Veracode

Veracode
Name	Veracode
Type	Private
Industry	Software security
Founded	2006
Headquarters	Burlington, Massachusetts, United States
Products	Application security testing, Static analysis, Dynamic analysis, Software composition analysis
Parent	Thoma Bravo (2020–present)

Veracode Veracode is an application security company providing cloud-based software testing and vulnerability assessment solutions for enterprises. Founded in 2006 in Burlington, Massachusetts during a period of rapid growth in cloud computing and software as a service, the company has positioned itself at the intersection of application security and enterprise risk management. Its platform integrates with development toolchains used by organizations such as General Electric, Capital One, Salesforce, Citigroup, and UnitedHealth Group.

History

Veracode was founded in 2006 amid contemporaneous developments at Microsoft and Google emphasizing secure coding, and it sought to deliver a cloud-first alternative to traditional on-premises tools used by organizations like IBM and Oracle Corporation. Early funding rounds involved investors associated with Bessemer Venture Partners and Massachusetts venture capital networks, while strategic hires came from firms such as Symantec and McAfee. In 2017 the company was acquired by Thoma Bravo portfolio activity and later underwent additional ownership restructuring when CA Technologies and Broadcom Inc. were active in mergers and acquisitions across the software security landscape. Throughout the 2010s Veracode expanded via partnerships with Atlassian, GitHub, Jenkins (software), and integrations with Amazon Web Services and Microsoft Azure.

Products and Services

Veracode offers static application security testing (SAST), dynamic application security testing (DAST), software composition analysis (SCA), and interactive application security testing (IAST), aligning with capabilities provided historically by vendors such as Checkmarx, Fortify (software), SonarSource, and WhiteSource. Its cloud platform supports integrations with continuous integration/continuous delivery pipelines using tools like Docker, Kubernetes, Jenkins (software), Travis CI, and CircleCI. The suite includes professional services and training comparable to offerings from SANS Institute and ISC2, alongside consulting engagements resembling work by Deloitte, Accenture, and PwC. Veracode’s remediation guidance, policy management, and application risk scoring are used in governance contexts alongside frameworks such as NIST Cybersecurity Framework and ISO/IEC 27001.

Technology and Methodology

The company’s technology combines binary static analysis, dynamic testing, and software composition analysis to detect issues like those cataloged in Common Vulnerabilities and Exposures, OWASP Top Ten, and CWE. Its methodology emphasizes integration into developer workflows through plug-ins for Eclipse (software), Visual Studio, and IntelliJ IDEA, mirroring trends promoted by DevOps advocates such as Jez Humble and Gene Kim. Veracode’s approach parallels academic research from institutions like MIT, Carnegie Mellon University, and Stanford University on automated code analysis, and its processes reflect standards advanced by CERT Coordination Center and National Institute of Standards and Technology. The platform leverages cloud infrastructure patterns used by Amazon Web Services, Microsoft Azure, and Google Cloud Platform to scale scanning for enterprises operating in environments similar to Netflix and Spotify.

Corporate Structure and Ownership

Veracode has operated as a privately held company with multiple rounds of venture and private equity ownership, including investment and control by Thoma Bravo. Its corporate governance includes executive leadership and board members with backgrounds at Symantec, McAfee, IBM, and Microsoft. The company’s headquarters in Burlington, Massachusetts situates it near other technology firms and academic centers such as Harvard University and Massachusetts Institute of Technology. Strategic transactions in the cybersecurity sector involving firms like FireEye, Palo Alto Networks, CrowdStrike, and McAfee have shaped market consolidation trends that influenced Veracode’s positioning.

Security Research and Vulnerability Findings

Veracode’s research teams have published analyses on common application flaws, contributing to discourse alongside groups at Google Project Zero, Microsoft Security Response Center, CERT Coordination Center, and academic cybersecurity labs at University of California, Berkeley and Georgia Institute of Technology. Findings often reference classes of defects in CWE and patterns echoed in OWASP Top Ten reports; researchers have presented at conferences such as Black Hat Briefings, DEF CON, RSA Conference, and BSides. The company’s published insights into software composition risks and open source vulnerabilities align with reports produced by GitHub Security Lab and NIST National Vulnerability Database.

Industry Adoption and Customers

Large enterprises across sectors including financial services, healthcare, technology, and retail deploy Veracode’s platform; named customers historically include Capital One, Salesforce, Citigroup, General Electric, and UnitedHealth Group. Adoption trends mirror those of other vendors like Checkmarx, Synopsys, and Contrast Security, and are driven by regulatory requirements and procurement policies seen in organizations such as Bank of America, JPMorgan Chase, and HSBC. Veracode’s tooling is commonly integrated into development toolchains alongside GitHub, Atlassian, Jenkins (software), and cloud providers like Amazon Web Services and Microsoft Azure.

Legal and Compliance Issues

Use of Veracode’s services intersects with regulatory regimes and standards including Sarbanes–Oxley Act, Health Insurance Portability and Accountability Act, Payment Card Industry Data Security Standard, GDPR, and frameworks issued by NIST. Compliance obligations have influenced procurement and contractual arrangements with global enterprises and have involved legal considerations similar to disputes and compliance reviews seen in cases involving Equifax, Target Corporation, and Sony Corporation. Security incidents and vulnerability disclosures in the application security industry have prompted coordination with disclosure policies championed by CERT Coordination Center and Open Web Application Security Project.

Category:Computer security companies Category:Software companies of the United States