Veracode, Inc. is an American cybersecurity company specializing in application protection. Based in Burlington, Massachusetts, it offers a SaaS platform to assess software security and support remediation. Its customers include organizations that develop their own applications and must balance delivery speed, compliance requirements, and IT risk management. Its corporate website is veracode.com.
A journey focused on application security
Founded in 2006 by Chris Wysopal and Christien Rioux, among others, Veracode is part of the history of American research into software vulnerabilities. The company built its business around a core idea: scaling security testing to make it compatible with development processes, rather than limiting it to a one-off audit before deployment to production.
Its ownership has changed several times. CA Technologies acquired it in 2017. Following Broadcom’s acquisition of CA, Veracode joined Thoma Bravo’s investment portfolio. In 2022, TA Associates acquired a majority stake, while Thoma Bravo retained an equity interest. These transactions accompanied its evolution from an application analysis specialist into a provider of solutions covering several dimensions of software risk.
Detecting vulnerabilities and organizing remediation
The platform combines several complementary methods. Static analysis looks for flaws in applications without running them, while dynamic analysis examines their behavior during execution. Software composition analysis identifies risks associated with open-source libraries and dependencies. This combination aims to provide better coverage of software that brings together in-house code and external components.
Veracode offers integrations with development tools and continuous integration and delivery pipelines. The goal is to surface issues in the environments developers already use, then help teams prioritize fixes. Hands-on secure coding training complements the technical tools. The company also publishes the State of Software Security report, based on data from its analyses, which documents vulnerabilities and remediation practices.
In 2024, the acquisition of Longbow Security strengthened its position in application security posture management. This approach involves bringing together information from different tools to place vulnerabilities in context and make them easier to address.
What’s next?
Veracode is developing AI-powered remediation assistance features, notably through Veracode Fix. The challenge goes beyond detection: it is about reducing the work required to turn an alert into an actionable change. The rise of code produced with AI assistants makes this connection between production and oversight particularly important. For the company, the next phase will hinge on the relevance of its recommended priorities, the reliability of its fixes, and integration into teams’ day-to-day practices, without adding excessive complexity to their development pipelines.