CISO Tribune

Vendor comparison · 2 companies

Kiuwan vs Veracode

Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). Veracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance. CISO Tribune files both under Static application security testing and Software composition analysis. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Kiuwan
  • Veracode
Kiuwan vs Veracode: Products, Customers and Funding Compared
KiuwanKiuwan sells static application security testing (SAST) and software composition analysis (SCA).kiuwan.comVeracodeVeracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance.veracode.com
What it sells
  • Code Security[1][5][7]A static application security testing tool that finds and prioritizes vulnerabilities across a codebase.
  • Insights[1][6]Supports SBOM generation by providing the components and information needed.
  • Code Quality[1][7][8]Code quality in a cloud environment for security QA engineers and IT teams.
  • Veracode Dynamic Analysis[13]Dynamic scanning for runtime vulnerabilities in web apps and APIs.
  • Veracode Fix[15]AI-powered remediation for in-house code and open-source libraries.
  • eLearning[4][11]Hands-on training to build secure coding skills.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Owned by Idera, Inc. since 2018[2][3]Owned by Thoma Bravo since 2019[2][4][10][14]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
Not stated on its pages
  • February 5, 2026Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.[9]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI. Kiuwan Governance is aimed at stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan can be run in the cloud, as hybrid-cloud based solutions, or on-premise.The company says its platform gives enterprises a clearer view of application risk from code to runtime. The company addresses financial institutions on GLBA compliance. The company addresses healthcare regulations like HIPAA and GDPR. The company addresses developers who want remediation guidance and AI-driven fixes inside the tools they already use.
Last verified
October 16, 2026September 27, 2026

Where they overlap

  • Static application security testing is the primary category of both Kiuwan and Veracode; both are also filed under Software composition analysis.

Where they differ, field by field

  • Veracode is also filed under Dynamic application security testing and Software supply chain security.
  • Kiuwan lists Code Security, Insights and Code Quality. Veracode lists Veracode Dynamic Analysis, Veracode Fix and eLearning.
  • Kiuwan is owned by Idera, Inc., since 2018. Veracode is owned by Thoma Bravo, since 2019.

How they differ

CISO Tribune files Kiuwan under static application security testing and software composition analysis, with static application security testing as its primary category. CISO Tribune files Veracode under static application security testing, dynamic application security testing, software composition analysis and software supply chain security, again with static application security testing as primary. Both companies therefore sell static analysis and software composition analysis, while only Veracode is filed under dynamic testing and supply chain security. Kiuwan sells Code Security, Insights and Code Quality, and Insights can export an SBOM in the CycloneDX format. Veracode sells Veracode Dynamic Analysis, Veracode Fix and eLearning, and it describes an Application Risk Management Platform that consolidates SAST, DAST and SCA scanning data.

Kiuwan says Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. Kiuwan also describes hybrid-cloud options. Veracode says its static analysis scans over 100 languages and frameworks, while Kiuwan says Code Security covers 30+ languages. Veracode Fix offers AI-powered remediation for in-house code and open-source libraries. Kiuwan Governance groups the results of code analyses into separate portfolios.

Kiuwan was founded in 2003 in Spain, was acquired by Idera, Inc. in 2018, and is now part of Sembi. Veracode is owned by Thoma Bravo, since 2019. Among the customers Veracode names are Resola, Manhattan Associates, HDI Global SE and Cox Automotive. On February 5, 2026, Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.

What it sells: Kiuwan

What Code Security does[1][5][7]
Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. Kiuwan states that Kiuwan Code Security is compliant with security standards including CWE, OWASP, PCI, CERT, and SANS.
What Insights does[1][6]
Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications.

What it sells: Veracode

What Veracode Dynamic Analysis does[13]
Dynamic application security testing identifies and addresses runtime vulnerabilities in web apps and APIs through simulated attacks. Dynamic scans can be automated or scheduled to match release frequency, compliance, and policy needs. Dynamic scans can cover hundreds of assets across environments, including those behind a firewall.
What Veracode Fix does[15]
Veracode Fix brings AI-powered remediation to the code written in-house and the open-source libraries it depends on. Veracode Fix integrates into the IDE, CLI, or CI/CD tool, with interactive and batch modes.

Questions about Kiuwan and Veracode

What do Kiuwan and Veracode sell?
Kiuwan sells Code Security, Insights and Code Quality. Veracode sells Veracode Dynamic Analysis, Veracode Fix and eLearning.
Are Kiuwan and Veracode in the same category?
Yes. Static application security testing is the primary category of both on CISO Tribune.
Who owns Kiuwan and Veracode?
Kiuwan is owned by Idera, Inc., since 2018. Veracode is owned by Thoma Bravo, since 2019.
Who are Kiuwan and Veracode sold to?
Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI. The company says its platform gives enterprises a clearer view of application risk from code to runtime.
What have Kiuwan and Veracode announced recently?
February 5, 2026: Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.

