CISO Tribune

Vendor comparison · 2 companies

Socket vs Veracode

Socket offers a developer-first platform that blocks malicious packages before they reach the code of its users. Veracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance. CISO Tribune files both under Software supply chain security and Software composition analysis. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Socket
  • Veracode
Socket vs Veracode: Products, Customers and Funding Compared
SocketSocket offers a developer-first platform that blocks malicious packages before they reach the code of its users.socket.devVeracodeVeracode sells an Application Risk Management Platform that identifies risks across the software development lifecycle, automates flaw fixes, and simplifies governance and compliance.veracode.com
What it sells
  • Socket Firewall[1][3]Blocks malicious packages at install.
  • Socket for GitHub[1][3]Catches risky dependency additions and malicious updates in pull requests before they merge.
  • Dependency Search[1][3]Shows security insights for open source packages across every major registry.
  • Veracode Dynamic Analysis[13]Dynamic scanning for runtime vulnerabilities in web apps and APIs.
  • Veracode Fix[15]AI-powered remediation for in-house code and open-source libraries.
  • eLearning[4][11]Hands-on training to build secure coding skills.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
Not stated on its pagesNot stated on its pages
Ownership and funding
Not stated on its pagesOwned by Thoma Bravo since 2019[2][4][10][14]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • May 20, 2026Socket announced a $60 million Series C funding round at a $1 billion valuation, led by Thrive Capital.[7]
  • February 5, 2026Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.[9]
G2 and Gartner Peer Insights
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 4, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
Socket says it serves industries including technology, media, healthcare and finance. Socket describes its platform as developer-first. Socket describes one of its plans as meant for building solo or in a small team.The company says its platform gives enterprises a clearer view of application risk from code to runtime. The company addresses financial institutions on GLBA compliance. The company addresses healthcare regulations like HIPAA and GDPR. The company addresses developers who want remediation guidance and AI-driven fixes inside the tools they already use.
Last verified
November 5, 2026September 27, 2026

Where they overlap

  • Socket and Veracode are both filed under Software supply chain security and Software composition analysis.

Where they differ, field by field

  • Socket's primary category is Software supply chain security; Veracode's is Static application security testing.
  • Veracode is also filed under Dynamic application security testing.
  • Socket lists Socket Firewall, Socket for GitHub and Dependency Search. Veracode lists Veracode Dynamic Analysis, Veracode Fix and eLearning.
  • Veracode is owned by Thoma Bravo, since 2019.

What it sells: Socket

What Socket for GitHub does[1][3]
Socket for GitHub catches risky dependency additions and malicious updates in pull requests before they merge. A GitHub account is connected so that Socket can access and scan the repositories, and customers choose the repositories that Socket protects automatically. Socket can run on a CI/CD pipeline and creates a report for review. Socket creates a project health report for a project.
What Dependency Search does[1][3]
Dependency Search shows security insights for millions of open source packages across every major registry. Socket lets a user look up supply chain risks for a given version of a package in the ecosystem registry.

What it sells: Veracode

What Veracode Dynamic Analysis does[13]
Dynamic application security testing identifies and addresses runtime vulnerabilities in web apps and APIs through simulated attacks. Dynamic scans can be automated or scheduled to match release frequency, compliance, and policy needs. Dynamic scans can cover hundreds of assets across environments, including those behind a firewall.
What Veracode Fix does[15]
Veracode Fix brings AI-powered remediation to the code written in-house and the open-source libraries it depends on. Veracode Fix integrates into the IDE, CLI, or CI/CD tool, with interactive and batch modes.

Questions about Socket and Veracode

What do Socket and Veracode sell?
Socket sells Socket Firewall, Socket for GitHub and Dependency Search. Veracode sells Veracode Dynamic Analysis, Veracode Fix and eLearning.
Are Socket and Veracode in the same category?
They share Software supply chain security and Software composition analysis. Socket's primary category is Software supply chain security and Veracode's is Static application security testing.
Who owns Socket and Veracode?
Veracode is owned by Thoma Bravo, since 2019.
Who are Socket and Veracode sold to?
Socket says it serves industries including technology, media, healthcare and finance. The company says its platform gives enterprises a clearer view of application risk from code to runtime.
What have Socket and Veracode announced recently?
May 20, 2026: Socket announced a $60 million Series C funding round at a $1 billion valuation, led by Thrive Capital. February 5, 2026: Veracode announced that its new Annual Contract Value rose 81 percent year over year in the final quarter of 2025.

