Compare Snyk vs. Tenable.io Vulnerability Management

Cancel
You must select at least 2 products to compare!
Veracode Logo
69,854 views|37,366 comparisons
Snyk Logo
Read 15 Snyk reviews.
7,691 views|6,099 comparisons
Most Helpful Review
Use Tenable.io Vulnerability Management? Share your opinion.
Find out what your peers are saying about SonarQube, Veracode, Sonatype and others in Application Security. Updated: November 2020.
446,956 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
"We are using the Veracode tools to expose the engineers to the security vulnerabilities that were introduced with the new features, i.e. a lot faster or sooner in the development life cycle.""The most valuable feature comes from the fact that it is cloud-based, and I can scale up without having to worry about any other infrastructure needs.""I have used this solution in multiple projects for vulnerability testing and finding security leaks within the code.""We used it for performing security checks. We have many Java applications and Android applications. Essentially it was used for checking the security validations for compliance purposes.""Veracode is a valuable tool in our secure SDLC process.""Integrations into our developer's IDE (Greenlight) and the DevOps Pipeline SAST / SourceClear Integrations has particularly increased our time to market and confidence.""The source composition analysis component is great because it gives our developers some comfort in using new libraries.""Veracode's cloud-based approach, coupled with the appliance that lets us use Veracode to scan internal-only web applications, has provided a seamless, always-up-to-date application security scanning solution."

More Veracode Pros »

"What is valuable about Snyk is its simplicity.""It has improved our vulnerability rating and reduced our vulnerabilities through the tool during the time that we've had it. It's definitely made us more aware, as we have removed scoping for existing vulnerabilities and platforms since we rolled it out up until now.""Snyk has given us really good results because it is fully automated. We don't have to scan projects every time to find vulnerabilities, as it already stores the dependencies that we are using. It monitors 24/7 to find out if there are any issues that have been reported out on the Internet.""The most valuable features include enriched information around the vulnerabilities for better triaging, in terms of the vulnerability layer origin and vulnerability tree.""Our overall security has improved. We are running fewer severities and vulnerabilities in our packages. We fixed a lot of the vulnerabilities that we didn't know were there.""The CLI feature is quite useful because it gives us a lot of flexibility in what we want to do. If you use the UI, all the information is there and you can see what Snyk is showing you, but there is nothing else that you can change. However, when you use the CLI, then you can use commands and can get the output or response back from Snyk. You can also take advantage of that output in a different way. For the same reason, we have been using the CLI for the hard gate in the pipeline: Obtain a particular CDSS score for vulnerability. Based on that information, we can then decide if we want to block or allow the build. We have more flexibility if we use the CLI.""It is one of the best product out there to help developers find and fix vulnerabilities quickly. When we talk about the third-party software vulnerability piece and potentially security issues, it takes the load off the user or developer. They even provide automitigation strategies and an auto-fix feature, which seem to have been adopted pretty well.""The dependency checks of the libraries are very valuable, but the licensing part is also very important because, with open source components, licensing can be all over the place. Our project is not an open source project, but we do use quite a lot of open source components and we want to make sure that we don't have surprises in there."

More Snyk Pros »

"Technical support has been good. They respond quite quickly.""The most valuable feature for me is container scanning because I am interested in CICD security."

More Tenable.io Vulnerability Management Pros »

Cons
"Veracode should make it easier to navigate between the solutions that they offer, i.e. between dynamic, static, and the source code analysis.""I would like to see expanded coverage for supporting more platforms, frameworks, and languages.""Ideally, I would like better reporting that gives me a more concise and accurate description of what my pain points are, and how to get to them.""One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications.""It needs better controls to include/exclude specific sections when creating a report that can be shared externally with customers and prospects.""Improve Mobile Application Dynamic Scanning DAST - .ipa and .apk""I think for us the biggest improvement would be to have an indicator when there's something wrong with a scan.""One feature I would like would be more selectivity in email alerts. While I like getting these, I would like to be able to be more granular in which ones I receive."

