service disruption, and the performance is solid. 

I've used Veracode in a telecommunication company with a huge environment and more than a hundred applications. I don't have experience with smaller-scale use cases, but I know the cloud is quite scalable. 

I rate Veracode support nine out of 10. We get support from the resellers and direct support from Veracode analysts. We call the support team or the architect when there is a serious technical isssue. 

Positive

I haven't used a commercial tool like Veracode before. It depends on where I'm working, but the most common tool we use is an open-source solution called SonarQube. 

Veracode is straightforward to deploy. It's not hard to connect it, and we had support from a local vendor to help us integrate it into our dev lifecycle. It required only one person from my team. 

We had assistance from our local reseller, and the experience was great because we had a direct connection from the partner to the brand. We have a local team member who was in charge of the resell process. 

We calculate the return on investment primarily based on the risk. We calculate the ROI annually, but it's not very detailed. We factor in the risks associated with the loss of customer information loss, penalties for noncompliance, etc. In the worst-case scenario, we estimate that could potentially lose up to $1 million annually. 

The licensing model could be more flexible, and Veracode could be more accessible to smaller enterprises. We obtained Veracode through a consultancy. Veracode sets the price through consultation with our reseller, but I have yet to get a direct quotation without any other reseller in the middle. If you are worried about the price, I would say that you could request more information and do a trial, then see if you can negotiate an offer. 

We decided to use Veracode without comparing it to any other kind of solution, we had a kind of consultancy from one of the companies, the IT services company that was one of our partners, and they worked close to us, and we selected Barracuda the tool that we needed.

I rate Veracode nine out of 10. It's an excellent solution for securing the development lifecycle. I recommend starting with a trial and getting in touch with the account team to explore all of the different features. 

Veracode is used to perform the dynamic analysis of our applications for security flaws. We have applications that are being used by millions of users. We needed a security analysis tool to secure the application. Veracode is helping us with the analysis of all the security flaws and discrepancies. 

It is software-as-a-service. It is in the cloud.

Earlier, we did not have any such dedicated tool for the security analysis of our application. It was quite challenging for us when on a day-to-day basis, it was accessed by the users because there could be security flaws making it prone to any third-party attacks, malware, unauthenticated access, etc. Veracode gives us a complete scanning report, which is very useful. It is informative and helpful to understand the things that we need to focus on.

Within three months of its implementation, we realized that it is a very powerful solution, and it works perfectly for all the use cases of our applications. Scanning through the application code is a very big task, and Veracode does that perfectly. It enhances the development and the coding work and is helpful for the development team and the product team.

Now, there is peace of mind. All the static and dynamic scans are done by Veracode, and we are making sure that there are no security flaws in the application. The automation of the analysis is helpful and saves our time and cost.

It is fully automated. I love the automation feature.

The findings of their security analysis are wonderful. You can easily go through all the analyses done by Veracode. You can see what are the flaws and what could be the best possible resolution to minimize those flaws in the application. When an application is being used by the public, security is a challenge. Veracode helps us to analyze all the security flaws, discrepancies, and vulnerabilities inside the application. It provides good reports.

The UI could be better. Also, there are some scenarios where there is no security flaw, but the report indicates that there is a security flaw. The report is not perfectly accurate. So, the accuracy of the scanning reports needs improvement.

It currently takes too much time to scan all the vulnerabilities in the applications and code. The time should be reduced. The scanning engine in Veracode needs some improvement in terms of performance and efficiency.

It has been two years.

The product is stable. There is no issue with that. It mostly works as expected. Sometimes, scanning analysis is not up to the mark because of some bugs or unstable releases, but 90% to 95% of the time, it works fine.

Its scalability is good. It is cloud-based. Whenever the application load increases, it is scaled automatically without an issue. We have plans to increase its usage in our future application process.

There are 35 to 50 users based in diverse geographical locations. We have Java, Python, and .NET applications running in the cloud. We also have some in-house cloud-based applications running on the AWS platform.

Their technical support people are good, but sometimes, they don't have complete knowledge of the software. So, they need some time to resolve the queries because they have to confirm or do knowledge sharing with their superior team members. I would rate them a 9 out of 10.

Positive

We didn't use any other solution previously. All our security scans were run manually by a third party, which cost a lot of money and time. We had to place a request to them, and then they used to schedule that.