About Socket

Socket offers a developer-first platform that blocks malicious packages before they reach the code of its users. Socket was founded in 2021 to tackle the growing threat of software supply chain attacks.[1][3]

Socket says modern apps rely on thousands of open source packages, and that dependencies are a common hiding place for malicious code. Socket says AI coding tools are accelerating how fast dependencies enter production. Socket describes packages as entering through managers, updates, AI code and transitive installs, often reaching production before teams can review every change. Socket describes CVE databases as tracking disclosed vulnerabilities, not malicious package behavior such as secret theft, exfiltration, install scripts or impersonation.[4]

Socket states that open source makes up 90% of modern application code. Socket scans every package and update for malicious behavior across all major registries. Socket analyzes the behavior of dependencies and provides real-time protection against both known and emerging threats.[1][3]

Socket Firewall blocks malicious packages at install. Socket for GitHub catches risky dependency additions and malicious updates in pull requests before they merge. Socket Reachability filters vulnerability noise by what is reachable from the code. Dependency Search shows security insights for millions of open source packages across every major registry. Socket lets a user look up supply chain risks for a given version of a package in the ecosystem registry.[1][3][5]

An organization is set up in Socket to manage access and protection settings. A GitHub account is connected so that Socket can access and scan the repositories. Customers choose the repositories that Socket protects automatically. Socket can run on a CI/CD pipeline and creates a report for review. Socket creates a project health report for a project. Socket states that source code never leaves the computer or CI environment of the customer, and that only the list of dependencies is sent to Socket's service. Socket counts a developer as someone who made a commit to a repository scanned by Socket in the past 90 days.[5][6]

Socket serves industries including technology, media, healthcare and finance. Socket describes one of its plans as meant for building solo or in a small team.[6]

Socket on the record

Sources

Socket full record

  1. [1]socket.devSocket · socket.dev · undated page, accessed November 5, 2026 · Tier A
  2. [2]Redefining Supply Chain Security - SocketSocket · undated page, accessed November 10, 2026 · Tier A
  3. [3]Socket - Block zero-day supply chain attacksSocket · undated page, accessed November 10, 2026 · Tier A
  4. [4]What is SocketSocket · undated page, accessed November 10, 2026 · Tier A
  5. [5]Socket for GitHubSocket · undated page, accessed November 10, 2026 · Tier A
  6. [6]Pricing - SocketSocket · undated page, accessed November 10, 2026 · Tier A
  7. [7]Socket raises $60M Series C at $1B valuation led by Thrive Capital to secure AI-driven software development | SocketSocket · published May 20, 2026 · Tier A

Veracode full record

  1. [1]PlatformVeracode · veracode.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Thoma bravo completes acquisition of veracode softwareThoma Bravo · thomabravo.com · published January 2, 2019 · Tier A
  3. [3]Veracode | Application Risk Management PlatformVeracode · undated page, accessed October 30, 2026 · Tier A
  4. [4]Application Risk Management: Secure Your SoftwareVeracode · undated page, accessed October 30, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) with VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  6. [6]Code Confidently with Veracode Package FirewallVeracode · undated page, accessed October 30, 2026 · Tier A
  7. [7]Container Security | VeracodeVeracode · undated page, accessed October 30, 2026 · Tier A
  8. [8]Scan containers, IaC, and secrets | Veracode DocsVeracode Docs · undated page, accessed October 30, 2026 · Tier A
  9. [9]Veracode Closes Record Year of Growth and Innovation Amid Surging Demand for Application Risk ManagementBusiness Wire · published February 5, 2026 · Tier A
  10. [10]Veracode Application Security Platform Reviews & Product DetailsG2 · undated page, accessed October 30, 2026 · Tier C
  11. [11]Veracode | Application Risk Management SolutionsVeracode · undated page, accessed November 4, 2026 · Tier A
  12. [12]Chief Risk Officer (CRO) | Application Risk Management | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  13. [13]Dynamic Application Security Testing (DAST) with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  14. [14]Application Security for Healthcare | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  15. [15]AI Code Remediation | Fix Application Vulnerabilities with VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  16. [16]Application Security for the Energy Sector | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A
  17. [17]GLBA Financial Security Compliance | VeracodeVeracode · undated page, accessed November 4, 2026 · Tier A

Spot a factual error? Request a correction.