Veracode Application Security Platform

Short Summary

Veracode is a privately held application security vendor headquartered in Burlington, Massachusetts, founded in 2006 by security consultants with deep experience working alongside white-hat hackers. The company was created to address a persistent mismatch between fast-moving software delivery and the reality that many applications were never designed with security in mind—an issue amplified by agile development, DevOps speed pressures, increasingly complex IT environments, and a shortage of qualified security experts. Veracode’s founding vision was a cloud-native, integrated security testing platform that makes vulnerability identification and proactive remediation easy and cost-effective, especially for modern applications assembled from multiple teams, languages, frameworks, and third-party libraries.

A key differentiator is Veracode’s static binary code analysis, which assesses entire built applications rather than isolated source modules, improving visibility into cross-module and cross-language exploit paths. Over time, the platform expanded into a unified SaaS offering spanning the software development lifecycle, with strong CI/CD integrations, automation, consolidated reporting, and developer-friendly workflows. The company’s ownership changed hands multiple times—acquired by CA Technologies in 2017, then Broadcom in 2018, and later acquired from Broadcom by Thoma Bravo in late 2018—yet these transitions reportedly helped it sharpen focus on DevSecOps and platform consolidation.

Today the Veracode Application Security Platform includes Static Analysis (SAST across 24 languages, extensive frameworks and integrations, binary scanning without source access, low false positives), Dynamic Analysis (runtime web testing, scalable next-gen unified solution, recurrent scheduling, low false positives), and Software Composition Analysis (inventorying open-source/third-party components, licensing and vulnerability insights, build-blocking policies via a centralized database). Additional offerings include Veracode Verified (process-oriented certification) and Greenlight (in-IDE continuous feedback and education), plus consulting, training, and manual penetration testing with policy-aligned reporting.

Interesting Facts

• Veracode is headquartered in Burlington, Massachusetts, USA.
• Veracode was founded in 2006.
• Veracode was acquired by CA Technologies in 2017.
• Broadcom acquired CA Technologies in 2018.
• Thoma Bravo announced the acquisition of Veracode from Broadcom at the end of 2018, making Veracode independent again.
• More than 140,000 software developers and security experts use the platform across over 2,100 enterprises worldwide.
• The partner network spans more than 30 countries and includes 390 partners.
• Veracode Static Analysis supports 24 programming languages, 29 integrations, and over 70 development frameworks.
• Half of all static scans take less than 15 minutes, and the out-of-the-box false positive rate is stated as less than 1.1%.
• No personally identifiable information (PII) is ever submitted to or accessed by Veracode.

Notable Quotes

• “developers continue to see security as a nuisance and innovation blocker.”
• “providing an integrated cloud-native security testing platform to make the process of identifying and proactively fixing vulnerabilities in software as easy and cost-effective as possible.”
• “allows assessing the security posture of entire applications after they’ve been built instead of analyzing separate parts of source code”
• “Veracode claims that most customers start using the platform within an hour”
• “more important is the low false positive rate of less than 1.1% provided out of the box”
• “Dynamic application testing complements the static analysis by focusing on different kinds of vulnerabilities which are difficult to identify from the source code alone”
• “a single point in time snapshot can be misleading and is quickly outdated.”
• “give instant feedback during the coding process.”
• “identifying a potential flaw within seconds”
• “Complex applications may take hours to scan, although rescans can be much faster thanks to fingerprinting of unchanged modules”