I was involved in negotiating with the vendor and implementing the right solution. I worked with the team members and the end-users of the solution.

Its deployment is straightforward. They have to once go through the complete application analysis and review. They need to sit with the product development and the engineering team to go through the requirements, development environment, and IDE environment of an application. Once done, it is perfectly implemented in one go.

It took one month to have initial discussions, do the requirement analysis, and finalize the requirements. It took 15 days to get it implemented. So, it took 30 to 45 days.

There were team members from the engineering, product, and consulting for procurement, implementation, and final roll-out of the solution.

Its maintenance is a part of the implementation pricing plan and subscription. They are providing the maintenance and upgrade of the system. Because it is cloud-based, it is not managed by us. Veracode currently manages all the upgrades and updates. For any operational issues or additional change management, there is an additional cost.

There are 10 to 15 people in our networking infrastructure and the cloud team who are responsible for handling all the issues and the requirements for the developers. I'm also responsible for that. We are coordinating with their sales team and the account management team for any new requests or ongoing issues.

We have definitely seen an ROI. It helps the developers and testers to go through all the security flaws in their code or application repository in a very unique way. There are no chances of any security flaws or issues in the application. It helps the organization and the team. So, ultimately, it provides a positive return on investment.

It is quite good. If you adapt it for the whole organization, it is quite affordable. The pricing plans are good as compared to the other competitors, and any small, medium, or big company can easily adopt Veracode. Its cost includes deployment, training, and support for one year.

Security is a major concern for any organization. The developers do hard work in developing code, but if that code has some security flaws, it would be a challenge for any organization.

At the time, we evaluated GitLab, SonarQube, and Micro Focus, but we didn't go for them because of various reasons, such as price concerns, pricing plans, and the availability of the solutions. 

Every organization should use some kind of security-analysis solution for making their product stable, reducing time and effort, and saving costs.

I would fully recommend this solution to prospective buyers if they have a requirement for an analysis of the security flaws in their application and code. They will find it very useful if they can manage their budget for implementing this solution in the organization. It works perfectly well, and it will meet their expectations.

Overall, I would rate it a 9 out of 10. No solution is perfect, and a few improvements are always required in any solution.

We use Veracode for SAST and SCA. We are moving towards dynamic analysis as well. We use it now to scan our artifacts and reports, and very soon we are going to use the Veracode plugin for our IDE to have immediate results for security analysis purposes.

Before integrating Veracode, we were getting so many security vulnerabilities on higher branches. We integrated it to fix that. It prevents vulnerable code from going into production. We have fewer vulnerabilities and bugs.

We are getting the security vulnerability results on a day-to-day basis. Our pipeline is running every hour, and we are getting early feedback, giving us a shift-left approach. On a daily basis, we are able to rectify issues rather than find them in production or pre-production.

It provides visibility into application status at every phase of development. We have our initial feature branch, or low-level branch, and then we commit. The pipeline is running, so we will know about things immediately. This is quite valuable for us.

The SCA, agent-based analysis, is valuable. SAST and DAST take time, while this is quite fast. It gives the results very quickly. We have implemented it into our CI/CD pipeline.

Another aspect that is quite good is the policy reporting for ensuring compliance with industry standards and regulations. Initially, we were using freeware tools, but we are quite impressed with how Veracode gives the most detailed and latest vulnerability and security information.

I have been using Veracode for almost a year.

It's a stable solution. There are no problems. The stability is a seven or eight out of 10.

We connected with Veracode's support a couple of times, and we got a different answer each time.

Neutral

We used to use Snyk and other tools. The switch to Veracode was an enterprise-level discussion, and I was not involved.

It took some time to see the benefits, around six to eight months.

Although Veracode doesn't scan source code, only binary code, I'm not concerned because we can scan the source code with an SCR tool.

Veracode hasn't yet helped our developers save time. Their development time has increased because, initially, we were only taking the security and vulnerability issues on the higher branches. Now it is on lower branches as well, so the development time has increased. In the local branches, if a report indicates something has not passed, we are not allowing them to merge their code into higher branches.

We have it deployed in a multi-cloud and hybrid environment. We are using AWS, Azure, and VMware vSphere.

Overall, I would recommend Veracode. It is quite helpful.

