Veracode Pricing 2026: Ultimate Guide for Security Products

Veracode pricing is quote-only in 2026: Veracode publishes no price list, and every product page on its site leads to a demo request. What you can see in public is how Veracode counts licenses and one product priced on AWS Marketplace. This guide uses both to show what you pay for with Static Analysis, Dynamic Analysis, and Software Composition Analysis.

Disclaimer: the figures below come from Veracode’s website and documentation, the AWS Marketplace listings of Veracode and its competitors, and a 2022 pricing document from a UK government procurement listing, all read in October 2026. Veracode sells by quote, so treat every figure here as a reference point for that conversation.

How Much Does Veracode Cost?

Veracode publishes no price for Static Analysis (SAST), Dynamic Analysis (DAST), Software Composition Analysis (SCA), or the platform around them. The pricing address on its website redirects to the platform page. Three public sources still give you reference points:

• Veracode’s own AWS Marketplace listing prices one product publicly, Veracode Security Labs, at $750 for a 12-month contract.
• The scanning products described on that listing carry no public price, and AWS states that pricing follows the duration and terms of your contract with Veracode.
• A FedRAMP listing for Veracode, sold by Carahsoft, is marked “Private Offer Only” and prices support and service packages only.

Each source is a reference point for your own quote. Together with the license model below, they show the unit Veracode counts, which is what you need before the first pricing call.

Veracode finds vulnerabilities in source code, open-source dependencies, and running web applications throughout the development lifecycle. Its product list covers testing, remediation, and supply chain controls, and no product on it is described as monitoring live applications for attacks or responding to them.

Once an application is live, someone still has to investigate the alerts an attack on it raises, at 2 a.m. as much as at noon. The UnderDefense Agentic AI SOC works on top of the SIEM, EDR, cloud, and identity tools you already run: AI agents investigate every alert, and analysts on shift 24/7 decide what happens next.

Veracode Pricing Comparison Table

Choosing the right Veracode plan depends on how many applications you license, which scan types you combine, and the term you sign. Here is how the main products compare in 2026, with the license unit each one uses.

Veracode sets the final price per quote, based on the number of applications, the products you combine, and the term. The license units in the table come from the public pricing document described below.

Veracode Pricing Model: Per-Application Licenses

A pricing document attached to a reseller’s listing on the UK government’s G-Cloud 14 Digital Marketplace, dated May 2022, describes the Veracode pricing model in more detail than any other public source. The primary license is a per-application subscription with a minimum term of 12 months, and it includes unlimited scans, unlimited platform users, unlimited developers per application, and all integrations.

Static Analysis comes in three license types: Standard, Small for applications up to 5 MB of analysis size, and Component for microservice components of an application already covered by a Standard or Small license. Dynamic Analysis is licensed per URL, and SCA per application or project, or per contributing developer. The document adds discounts for volume and subscription length, plus discretionary discounts that depend on product mix and timing. Ask your Veracode rep which license type each of your applications falls under, because the analysis size of each application changes the bill.

Veracode Products Overview

Veracode’s platform covers application security testing across the development lifecycle. Whether you need static application security testing (SAST), dynamic application security testing (DAST), or software composition analysis (SCA), each one is sold as its own product, with remediation, supply chain, and posture management products around them.

Choosing the Right Plan for Your Portfolio

Which plan fits depends less on company size than on how many applications you license and how often they ship:

• A focused program covering a few business-critical applications can start with one scan type and add more later.
• A large portfolio with many teams and microservices needs the platform’s policy, reporting, and integrations, and its license count drives the price.

Count your applications and their microservice components first, because that count shapes every quote.

Main Product Plans:

Three testing products make up most Veracode contracts:

• Veracode Software Composition Analysis (SCA) finds security and license risks in third-party and open-source libraries.
• Veracode Static Analysis (SAST) detects vulnerabilities at the code level before deployment.
• Veracode Dynamic Analysis (DAST) tests web applications and APIs while they run, to find runtime vulnerabilities.