About Kiuwan

Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). Kiuwan was founded in 2003 in Spain. Idera, Inc. acquired Kiuwan in 2018. Kiuwan is now part of Sembi. Kiuwan works with all common programming languages and dev environments. Kiuwan describes its tool set as designed for dev teams across the SDLC.[1][4][7]

Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Kiuwan describes SAST as analysis of source code to detect security vulnerabilities before an application is executed. Kiuwan Code Security scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security analyzes code in the IDE with real-time feedback on every save. Kiuwan Code Security supports local pre-commit analysis and automated scans in a CI/CD pipeline. Kiuwan Code Security can detect injection attacks, cross-site scripting, cross-site request forgery, broken authentication, insecure cryptography, access control flaws, and security misconfigurations.[1][5]

Kiuwan Code Security covers 30+ languages, including Java, Python, JavaScript, C#, Go, and Swift. Kiuwan Code Security offers IDE plugins for Visual Studio, VS Code, Eclipse, and JetBrains. Kiuwan has native plugins for Jenkins and Azure DevOps that add scans to the build process. GitLab CI integrates with Kiuwan via the local analyzer. Kiuwan offers integration with popular IDEs, version control systems, issue trackers, and CI/CD pipelines.[5][6]

Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. The Kiuwan local analyzer (KLA) runs entirely on the user infrastructure for air-tight environments or data residency requirements. Kiuwan offers source code analysis and vulnerability tracking solutions either on-premise or in the cloud. Kiuwan can be run as hybrid-cloud based solutions or with a local analyzer for integration with development environments.[5][6][7]

Kiuwan describes its SCA as addressing third-party components, to remediate vulnerabilities and ensure license compliance. Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications. Kiuwan Governance groups the results of code analyses into separate portfolios. Kiuwan Governance serves stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan identifies risky software applications with decision quadrants. Kiuwan tracks dev team and vendor activity across projects and change requests. Kiuwan forecasts the evolution of an application portfolio with predictive analytics. Kiuwan provides measurement of software quality, prioritization of key issues, and remediation plans from findings.[1][5][6][7]

Kiuwan sells plans ranging from focused SAST coverage to full SAST, SCA, Code Quality, Governance, and enterprise support. Kiuwan pricing scales by number of users and applications, and lines of code pricing is available. Kiuwan provides reports used to review vulnerabilities and identify app and code quality issues requiring remediation. Kiuwan aligns with industry regulations such as OWASP, CISA, NTIA, SBOM, GDPR, HIPAA, and PCI DSS. Kiuwan describes its SAST as compliant with financial security standards like NYDFS, GLBA, and PCI. Kiuwan describes its SAST as compliant with banking security standards such as ISO/IEC, NIST, and PCI.[1][4][5][6][7][8][9][10]

Kiuwan on the record

Sources

Kiuwan full record

  1. [1]kiuwan.comKiuwan · kiuwan.com · undated page, accessed October 16, 2026 · Tier A
  2. [2]Idera acquires kiuwanKiuwan · kiuwan.com · published May 26, 2021 · Tier A
  3. [3]About Us | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  4. [4]Why US Organizations Need Kiuwan | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  6. [6]SBOM Software Bill Of Materials | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  7. [7]Code Security | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  8. [8]Pricing | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  9. [9]Why Finance Organizations Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  10. [10]Why Banks Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A

Veracode full record

  1. [1]PlatformVeracode · veracode.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Thoma bravo completes acquisition of veracode softwareThoma Bravo · thomabravo.com · published January 2, 2019 · Tier A
  3. [3]Veracode | Application Risk Management PlatformVeracode · undated page, accessed October 30, 2026 · Tier A
  4. [4]Application Risk Management: Secure Your SoftwareVeracode · undated page, accessed October 30, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) with VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  6. [6]Code Confidently with Veracode Package FirewallVeracode · undated page, accessed October 30, 2026 · Tier A
  7. [7]Container Security | VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  8. [8]Scan containers, IaC, and secrets | Veracode DocsVeracode Docs · undated page, accessed October 30, 2026 · Tier A
  9. [9]Veracode Closes Record Year of Growth and Innovation Amid Surging Demand for Application Risk ManagementBusiness Wire · published February 5, 2026 · Tier A
  10. [10]Veracode Application Security Platform Reviews & Product DetailsG2 · undated page, accessed October 30, 2026 · Tier C
  11. [11]Veracode | Application Risk Management SolutionsVeracode · undated page, accessed November 4, 2026 · Tier A
  12. [12]Chief Risk Officer (CRO) | Application Risk Management | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  13. [13]Dynamic Application Security Testing (DAST) with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  14. [14]Application Security for Healthcare | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  15. [15]AI Code Remediation | Fix Application Vulnerabilities with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  16. [16]Application Security for the Energy Sector | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  17. [17]GLBA Financial Security Compliance | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A

Spot a factual error? Request a correction.