We just raised a $30M Series A: Read our story

Compare Snyk vs. Tenable.io Vulnerability Management

Cancel
You must select at least 2 products to compare!
Veracode Logo
61,411 views|33,718 comparisons
Snyk Logo
Read 19 Snyk reviews.
18,793 views|14,352 comparisons
Featured Review
Find out what your peers are saying about SonarSource, Veracode, Sonatype and others in Application Security. Updated: November 2021.
554,873 professionals have used our research since 2012.
Quotes From Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros
"Veracode is a valuable tool in our secure SDLC process.""My experience with Veracode across the board every time, in all products, the technology, the product, the service, and the salespeople is fabulous.""Their dashboard is really good, overall. In my opinion, it's one of the best in the market, and I say that because we have used other service providers.""It is SaaS hosted. That makes it very convenient to use. There is no initial time needed to set up an application. Scanning is a matter of minutes. You just log in, create an application profile, associate a security configuration, and that's about it. It takes 10 minutes to start. The lack of initial lead time or initial overhead to get going is the primary advantage.""In terms of secure development, the SAST scan is very useful because we are able to identify security flaws in the code base itself, for the application.""The time savings has been tremendous. We saw ROI in the first six months.""The static scan is the feature that we use the most, as it gives us insight into our source code. We have it integrated with our continuous integration, continuous delivery system, so we can get insight quickly.""The source composition analysis component is great because it gives our developers some comfort in using new libraries."

More Veracode Pros »

"What is valuable about Snyk is its simplicity.""From the software composition analysis perspective, it first makes sure that we understand what is happening from a third-party perspective for the particular product that we use. This is very difficult when you are building software and incorporating dependencies from other libraries, because those dependencies have dependencies and that chain of dependencies can go pretty deep. There could be a vulnerability in something that is seven layers deep, and it would be very difficult to understand that is even affecting us. Therefore, Snyk provides fantastic visibility to know, "Yes, we have a problem. Here is where it ultimately comes from." It may not be with what we're incorporating, but something much deeper than that.""It has improved our vulnerability rating and reduced our vulnerabilities through the tool during the time that we've had it. It's definitely made us more aware, as we have removed scoping for existing vulnerabilities and platforms since we rolled it out up until now.""The solution's vulnerability database, in terms of comprehensiveness and accuracy, is very high-level. As far as I know, it's the best among their competitors.""The dependency checks of the libraries are very valuable, but the licensing part is also very important because, with open source components, licensing can be all over the place. Our project is not an open source project, but we do use quite a lot of open source components and we want to make sure that we don't have surprises in there.""It's very easy for developers to use. Onboarding was an easy process for all of the developers within the company. After a quick, half-an-hour to an hour session, they were fully using it on their own. It's very straightforward. Usability is definitely a 10 out of 10.""The most valuable features include enriched information around the vulnerabilities for better triaging, in terms of the vulnerability layer origin and vulnerability tree.""It is easy for developers to use. The documentation is clear as well as the APIs are good and easily readable. It's a good solution overall."

More Snyk Pros »

"The vulnerability scanning is the most important aspect of the solution for us.""Technical support has been good. They respond quite quickly.""The most valuable feature for me is container scanning because I am interested in CICD security.""The solution can integrate with third parties and meets standard compliance.""They are on a good trajectory as a company and investing in R&D in the right ways.""The initial setup is very straightforward.""It is very stable, and it is updated periodically by adding new vulnerabilities."

More Tenable.io Vulnerability Management Pros »

Cons
"Improve Mobile Application Dynamic Scanning DAST - .ipa and .apk""We tried to create an automatic scanning process for Veracode and integrate it into our billing process, but it was easier to adopt it to repositories based on GIT. Until now, our source control repository was Azure DevOps Server (Microsoft TFS) to managing our resources. This was not something that they supported. It took us some sessions together before we successfully implemented it.""The product has issues with scanning.""Scheduling can be a little difficult. For instance, if you set up recurring scheduled scans and a developer comes in and says, "Hey, I have this critical release that happened outside of our normal release patterns and they want you to scan it," we actually have to change our schedule configuration and that means we lose the recurring scheduling settings we had.""Sometimes, I get feedback from a developer saying, "They are scanning a Python code, but getting feedback around Java code." While the remediation and guidelines are there, improvement is still required, e.g., you won't get the exact guidelines, but you can get some sort of a high-level insights.""The ideal situation in terms of putting the results in front of the developers would be with Veracode integration into the developer environment (IDE). They do have a plugin, which we've used in the past, but we were not as positive about it.""If the dynamic scan is improved, then the speed might go up. That is somehow not happening. We have raised this concern. It might also help if they could time limit scans to 24 hours instead of letting them go for three days. Then, whatever results could be shared, even if the scan is not complete, that would definitely help us.""Sometimes the scans are not done quickly, but the solutions that it provides are really good. The quality is high, but the analysis is not done extremely quickly."