The sections below cover what each one costs, what it does, and where it falls short.

Veracode Static Analysis (SAST) Pricing and Features

Veracode Static Analysis scans your application’s source code, binaries, and libraries to find vulnerabilities before deployment. Veracode does not publish its price. It is licensed per application, in the Standard, Small, and Component types described above, at the list prices shown in the table.

Key Features of Veracode Static Analysis

Veracode describes these Static Analysis features on its product page:

• Direct source code scanning without compilation, for build-free feedback.
• Source, binary, and hybrid scanning, including third-party code when the source is not available.
• Full program analysis for applications of up to 5 GB of code.
• Coverage of 100+ languages and frameworks, according to Veracode.
• Scans in the IDE, in CI/CD pipelines through Pipeline Scan, and a full policy scan before release.
• AI-generated fix suggestions through Veracode Fix.

Veracode reports a false-positive rate below 1.1% for Static Analysis, a vendor figure worth testing on your own code before you sign.

Pros of Veracode Static Analysis:

The main strengths come from scan depth and fit with developer workflows:

• Advanced scanning shows potential threats at the code level.
• It integrates with development workflows to catch issues early in the SDLC.
• Developers get remediation advice they can act on.

The quality of those results depends on the setup work covered in the cons below.

Cons of Veracode Static Analysis:

Two trade-offs come up most often:

• Per-application licensing adds up quickly in a large portfolio of microservices.
• Configuration and setup on large codebases can take specialist expertise.

The technical limitations later in this guide show where that expertise goes, so read them before you count licenses.

Veracode Dynamic Analysis (DAST) Pricing and Features

Veracode Dynamic Analysis tests web applications and APIs at runtime, simulating attacks to find vulnerabilities that are exploitable in a live environment. Veracode DAST pricing is not published either. In the 2022 G-Cloud document, Dynamic Analysis was licensed per URL, or as an add-on to a static license priced at 15% of the static price.

Veracode offers a 14-day DAST Essentials free trial, with no credit card required, so you can test the scanner on one application before you price URLs.

Key Features of Veracode Dynamic Analysis

Veracode lists these Dynamic Analysis features on its product page:

• Scans of web applications and APIs, including entire API workflows.
• Automated or scheduled scans with configurable depth, speed, and accuracy.
• Scanning of applications behind your firewall through Internal Scanning Management.
• CI/CD integration, which Veracode says you can set up within 10 minutes.
• External Attack Surface Management to find applications and APIs you did not know about.

Veracode reports a false-positive rate below 5% for Dynamic Analysis, which is worth checking against the findings from your trial.

Pros of Veracode Dynamic Analysis (DAST):

Dynamic Analysis covers what static analysis cannot see, because it tests the running application:

• It tests applications as they run and finds vulnerabilities that static analysis can miss.
• It prioritizes vulnerabilities by risk.
• It works for both on-premises and cloud-hosted applications.

Its value grows when you run it alongside Static Analysis on the same applications.

Cons of Veracode Dynamic Analysis (DAST):

Two setup requirements add work for internal and multi-domain applications:

• Internal applications need Internal Scanning Management, with a gateway and a JAR file you run in your environment.
• Veracode does not scan subdomains automatically, so each one has to be added to the scan’s allowlist.

Plan both into the onboarding of every internal application, since each one adds setup time your team pays for.

Veracode Software Composition Analysis (SCA) Pricing and Features

Veracode’s Software Composition Analysis finds and manages open-source vulnerabilities by scanning third-party components and libraries for known vulnerabilities and license compliance. Veracode SCA pricing follows the same quote-only rule. The 2022 G-Cloud document licensed SCA per application or project, per contributing developer, or as an add-on priced at 25% of the static license.

If you already license Static Analysis, ask for SCA as that add-on before you compare standalone prices. A single compromised package can reach thousands of builds, as the npm supply chain attack showed, so price SCA alongside Static Analysis from the start.

