Veracode

How does Fluid Attacks' solution compare to Veracode's? The following comparison table enables you to discern the performance of both providers across various attributes essential for meeting your company’s cybersecurity needs. To better understand each attribute, read their descriptions in the dedicated page.

Organization

Attribute	Essential	Advanced	Veracode
Focus	Native ASPM with In-house scanners	AI-powered PTaaS on top of native ASPM with In-house scanners	Native ASPM with In-house scanners
Extras	None	None	MPT and PTaaS
Headcount	136	Same	545
Headcount distribution	Engineering 40%, TI 15%, sales 13%, marketing 2%, operations 4% and others 26%	Same	Engineering 27%, TI 17%, sales 14%, marketing 4%, operations 3% and others 35%
Headcount growth	+3%, -2%, -7%	Same	-4%, -15%, -24%
Headquarters	86% CO	Same	78% US
Countries	CO and US	Same	GB and US
Reputation	9.79 from 161 reviews over 7 years on Gartner and Clutch	Same	8.49 from 764 reviews over 10 years on G2, Gartner, PeerSpot, Software Advice and TrustRadius
Followers	20K based on the following: Facebook, Instagram, LinkedIn, X and YouTube	Same	110K based on the following social media: Facebook, Instagram, LinkedIn, X and YouTube
Research firms	None	None	451 Research, Everest Group, Forrester, Frost & Sullivan and IDC
Founded	2001	Same	2006
Funding	Bootstrapped	Same	$114.3M USD in 7 rounds from 14 investors
Acquisitions	None	None	Acquired 0 times and made 5 acquisitions
Revenue	5M to 10M	Same	100M to 500M
CVE	257 CVEs reported to MITRE, ranked in the top 10 CVE labs worldwide	Same	Not applicable
Compliance	SOC 2 Type II and SOC 3	Same	CyberGRX, SOC 2 Type II, SOC 3 and TruSight
Bug bounty	Yes	Yes	No
Visits	19K per month. Top 3: 50% NL, 17% CO, 6% US and others 27%	Same	113K per month. Top 3: 40% US, 12% IN, 6% PT and others 42%
Authority	32 out of 100	Same	45 out of 100
Vulnerability database	Discovered	Same	Discovered and third-party
Content	Blog, documentation, e-books, reports, videos, webinars and whitepapers	Same	Blog, documentation, e-books, infographics, podcast, videos, webinars and white papers
Knowledge base	13 KB sections, 6 in common and 7 additional	Same	7 KB sections, 6 in common and 1 additional
Community	Forum	Same	Forum
Sync training	No	No	No
Async training	3 product use courses, all free	Same	Security education platform with 55 courses (subscription-based) and 58 security education courses (subscription-based)
Distribution	Direct or with any of its 14 partners	Same	Direct or with any of its 545 partners
Marketplaces	AWS	Same	AWS and Azure
Freemium	No	No	No
Free trial	21-day free trial	PoV	14-day free trial and PoV
Demo	Yes	Yes	Yes
Pricing	Contact sales, marketplace and public web	Contact sales and public web	Contact sales and marketplaces
Pricing tiers	1 plan	1 plan	3 plans (SAST, DAST, SCA). None transparent
Minimum commit	Monthly	Monthly	Annually
Minimum payment period	Monthly	Monthly	Annually
Minimum capabilities	API security testing, ASPM, binary SAST, containers, CSPM, DAST, IaC, SAST, SCA and secrets	Same plus: PTaaS, RE and SCR	SAST
Minimum scope	1 group	1 author	No information available
Pricing drivers	Groups	Authors	Authors and techniques
Minimum monthly payment	1.529 USD	1.529 + 429 USD	No information available

Service

Attribute	Essential	Advanced	Veracode
PTaaS	No	Yes	MPT and PTaaS
Reverse engineering	No	Yes	Yes
Secure code review	No	Yes	No information available
Pivoting	No	Yes	Yes
Exploitation	No	Yes	Yes
Manual reattacks	Not applicable	Unlimited reattacks	1 reattack
Zero-day vulnerabilities	None	Continuous zero-day vulnerability research	Continuous zero-day vulnerability research
SLA	Availability	Accuracy, availability and response	Availability
Min availability	>=99.95% per minute LTM	Same	>=99% unknown per month
After-sale guarantees	No	Yes	No
Accreditations	CNA and Penetration Testing by CREST	Same	DevOps ISV Competency, Security ISV Competency and Penetration Testing by CREST
Hacker certifications	Not applicable	202 from 59 different types	54 from 25 different types
Type of contract	Employee	Same	Employee
Endpoint control	Not applicable	Total	No information available
Channel control	Not applicable	Total	No information available
Standards	Some requirements from 65 standards, 29 in common and 36 additional	All requirements from the same standards	32 standards, 29 in common and 3 additional
Detection method	Automated tools	Automated tools, AI and human intelligence	Automated tools and human intelligence
False positives	36.03 times better	56.67 times better	1.64% F0.5 score per quantity
False negatives	64.59 times better	185.73 times better	0.41% F2.0 score per severity
Remediation	5, 3 in common and 2 additional	Same, plus 1	3, all in common
Outputs	5, 4 in common and 1 additional	Same, plus 2	5, 4 in common and 1 additional

