Veracode

What the company sells

Veracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance. Veracode says it identifies and resolves application risks with decades of expertise and AI-driven insights. Veracode combines decades of security research, proprietary data, and AI-driven analysis to give enterprises a clearer view of application risk from code to runtime. Veracode describes the platform as a suite of application risk management tools purposely built to reduce risk, catch vulnerabilities early, and empower developers to deliver secure code across the SDLC.

Veracode Application Risk Management (ASPM) centralizes risk data across code, containers, and cloud. Application Security Posture Management prioritizes vulnerabilities and pinpoints the owner and root cause of each security issue. Veracode's Application Risk Management platform is described as helping quantify technical risks in business terms. Veracode consolidates scanning data (SAST, DAST, SCA) into a single source of truth. Over 100 languages and frameworks are supported to secure the SDLC.

Veracode's Static Application Security Testing (SAST) scans over 100 languages and frameworks in real time within IDEs and CI/CD pipelines. Static analysis can scan first-party source code alongside third-party or proprietary code when source is not available. Static analysis supports full program analysis for applications up to 5GB of code. The static analysis engine aligns its findings with the Common Weakness Enumeration (CWE) standard. Dynamic application security testing identifies and addresses runtime vulnerabilities in web apps and APIs through simulated attacks. Dynamic scans can be automated or scheduled to match release frequency, compliance, and policy needs. Dynamic scans can cover hundreds of assets across environments, including those behind a firewall. Resola used Veracode Dynamic Analysis for faster scans, improved security, and boosted customer trust. The platform automates open-source security scans, identifies new vulnerabilities, and manages license risks. SAST, DAST, SCA, IaC, and container scans are integrated into IDEs.

Veracode Container is included with the Veracode CLI, which is available on Windows, Linux, and MacOS. Container scanning inspects and corrects container images and Infrastructure as Code files. Tools for scanning containers and Infrastructure as Code cover vulnerabilities, misconfigurations and embedded secrets. The platform is described as proactively stopping vulnerabilities, malware, and policy violations before they reach development pipelines. Insights for security teams are curated by the Veracode Threat Research team and delivered via a proprietary threat feed. SBOMs can be created and managed, alongside third-party reviews and detailed reporting for compliance and stakeholder satisfaction. Veracode acquired Phylum, Inc technology for enhanced software composition analysis.

Veracode Fix brings AI-powered remediation to the code written in-house and the open-source libraries it depends on. Veracode Fix integrates into the IDE, CLI, or CI/CD tool, with interactive and batch modes. Developers get fix guidance directly in the IDE, CLI, and CI/CD, with quality gates. Fix suggestions are described as covering, on average, over 70% of detected flaws across 10 supported languages. Pull requests for open-source dependency fixes include version rationale, impacted components, and supporting references. Veracode Fix includes a configurable GitHub Action that scans and suggests on Pull and Merge in GitHub.

Security teams get unified visibility across code, dependencies, containers, and runtime signals. Developers get remediation guidance and AI-driven fixes inside the tools they already use. The platform gives governance, reporting, and policy control to support compliance and prove progress. eLearning and Security Labs provide hands-on training to build secure coding skills.

Veracode says its compliance and reporting capabilities help meet healthcare regulations like HIPAA and GDPR. Veracode says its AppSec solutions safeguard energy systems and smart grids. Veracode says its on-demand application security testing solution allows financial institutions to meet GLBA compliance as part of their overall security program. Manhattan Associates is described as automating appsec across its development environment. HDI Global SE is described as making its security innovation initiative a measurable reality. Cox Automotive is described as boosting time to market.^{[1][3][5][6][7][8][11][12][13][15][16][17]}

Categories

• Static application security testing (primary category)
• Dynamic application security testing
• Software composition analysis
• Software supply chain security
• Compare Veracode with companies in the same categoryside by side

Headquarters

Not established from our sources

Founded

Not established from our sources

Ownership

Owned by Thoma Bravo since 2019^{[2][4][10][14]}

CISO on record

Not yet on our record. Send a verified source

Website

veracode.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

• Veracode Dynamic Analysis^[13]

  Dynamic scanning for runtime vulnerabilities in web apps and APIs.

  Dynamic application security testing identifies and addresses runtime vulnerabilities in web apps and APIs through simulated attacks. Dynamic scans can be automated or scheduled to match release frequency, compliance, and policy needs. Dynamic scans can cover hundreds of assets across environments, including those behind a firewall.

• Veracode Fix^[15]

  AI-powered remediation for in-house code and open-source libraries.

  Veracode Fix brings AI-powered remediation to the code written in-house and the open-source libraries it depends on. Veracode Fix integrates into the IDE, CLI, or CI/CD tool, with interactive and batch modes.

• eLearning^[4][11]

  Hands-on training to build secure coding skills.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of Veracode's categories, then alphabetical. A list from the record, never a ranking.

• On static application security testing, Veracode competes with Checkmarx, GitLab, GitHub Advanced Security, Kiuwan, Semgrep, AISLE, OpenText, Arnica, Black Duck, Endor Labs and 13 more.

• On dynamic application security testing, Veracode competes with Invicti, Beagle Security, Detectify, StackHawk, Black Duck, Checkmarx, Mend.io, Fleuret AI, 42Crunch, Astra Security and 7 more.

• On software composition analysis, Veracode competes with Black Duck, Endor Labs, Mend.io, Snyk, Sonatype, Arnica, Checkmarx, GitLab, Invicti, JFrog and 10 more.

• On software supply chain security, Veracode competes with JFrog, Anchore, RapidFort, Socket, Archipelo, Chainguard, Minimus, Red Hat, Arnica, Endor Labs and 15 more.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

• G2 · 4.5 out of 5^[10]seen November 4, 2026

Recent news

Dated company events from the last twelve months, each in one sentence of ours with its source. Newest first.

• February 5, 2026

  Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025. Business Wire^[9]

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

1. [1]PlatformVeracode · veracode.com · undated page, accessed September 27, 2026 · Tier A: the company, a regulator or a filing
2. [2]Thoma bravo completes acquisition of veracode softwareThoma Bravo · thomabravo.com · published January 2, 2019 · Tier A: the company, a regulator or a filing
3. [3]Veracode | Application Risk Management PlatformVeracode · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
4. [4]Application Risk Management: Secure Your SoftwareVeracode · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
5. [5]Static Application Security Testing (SAST) with VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
6. [6]Code Confidently with Veracode Package FirewallVeracode · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
7. [7]Container Security | VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
8. [8]Scan containers, IaC, and secrets | Veracode DocsVeracode Docs · undated page, accessed October 30, 2026 · Tier A: the company, a regulator or a filing
9. [9]Veracode Closes Record Year of Growth and Innovation Amid Surging Demand for Application Risk ManagementBusiness Wire · published February 5, 2026 · Tier A: the company, a regulator or a filing
10. [10]Veracode Application Security Platform Reviews & Product DetailsG2 · undated page, accessed October 30, 2026 · Tier C
11. [11]Veracode | Application Risk Management SolutionsVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
12. [12]Chief Risk Officer (CRO) | Application Risk Management | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
13. [13]Dynamic Application Security Testing (DAST) with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
14. [14]Application Security for Healthcare | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
15. [15]AI Code Remediation | Fix Application Vulnerabilities with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
16. [16]Application Security for the Energy Sector | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing
17. [17]GLBA Financial Security Compliance | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A: the company, a regulator or a filing

Last verified September 27, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded September 27, 2026, expanded November 4, 2026 from the references above.

Work for Veracode? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.