Veracode review

Veracode is an application security platform for finding and managing software risks across the development lifecycle. Its stated coverage includes code, dependencies, containers and runtime signals, with tools for security teams, developers and leaders to assess risk and track remediation.

The feature set described for the platform includes application risk identification, automated and AI-driven flaw fixes, third-party and open-source dependency assessment, and security checks for applications built with AI-generated code. Veracode also supports security practices across development phases, plus policy controls, reporting and compliance work.

That is broad coverage, but the available product description does not spell out which capabilities come with which plan or how they are priced. The pricing information we have lists a custom enterprise quote and says monthly and annual prices are not published. If you are comparing vendors, ask Veracode to map each required capability to a quoted package before treating the platform as an all-in-one option.

Veracode’s main selling point is scope: its stated feature set spans risk identification, remediation, software supply chain checks and governance, rather than focusing on just one scanning task. That could suit organizations trying to coordinate application security across developers, security teams and leadership.

The platform also addresses two concerns that are increasingly relevant to software teams: third-party dependencies and AI-generated code. Its described features include assessing libraries and open-source contributions, identifying risks in applications built with AI-generated code, and offering AI-driven remediation. Policy controls and reporting may also help teams connect technical findings with governance and compliance needs. The available product information does not specify exact language support, scan limits or which features are gated by plan, so confirm those details against your own code and workflows.

A Reddit discussion about SAST selection includes one commenter noting that Veracode scans binaries rather than source code, which may matter to teams that do not want source uploaded. Another commenter specifically suggested Veracode for that reason. Treat this as user-reported information and verify the current workflow with the vendor.

The clearest buying drawback is price opacity. The pricing information available to us lists no monthly or annual price and points buyers to a custom enterprise quote. It does not publish a free plan, trial details, plan-level feature breakdown or usage caps. That makes it hard to compare cost or estimate spend before speaking with sales; ask for limits and overage terms in writing.

There are also negative user reports worth checking, though Reddit comments are anecdotal, not a product audit. In one cybersecurity thread, users alleged layoffs and offshoring affecting Static, Dynamic and SCA teams, and commenters raised concerns about product investment, support and institutional knowledge. Other commenters described Veracode as dated or not compelling. These claims do not establish current product quality, but they are reasonable topics for reference checks.

For SAST, requirements matter: Reddit users describe Veracode as binary-scanning rather than source-scanning, while another commenter saw that as a privacy advantage. Confirm deployment, data handling and scan inputs directly before committing.

Veracode’s pricing is not published, so there’s no reliable starting price or tier-by-tier comparison. The pricing information checked on November 7, 2026, lists a custom enterprise quote and says to contact sales. It gives no monthly or annual price.

The published pricing details list no free plan, but a free trial is not published. They also give no prices for add-ons, no billing terms, and no limits or included features for the custom plan. That means there’s no documented price jump between tiers to calculate—and no public tier structure to compare against another vendor.

Treat the quote as a sales conversation, not a predictable line item. Ask for the full cost by product, application or user, and confirm what’s included in the quote. Get renewal terms, billing cadence, and any charges for support or extra coverage in writing. The available pricing data is marked low confidence, so verify current terms directly with Veracode before budgeting.

A move to Veracode needs a scope check before a migration plan. Its stated coverage spans code, dependencies, containers, and runtime signals, plus governance and compliance. Map your current tools and policies to those areas, then ask Veracode which products and integrations the quote covers. The published material does not say how long migration takes or document export formats, APIs, or retention terms; confirm those before signing.

If you leave, request a written account of what data can be exported, in what format, and for how long you can access it after cancellation. Don’t assume scan history, findings, policies, or reports transfer cleanly to a replacement platform.

The brief flags user reports as worth checking, but includes no Reddit posts or specific complaints. We can’t responsibly name reasons users leave based on that alone. Look for recent threads, and ask Veracode for references from customers moving in or out of the platform.