Veracode

Veracode is one of the most established enterprise application security platforms in the world, founded in 2006 in Burlington, Massachusetts and pioneering the cloud-based binary SAST scanning model that remains its core technical differentiator today. Acquired by Broadcom in 2024 after previously being owned by CA Technologies, Veracode continues to serve large enterprises and regulated industries with a comprehensive AppSec suite covering binary SAST, DAST, SCA, manual penetration testing, developer security training, and AI-powered remediation.

Veracode\u2019s defining capability is its binary analysis approach: rather than scanning source code like most SAST tools, Veracode\u2019s Upload-and-Scan engine analyzes compiled application artifacts \u2014 JAR files, WAR files, DLLs, executables \u2014 without requiring source code access. This approach catches vulnerabilities introduced during compilation, finds issues in third-party libraries and legacy code where source isn\u2019t available, and produces fewer false positives because it scans exactly what runs in production. In 2025-2026, Veracode expanded its AI capabilities with Veracode Fix \u2014 an AI remediation engine that generates code patches for detected vulnerabilities across 11 languages, now bundled with SAST at no additional charge, with customers reporting up to 92% reduction in fix time. Veracode\u2019s Spring 2026 GenAI Code Security Report found 45% of AI-generated code contained known vulnerabilities without explicit security guidance, positioning Veracode Fix as a critical tool for AI-assisted development.

Veracode is the right choice for large enterprises in regulated industries \u2014 financial services, healthcare, government, defense \u2014 with strict compliance requirements (PCI-DSS, HIPAA, NIST, FedRAMP), large legacy application portfolios, third-party code dependencies without source access, and the need for a comprehensive AppSec program backed by two decades of binary analysis expertise.

Veracode does not publish pricing publicly \u2014 all plans require direct engagement with the sales team.

Pricing is per-application (not per-developer), scaling with application count and scan frequency. Reference pricing: Static Analysis (SAST) starts at approximately $10,000-$15,000/year for up to 100 applications. Full enterprise packages combining SAST, DAST, SCA, Pipeline Scan, and Veracode Fix typically run $100,000-$250,000+/year for large application portfolios.

Veracode Fix AI remediation is bundled with Static Analysis SAST at no additional charge as of 2026 \u2014 a notable advantage over competitors that charge separately for AI remediation. Contact Veracode through veracode.com for enterprise pricing and application portfolio assessment.