More Veracode Cons »

"Could include other types of security scanning and statistical analysis""There are some new features that we would like to see added, e.g., more visibility into library usage for the code. Something along the lines where it's doing the identification of where vulnerabilities are used, etc. This would cause them to stand out in the market as a much different platform.""They were a couple of issues which happened because Snyk lacked some documentation on the integration side. Snyk is lacking a lot of documentation, and I would like to see them improve this. This is where we struggle a bit. For example, if something breaks, we can't figure out how to fix that issue. It may be a very simple thing, but because we don't have the proper documentation around an issue, it takes us a bit longer.""We've also had technical issues with blocking newly introduced vulnerabilities in PRs and that was creating a lot of extra work for developers in trying to close and reopen the PR to get rid of some areas. We ended up having to disable that feature altogether because it wasn't really working for us and it was actually slowing down developer velocity.""Scalability has some issues because we have a lot of code and its use is mandatory. Therefore, it can be slow at times, especially because there are a lot of projects and reporting. Some UI improvements could help with this.""The way Snyk notifies if we have an issue, there are a few options: High vulnerability or medium vulnerability. The problem with that is high vulnerabilities are too broad, because there are too many. If you enable notifications, you get a lot of notifications, When you get many notifications, they become irrelevant because they're not specific. I would prefer to have control over the notifications and somehow decide if I want to get only exploitable vulnerabilities or get a specific score for a vulnerability. Right now, we receive too many high vulnerabilities. If we enable notifications, then we just get a lot of spam message. Therefore, we would like some type of filtering system to be built-in for the system to be more precise.""We have seen cases where tools didn't find or recognize certain dependencies. These are known issues, to some extent, due to the complexity in the language or stack that you using. There are some certain circumstances where the tool isn't actually finding what it's supposed to be finding, then it could be misleading.""Generating reports and visibility through reports are definitely things they can do better."

More Snyk Cons »

"The interface could be improved; right now it's running on two interfaces simultaneously.""It would be helpful if Tenable could be more clear with regard to everything the solution can and cannot do with the particular license that you have."

More Tenable.io Vulnerability Management Cons »

Pricing and Cost Advice
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works.""They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey.""For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization.""I don't really know about the pricing, but I'd say it's worth whatever Veracode is charging, because the solution is that good.""Veracode's price is high. I would like them to better optimize their pricing.""If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount."

More Veracode Pricing and Cost Advice »

"It's inexpensive and easy to license. It comes in standard package sizing, which is straightforward. This information is publicly found on their website.""We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon""You can get a good deal with Snyk for pricing. It's a little expensive, but it is worth it.""Their licensing model is fairly robust and scalable for our needs. I believe we have reached a reasonable agreement on the licensing to enable hundreds of developers to participate in this product offering. The solution is very tailored towards developers and its licensing model works well for us.""The price is good. Snyk had a good price compared to the competition, who had higher pricing than them. Also, their licensing and billing are clear.""It's good value. That's the primary thing. It's not cheap-cheap, but it's good value.""With Snyk, you get what you pay for. It is not a cheap solution, but you get a comprehensiveness and level of coverage that is very good. The dollars in the security budget only go so far. If I can maximize my value and be able to have some funds left over for other initiatives, I want to do that. That is what drives me to continue to say, "What's out there in the market? Snyk's expensive, but it's good. Is there something as good, but more affordable?" Ultimately, I find we could go cheaper, but we would lose the completeness of vision or scope. I am not willing to do that because Snyk does provide a pretty important benefit for us.""Snyk is a premium-priced product, so it's kind of expensive. The big con that I find frustrating is when a company charges extra for single sign-on (SSO) into their SaaS app. Snyk is one of the few that I'm willing to pay that add-on charge, but generally I disqualify products that charge an extra fee to do integrated authentication to our identity provider, like Okta or some other SSO. That is a big negative. We had to pay extra for that. That little annoyance aside, it is expensive. You get a lot out of it, but you're paying for that premium."

More Snyk Pricing and Cost Advice »

"There are additional features that can be licensed for an additional cost."