More Veracode Cons »

"We've also had technical issues with blocking newly introduced vulnerabilities in PRs and that was creating a lot of extra work for developers in trying to close and reopen the PR to get rid of some areas. We ended up having to disable that feature altogether because it wasn't really working for us and it was actually slowing down developer velocity.""We have seen cases where tools didn't find or recognize certain dependencies. These are known issues, to some extent, due to the complexity in the language or stack that you using. There are some certain circumstances where the tool isn't actually finding what it's supposed to be finding, then it could be misleading.""It would be great if they can include dynamic, interactive, and run-time scanning features. Checkmarx and Veracode provide dynamic, interactive, and run-time scanning, but Snyk doesn't do that. That's the reason there is more inclination towards Veracode, Checkmarx, or AppScan. These are a few tools available in the market that do all four types of scanning: static, dynamic, interactive, and run-time.""We tried to integrate it into our software development environment but it went really badly. It took a lot of time and prevented the developers from using the IDE. Eventually, we didn't use it in the development area... I would like to see better integrations to help the developers get along better with the tool. And the plugin for the IDE is not so good. This is something we would like to have...""Because Snyk has so many integrations and so many things it can do, it's hard to really understand all of them and to get that information to each team that needs it... If there were more self-service, perhaps tutorials or overviews for new teams or developers, so that they could click through and see things themselves, that would help.""I would like to give further ability to grouping code repositories, in such a way that you could group them by the teams that own them, then produce alerting to those teams. The way that we are seeing it right now, the alerting only goes to a couple of places. I wish we could configure the code to go to different places.""We would like to have upfront knowledge on how easy it should be to just pull in an upgraded dependency, e.g., even introduce full automation for dependencies supposed to have no impact on the business side of things. Therefore, we would like some output when you get the report with the dependencies. We want to get additional information on the expected impact of the business code that is using the dependency with the newer version. This probably won't be easy to add, but it would be helpful.""It lists projects. So, if you have a number of microservices in an enterprise, then you could have pages of findings. Developers will then spend zero time going through the pages of reports to figure out, "Is there something I need to fix?" While it may make sense to list all the projects and issues in these very long lists for completeness, Snyk could do a better job of bubbling up and grouping items, e.g., a higher level dashboard that draws attention to things that are new, the highest priority things, or things trending in the wrong direction. That would make it a lot easier. They don't quite have that yet in container security."

More Snyk Cons »

"An area of improvement for this solution is being able to customize the dashboard. For example, the dashboard does not allow us to view a previous months vulnerability results alongside current results to make comparisons.""The solution seems to focus too much on enterprises, and they really need a product that works for SMBs.""The interface could be improved; right now it's running on two interfaces simultaneously.""It would be helpful if Tenable could be more clear with regard to everything the solution can and cannot do with the particular license that you have.""The pricing of the solution could be more reasonable.""It can have more integration.""There needs to be better dashboard navigation."

More Tenable.io Vulnerability Management Cons »

Pricing and Cost Advice
"For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization.""I don't really know about the pricing, but I'd say it's worth whatever Veracode is charging, because the solution is that good.""Veracode's price is high. I would like them to better optimize their pricing.""If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount.""Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive.""We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive.""Veracode is one of the more expensive solutions in the market, but it is worth the expense because of the eLearning and the security consultations; everything is included in the license.""It is very reasonably priced compared to what we were paying our previous vendor. For the same price, we are getting much more value and reducing our AppSec costs from 40 to 50 percent."

More Veracode Pricing and Cost Advice »

"It's inexpensive and easy to license. It comes in standard package sizing, which is straightforward. This information is publicly found on their website.""We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon""It's good value. That's the primary thing. It's not cheap-cheap, but it's good value.""Snyk is a premium-priced product, so it's kind of expensive. The big con that I find frustrating is when a company charges extra for single sign-on (SSO) into their SaaS app. Snyk is one of the few that I'm willing to pay that add-on charge, but generally I disqualify products that charge an extra fee to do integrated authentication to our identity provider, like Okta or some other SSO. That is a big negative. We had to pay extra for that. That little annoyance aside, it is expensive. You get a lot out of it, but you're paying for that premium.""Their licensing model is fairly robust and scalable for our needs. I believe we have reached a reasonable agreement on the licensing to enable hundreds of developers to participate in this product offering. The solution is very tailored towards developers and its licensing model works well for us.""The price is good. Snyk had a good price compared to the competition, who had higher pricing than them. Also, their licensing and billing are clear.""You can get a good deal with Snyk for pricing. It's a little expensive, but it is worth it.""With Snyk, you get what you pay for. It is not a cheap solution, but you get a comprehensiveness and level of coverage that is very good. The dollars in the security budget only go so far. If I can maximize my value and be able to have some funds left over for other initiatives, I want to do that. That is what drives me to continue to say, "What's out there in the market? Snyk's expensive, but it's good. Is there something as good, but more affordable?" Ultimately, I find we could go cheaper, but we would lose the completeness of vision or scope. I am not willing to do that because Snyk does provide a pretty important benefit for us."