My use case for Veracode is for a front-end application, specifically an agent compensation calculation engine. That application is deployed through an EAR file, and then Veracode scans the EAR file and gives me the scan report to help me change and improve the file for future deployments.

What I found most valuable in Veracode is that it gives me a part-by-part report of the entire EAR file and lets me set up the application for a limited time. For example, I'm running an application via the dev ops pipeline. Hence, I need to create a pipeline application and a sandbox to connect with Veracode and then add my application. When you create a sandbox, you can create it full-time or for a limited time, so I created it for a limited time. Once that expires, Veracode allows you to automatically renew it, which is one of the features I find remarkable in Veracode.

I also like that for each integration in Veracode, there's documentation.

I also find the Veracode support team extraordinary because the team goes above and beyond to ensure you get the best experience.

I find Veracode essential in preventing vulnerable code from going into production because if there's a vulnerability, the solution finds it. For example, my code has many JavaScript front-end and EAR files with some vulnerabilities. Right now, I'm deploying my code, but in the future, I may have to improve it and change it to ensure the servers are secure, so in that way, Veracode becomes more important for the industry today.

Policy reporting in Veracode is good in terms of ensuring compliance with industry standards and regulations. I like that the solution is more flexible when working with applications, mainly because my organization has a good firewall. Veracode is flexible and allows the organization to connect to the firewall in various ways. The Veracode policy is flexible and has an entire page and record that connects with my application, industry, company, and server in different ways. It does not disturb my policies so that I can get my application to work.

The false positive rate for Veracode is about seventy-thirty because it gives the most accurate report. For example, my organization depends on the Veracode analysis to ensure the code is on point, so the organization is building the next BI based on the Veracode analysis.

Veracode has also helped my organization save time because, without the report, the development team would spend a lot of time figuring out what is wrong and why the application is vulnerable. Veracode points out what is happening and why the file size must be reduced, so it helps reduce mistakes in terms of time.

An area for improvement I found in Veracode is the connectivity because currently, my company uses a plugin for the dev-ops cloud-based connectivity. A pretty helpful feature would be if Veracode gives a direct code for connecting to the Oracle server directly and authenticating it via a unique server. Currently, my organization has to find a roundabout for that and then needs to build a separate pipeline and then connect that pipeline for Veracode to start.

I've been using Veracode for the past two months.

Veracode has always been stable. It has good stability.

I found Veracode scalable because it supports a variety of platforms. Though the support for other platforms is less, Veracode has been incorporating more support over time and offering other solutions as well.

If you're unable to set up the solution, the Veracode team has a consultation call to help you set up the solution. The team would even raise set-up-related issues with the Veracode engineering team, which was how I reached Veracode Technical Support, which was a good experience.

I found Veracode Support extraordinary. I've been having an issue for the past month, and the team reached out to me and has been working with me for the past month, giving me various solutions to figure out how to solve the issue. It turns out it was a firewall issue, and I just had to go to the back-end and allow the back-end application, and now it is working fine.

The Veracode Support team was helpful and escalated my situation from level one to level two to level three, and finally, had the appropriate team reach out to me based on my issue. Then, within the span of two weeks, the team finally figured out the issue I was facing and gave me the final results and how I could fix it, so I found support good, fast, and responsive.

Overall, I had a pleasant experience with Veracode Support, so I rate support as eight out of ten.

Positive

I didn't use a previous solution before Veracode.

I wasn't involved in the initial deployment of Veracode.

I have no information on the pricing or licensing cost for Veracode.

I've not used the Software Bill of Materials in Veracode.

I'm unsure how the false positive rate affects developer confidence in Veracode on fixing vulnerabilities because I'm more of a DevOps user and don't work on development but automation.

I'm also unsure of the effect of Veracode on my organization's ability to fix flaws because I've not used it directly to fix any flaws. I report to the dev team, who then takes the report and fixes the flaws accordingly.

I'm unsure of the impact Veracode had on the overall security posture of my organization, as I didn't use it for that.

In my organization, Veracode has a hybrid cloud deployment.

The solution doesn't require any maintenance.

My rating for Veracode, overall, is eight out of ten.

What I'd tell others looking into buying the solution is that as far as DevOps is concerned, Veracode is a must-have. It's been helpful for my organization DevOps-wise, though I have no information on other Veracode offerings. I recommend that others buy Veracode.

My organization has a business relationship with Veracode. It's a Veracode partner.