More Tenable.io Vulnerability Management Pricing and Cost Advice »

report
Use our free recommendation engine to learn which Application Security solutions are best for your needs.
446,956 professionals have used our research since 2012.
Questions from the Community
Top Answer: Veracode has offered a dynamic analysis testing solution for several years, having launched our first offering in 2015… more »
Top Answer: I would recommend them. They have the ability to cover multiple languages and come with all the features you would… more »
Top Answer: SonarQube depends on completely what you configure the Rules. You will have the option of the Profile creation and can… more »
Top Answer: What is valuable about Snyk is its simplicity.
Top Answer: The product could be improved by including other types of security scanning (e.g. SAST or DAST), which is important. It… more »
Top Answer: We use the product to scan our code for any vulnerable dependencies we might have. We depend on open source libraries… more »
Top Answer: Technical support has been good. They respond quite quickly.
Top Answer: I don't have any issues with the solution at this time, and I don't think there are any features that are missing or… more »
Top Answer: We use the cloud deployment model. I'd recommend the solution. I'd rate it eight out of ten.
Popular Comparisons
Compared 50% of the time.
Compared 16% of the time.
Compared 4% of the time.
Compared 4% of the time.
Compared 21% of the time.
Compared 18% of the time.
Compared 13% of the time.
Compared 8% of the time.
Compared 1% of the time.
Learn
Veracode
Snyk
Tenable Network Security
Overview

Veracode covers all your Application Security needs in one solution through a combination of five analysis types; static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline, and empowers developers to find and fix security defects.

Snyk’s mission is to help developers use open source code and stay secure. The use of open source is booming, but security is a key concern (https://snyk.io/stateofossecurity/). Snyk’s unique developer focused product enables developers and enterprise security to continuously find & fix vulnerable dependencies without slowing down, with seamless integration into Dev & DevOps workflows. Snyk is adopted by over 100,000 developers, has multiple enterprise customers (such as Google, New Relic, ASOS and others) and is experiencing rapid growth. Our investors are Canaan Partners, BOLDStart, and several successful developer tools entrepreneurs. Snyk was founded in 2015 and is headquartered in London with offices in Israel and the US. For more information, go to https://snyk.io/.

Tenable.io Vulnerability Management provides the most accurate information about all your assets and vulnerabilities in ever-changing environments. Available for cloud or on-prem deployment, Tenable.io features a streamlined interface, intuitive guidance, and seamless integrations that help security teams maximize efficiency. When visibility and insight matter most, Tenable.io helps you truly understand your Cyber Exposure.

Offer
Learn more about Veracode
Learn more about Snyk
Learn more about Tenable.io Vulnerability Management
Sample Customers
State of Missouri, ReknerStartApp, Segment, Skyscanner, DigitalOcean, Comic ReliefGlobal Payments AU/NZ
Top Industries
REVIEWERS
Financial Services Firm30%
Insurance Company11%
Computer Software Company8%
Engineering Company5%
VISITORS READING REVIEWS
Computer Software Company37%
Comms Service Provider16%
Financial Services Firm7%
Media Company5%
VISITORS READING REVIEWS
Computer Software Company37%
Comms Service Provider16%
Media Company7%
Financial Services Firm6%
VISITORS READING REVIEWS
Computer Software Company34%
Comms Service Provider18%
Government9%
Media Company6%
Company Size
REVIEWERS
Small Business23%
Midsize Enterprise26%
Large Enterprise51%
VISITORS READING REVIEWS
Small Business15%
Midsize Enterprise18%
Large Enterprise67%
REVIEWERS
Small Business29%
Midsize Enterprise41%
Large Enterprise29%
No Data Available
Find out what your peers are saying about SonarQube, Veracode, Sonatype and others in Application Security. Updated: November 2020.
446,956 professionals have used our research since 2012.
Snyk is ranked 5th in Application Security with 15 reviews while Tenable.io Vulnerability Management is ranked 8th in Vulnerability Management with 2 reviews. Snyk is rated 8.6, while Tenable.io Vulnerability Management is rated 8.6. The top reviewer of Snyk writes "Helps Avoid The Pain And The Cost Of Trying To Retrofit Security in your Code". On the other hand, the top reviewer of Tenable.io Vulnerability Management writes "Supports container scanning, and the technical support is good". Snyk is most compared with WhiteSource, Black Duck, SonarQube, JFrog Xray and Sqreen, whereas Tenable.io Vulnerability Management is most compared with Tenable SC, Tenable Nessus, Rapid7 InsightVM, Flexera Software Vulnerability Manager and Orca Security.

See our list of .

We monitor all Application Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.