Veracode

Veracode provides application security testing as a service, covering static, dynamic and composition analysis alongside developer training. Delivering scanning as a service rather than as software the customer installs was the company's original distinguishing choice and it still shapes the product.

The service model removed a real obstacle. Static analysis tools required tuning, infrastructure and expertise the buying organisation frequently did not have, and a scan submitted to a service that returns verified results avoids the situation where a tool sits unconfigured because nobody had time to learn it properly.

Policy based scanning is the other structural idea and it suits how large organisations actually govern software. Rather than presenting every finding equally, a scan is assessed against a defined policy so that an application either passes or does not, which converts a long list into a decision somebody can act on.

Third party attestation is a use case worth knowing about. Enterprises increasingly require software vendors to demonstrate their applications have been assessed, and a recognised independent assessment is more persuasive to a customer's security team than a supplier's assurance that they scan internally.

No pricing is published, and this end of the market is priced by application count and scan frequency, typically under an annual contract with a minimum commitment.