More Snyk Pricing and Cost Advice »

"There are additional features that can be licensed for an additional cost.""The solution is not too expensive."

More Tenable.io Vulnerability Management Pricing and Cost Advice »

report
Use our free recommendation engine to learn which Application Security solutions are best for your needs.
554,873 professionals have used our research since 2012.
Questions from the Community
Top Answer: SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis… more »
Top Answer: There is a single area on the dashboard where you can get a full view of all of the tests and the results from… more »
Top Answer: I was impressed with the pricing we got from Veracode. I was able to make it work very well within our budget.
Top Answer: Snyk does a great job identifying and reducing vulnerabilities. This solution is fully automated and monitors 24/7 to… more »
Top Answer: There are many valuable features. For example, the way the scanning feature works. The integration is cool because I can… more »
Top Answer: Pricing-wise, it is not expensive as compared to other tools. If you have a couple of licenses, you can scan a certain… more »
Top Answer:  Tenable Nessus is a vulnerability assessment solution that is both easy to deploy and easy to manage. The design of the… more »
Top Answer: It is very stable, and it is updated periodically by adding new vulnerabilities.
Comparisons
Learn More
Overview

Veracode covers all your Application Security needs in one solution through a combination of five analysis types; static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline, and empowers developers to find and fix security defects.

Snyk’s mission is to help developers use open source code and stay secure. The use of open source is booming, but security is a key concern (https://snyk.io/stateofossecurity/). Snyk’s unique developer focused product enables developers and enterprise security to continuously find & fix vulnerable dependencies without slowing down, with seamless integration into Dev & DevOps workflows. Snyk is adopted by over 100,000 developers, has multiple enterprise customers (such as Google, New Relic, ASOS and others) and is experiencing rapid growth. Our investors are Canaan Partners, BOLDStart, and several successful developer tools entrepreneurs. Snyk was founded in 2015 and is headquartered in London with offices in Israel and the US. For more information, go to https://snyk.io/.

Tenable.io Vulnerability Management provides the most accurate information about all your assets and vulnerabilities in ever-changing environments. Available for cloud or on-prem deployment, Tenable.io features a streamlined interface, intuitive guidance, and seamless integrations that help security teams maximize efficiency. When visibility and insight matter most, Tenable.io helps you truly understand your Cyber Exposure.

Offer
Keep your software secure

Application security starts with secure code. Find out more about the benefits of using Veracode to keep your software secure throughout the development lifecycle.

Learn more about Snyk
Learn more about Tenable.io Vulnerability Management
Sample Customers
State of Missouri, Rekner
StartApp, Segment, Skyscanner, DigitalOcean, Comic Relief
Global Payments AU/NZ
Top Industries
REVIEWERS
Financial Services Firm30%
Computer Software Company12%
Insurance Company9%
Healthcare Company7%
VISITORS READING REVIEWS
Computer Software Company30%
Comms Service Provider16%
Financial Services Firm10%
Manufacturing Company6%
VISITORS READING REVIEWS
Computer Software Company29%
Comms Service Provider21%
Financial Services Firm8%
Manufacturing Company5%
VISITORS READING REVIEWS
Computer Software Company27%
Comms Service Provider16%
Government11%
Financial Services Firm7%
Company Size
REVIEWERS
Small Business24%
Midsize Enterprise25%
Large Enterprise51%
VISITORS READING REVIEWS
Small Business24%
Midsize Enterprise31%
Large Enterprise45%
REVIEWERS
Small Business32%
Midsize Enterprise37%
Large Enterprise32%
VISITORS READING REVIEWS
Small Business35%
Midsize Enterprise13%
Large Enterprise51%
REVIEWERS
Small Business100%
Find out what your peers are saying about SonarSource, Veracode, Sonatype and others in Application Security. Updated: November 2021.
554,873 professionals have used our research since 2012.

Snyk is ranked 4th in Application Security with 19 reviews while Tenable.io Vulnerability Management is ranked 6th in Vulnerability Management with 7 reviews. Snyk is rated 8.4, while Tenable.io Vulnerability Management is rated 7.8. The top reviewer of Snyk writes "Helps Avoid The Pain And The Cost Of Trying To Retrofit Security in your Code". On the other hand, the top reviewer of Tenable.io Vulnerability Management writes "Very mature and quite stable but could use a better user interface". Snyk is most compared with SonarQube, WhiteSource, Black Duck, Checkmarx and GitLab, whereas Tenable.io Vulnerability Management is most compared with Tenable SC, Tenable Nessus, Rapid7 InsightVM, Qualys VM and Arctic Wolf Managed Risk.

We monitor all Application Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.