Key Features of Veracode SCA

Veracode lists these SCA features on its product page:

• A proprietary vulnerability database that includes issues not yet listed in the National Vulnerability Database.
• Vulnerability Method Analysis, which shows where your code calls the vulnerable part of a library.
• Detection and blocking of malicious packages.
• Auto-pull requests that apply the suggested fix.
• SBOM generation in CycloneDX and SPDX formats.
• License risk checks and custom policy gates.

The SBOM output also helps when a customer or regulator asks what your software contains.

Pros of Veracode Software Composition Analysis (SCA):

The main strengths are coverage and automation:

• It reduces the risk introduced by third-party code.
• It automates open-source security checks in the CI/CD pipeline.
• Dashboards and alerts track the health of each component.

SCA pays off most in codebases built largely on open source.

Cons of Veracode Software Composition Analysis (SCA):

Two limitations depend on the size and makeup of your codebase:

• Applications with few open-source components gain less from it.
• Cost grows with the number of projects or contributing developers you license.

Check which of the two license units fits your team before you ask for a quote.

Veracode Platform Pricing and Alternatives

Beyond the three testing modules, Veracode sells an Application Risk Management Platform. Its product list adds Risk Manager for application security posture management, Veracode Fix for AI-generated fixes, Package Firewall, Software Supply Chain Intelligence, container and IaC scanning, penetration testing as a service, Security Labs, and eLearning. None of these has a public price except Security Labs on AWS Marketplace.

If you are pricing the platform, compare it with the application security vendors buyers most often set against Veracode. The four below are compared using only the prices each publishes on its own site or its own marketplace listing.

Veracode vs Checkmarx Pricing

Checkmarx sells Checkmarx One in three packages, Essentials, Professional, and Enterprise, plus “Start with SAST” and “Start with Supply Chain” options, all by custom quote on its pricing page. Checkmarx’s own AWS Marketplace listing is more specific: Start with SAST costs $1,035 per license per year, and Essential costs $1,564 per license per year.

The same listing sets a minimum deal size of $30,000 for a one-year term. It prices the Premium Service Package at 20% of the SaaS subscription fee or $10,000, whichever is higher. On its own site, Checkmarx says it offers a personalized demo and no self-serve free trial.

Veracode vs Snyk Pricing

Snyk publishes the most. Its Free plan costs $0 and includes SCA, SAST, IaC, and container scanning with test limits, and the Team plan starts at $25 per month for teams of up to 10 developers.

Enterprise customers buy credits, where 1 credit costs $1. On Snyk’s rate card, Snyk Code and Snyk Open Source each use 1.0 credit per active contributor per day, and API and web scanning uses 3.0 credits per provisioned target per day.

Veracode vs Fortify (OpenText) Pricing

Fortify moved from Micro Focus to OpenText when OpenText closed its acquisition of Micro Focus on January 31, 2023. OpenText now sells Fortify SAST with several deployment options, including the SaaS platform Fortify on Demand.

Its AWS Marketplace listing, OpenText Core Application Security (Fortify), prices work in assessment units: $996 per unit a year for 4 to 99 units, and $864 per unit for 100 or more, with managed support. Bundles on the same listing include single assessments of 15 static applications for $14,190 a year, and assessment subscriptions for the same 15 for $54,360.

Veracode vs Offensive360 Pricing

Offensive360 publishes no price. Its pricing page offers a custom annual license for SAST and DAST, with the scanning scope agreed in your proposal and no per-developer seat fee. An on-premises edition comes as an OVA virtual appliance, with an air-gapped deployment option.

Veracode Alternatives Compared

The table puts each vendor’s published starting point side by side, as read in October 2026.

The units differ, so convert each one into the same terms before you compare: the cost per application per year for the portfolio you actually run.

