Veracode Static Analysis review

Veracode Static Analysis fits enterprises that must cover a large and mixed portfolio, including older and mobile code, under one policy. Veracode states support for more than 100 languages and frameworks, the widest claim on this list, and its patented path analysis reports every execution path an attacker could use to reach vulnerable code. Scans run in the IDE for quick feedback, in CI/CD pipelines where policy can stop flawed code from reaching product builds, and from a CLI. Veracode Fix adds AI-generated remediation, and the reporting focuses on policy, analytics and portfolio risk, which suits security leaders reporting to auditors or boards. The same platform sells SCA, DAST, container scanning and a package firewall. The drawbacks are the usual enterprise ones: there is no published price, so we left it pending, and onboarding is heavier than connecting a repository to SonarQube Cloud or Codacy.

Who it is for

Enterprises with large, mixed portfolios that need policy and risk reporting

Price

See vendor pricing (USD check pending).

US price check pending. See the vendor pricing page.

Key features

• Coverage for 100+ languages and frameworks, including legacy, mobile and cloud-native stacks
• Patented path analysis (US 9,286,063) that reports execution paths to vulnerable code
• IDE scanning, CI/CD pipeline scans and a CLI
• Veracode Fix for AI code remediation
• Policy, analytics and portfolio risk reporting

Strengths and weaknesses

• Strength: Broadest stated language coverage on this list at 100+ languages and frameworks
• Strength: Policy checks can stop flawed code from reaching product builds
• Strength: Part of a platform with SCA, DAST, container and package firewall products
• Weakness: No public pricing; you need a sales quote
• Weakness: Heavier to adopt than pull request tools for small teams
• Weakness: Most value comes from the wider Veracode platform, not SAST alone

Key facts

• Pricing: Custom quote
• Languages: 100+ languages and frameworks
• Where it runs: IDE, CI/CD pipeline, CLI

Where it ranks

Veracode Static Analysis is No. 9 in our Best Static Code Analysis Tools verdict.