Product

Attribute	Essential	Advanced	Veracode
ASPM	Yes	Yes	Yes
API	GraphQL with JSON	Same	REST with JSON and XML
IDE	5 functionalities, 3 in common and 2 additional	Same, plus 1 functionality	4 functionalities, 3 in common and 1 additional
CLI	Yes	Yes	Yes
CI/CD	Breaks the build	Same	Breaks the build
Vulnerability sources	4 sources, 1 in common and 3 additional	Same	10 sources, 1 in common and 9 additional
Priority criteria	CVSS v4.0, CVSSF, EPSS and KEV	Same	CVSS v3.0, EPSS and KEV
Custom prioritization	Priority score	Same	Established EPSS limits and vulnerability classification policy
Scanner origin	In-house	In-house	In-house
SCA	24 package managers, 10 in common and 14 additional	Same	18 package managers, 10 in common and 8 additional
AI security	No	Yes	No
Reachability	12 languages	Same	Yes. No information available
Reachability type	Deterministic	Same	No information available
SBOM	22 package managers, 9 in common and 13 additional	Same	18 package managers, 9 in common and 9 additional
Malware detection	Yes	Yes	Yes
Autofix on components	No	No	No
Containers	4 distributions, 2 in common and 2 additional	Same	5 distributions, 2 in common and 3 additional
Source SAST (languages)	12, 10 in common and 2 additional	Same	25, 10 in common and 15 additional
Source SAST (frameworks)	22, 4 in common and 18 additional	Same	15, 4 in common and 11 additional
Custom rules	No	No	Custom rules for SCA
IaC	6, 5 in common and 1 additional	4, 2 in common and 2 additional	7, all in common
Binary SAST	1 type of binary in common	Same, plus 2 types of binaries	6 types of binaries, 1 in common and 5 additional
DAST	7 attack surface types, 5 in common and 2 additional	Same	6 attack surface types (only web based), 5 in common and 1 additional
API security testing	No	4 types of APIs, 1 in common and 3 additional	1 type of API in common
IAST	No	No	No
CSPM	Yes	Yes	No
Environments	Left & Right (included)	Same	Left & Right (at extra cost)
ASM	No	No	No
Secrets	15 secrets types, 5 in common and 11 additional	Same, plus verify other attack vectors and secrets exploitability	5 secrets types, all in common
AI	4 functions, 1 in common and 3 additional	Same	1 function in common
Open-source	MPL-2.0 license, totally equivalent to the paid version	Not applicable	No
Provisioning as Code	Yes	Yes	No
Deployment	SaaS	Same	SaaS
Regions	US	Same	EU and US
Status	Yes	Yes	Yes
Incidents	6 per year	Same	2.25 per year

Integrations

Attribute	Essential	Advanced	Veracode
SCM	4	Same	4, all in common
Binary repositories	None	None	None
Ticketing	3 , all in common	Same	5, 3 in common and 2 additional
ChatOps	None	None	6
IDE	3, 2 in common and 1 additional	Same	6, 2 in common and 4 additional
CI/CD	20, 8 in common and 12 additional	Same	11, 8 in common and 3 additional
SCA	Native	Same	Native
Container	Native	Same	Native
SAST	Native	Same	Native
DAST	Native	Same	Native
IAST	None	None	None
Cloud	3, 1 in common and 2 additional	Same	1 in common
CSPM	Native	Same	None
Secrets	Native	Same	Native
Remediation	None	None	1
Bug bounty	None	None	None
Vulnerability management	None	None	7
Compliance	None	None	None

References were last checked on Aug 29, 2025.

Free trial

Search for vulnerabilities in your apps for free with Fluid Attacks' automated security testing! Start your 21-day free trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.

Comparison between Fluid Attacks and Veracode | Fluid Attacks

Veracode