Hidden Costs of Veracode

The license is only part of a Veracode budget. These costs appear in Veracode’s documentation and public listings, and each one belongs in your business case:

• The 2022 G-Cloud document prices Standard, Premier, and Premier Plus support at 10%, 20%, and 27% of the SaaS list price.
• The Carahsoft FedRAMP listing prices Technical Service Packages at $34,603.53 for Silver, $74,974.31 for Gold, and $144,181.36 for Platinum a year.
• The same listing sells a Technical Account Manager at $48,060.45 a year and a weekly Mitigation Proposal Review setup at $57,672.54.
• Each microservice component of a licensed application can need its own Component license.
• Your developers spend time triaging findings, documenting mitigations, and keeping fixes moving.

The last item is usually the largest. Verizon’s 2026 Data Breach Investigations Report found that only 26% of critical CISA KEV vulnerabilities were fully remediated in 2025, with a median of 43 days, so a finding can stay open in production long after the scan that found it.

Veracode Technical Limitations That Add Cost

Veracode’s documentation sets limits that turn into engineering hours when your build does not fit them:

• Upload and Scan analyzes compiled binaries, so some languages must be compiled and packaged to Veracode’s rules first.
• Findings show the source file and line number only when you include debug information.
• Veracode cannot analyze code compiled with optimizations or obfuscated code, and ASP.NET pages must be precompiled.
• Each scan accepts files of up to 2 GB, up to 5 GB in total, and up to 50,000 files.
• Pipeline Scan is not connected to the Veracode Platform, so it does not support flaw mitigations or flaw matching.
• One user can start six Pipeline Scans per minute, and each scan stops at 60 minutes.

Each of these limits means work for your developers or build engineers, and none of that work appears on the quote. Ask Veracode which ones apply to your languages and pipelines before you sign.

How to Negotiate Veracode Pricing: A 7-Point Framework

Veracode prices by quote, so your room to negotiate lies in how you scope the deal. Work through these seven points before the first pricing call:

1. Count your applications the way Veracode licenses them, including microservice components, and your URLs for Dynamic Analysis.
2. Ask which Static Analysis license type, Standard, Small, or Component, each application needs.
3. Price SCA and Dynamic Analysis both as static add-ons and as standalone licenses.
4. Request one-year and three-year quotes side by side, since list prices drop on longer terms.
5. Run the 14-day DAST Essentials trial on a real application before you commit to a URL count.
6. Bring the published prices from the Checkmarx, Snyk, and Fortify listings above to the call.
7. Get the support tier, its percentage of list price, and any service packages in writing.

Points 1 and 7 move the number most. The application count sets the base, and support and service packages are where a quote grows after the license price is agreed.

How Can UnderDefense Help Improve Veracode Productivity?

Veracode tells you which flaws exist before release, and some of them will still be open when the application goes live. Verizon’s 2026 DBIR found that exploitation of vulnerabilities was the most common initial access vector, at 31%, so the alert that matters most to a Veracode customer is the one raised when someone tries to use an open flaw at 2 a.m.

The UnderDefense Agentic AI SOC works on top of the SIEM, EDR, cloud, and identity tools you already run, without replacing Veracode or any of them. AI agents investigate every alert those tools raise, and analysts on shift around the clock make the response decisions, so your AppSec team keeps fixing code while someone watches the running application.

When a critical alert fires overnight, an UnderDefense analyst responds within the 20-minute SLA response time for critical alerts, and your team wakes up to the investigation along with the escalation. One G2 reviewer describes what that looks like day to day:

“The UnderDefense analyst assigned to our account knows our environments and reaches out when something actually requires our attention.”

Daniel D., Founder, company of 50 or fewer employees, G2, August 20, 2026

UnderDefense is rated 4.9 out of 5 from 57 reviews on G2, as of October 2026. Plan for detection tuning when you start: reviewers report that fitting detections to a new environment takes from a few weeks to a few months.

Bring one Veracode finding that is still open in production. Book a triage demo

Frequently Asked Questions