Veracode and the art of fixing what you find

A software bug can have a very comfortable life. Somebody discovers it. A scanner records it. A dashboard gives it a color. Then, while the organization ships its next release, the bug stays exactly where it was. In Veracode’s 2026 research, 82 percent of organizations carried security debt: vulnerabilities left unresolved for more than a year. The warning had arrived. The repair had not.

This is the problem that makes Veracode interesting. A company associated with finding flaws now sells a broader system for managing what happens afterward. Its software serves security leaders who need a defensible account of risk and developers who need something considerably more practical: a clear next task.

The hacker who became a supplier

Chris Wysopal came from the L0pht, the hacker think tank whose researchers made insecure software a public argument. He later worked at security consultancy @stake. In 2006, he and Christien Rioux co-founded Veracode. Their background helps explain an enduring technical choice: examining the compiled software artifact through binary analysis.

Consider the distinction. A source scanner examines the instructions programmers write; a binary scanner examines a compiled form. Veracode’s longstanding approach gave the business a recognizable position in application security. It also created practical questions about packaging and supported technologies that buyers still need to test against their own builds.

The business became valuable enough to change hands repeatedly. CA Technologies bought Veracode in 2017. After Broadcom acquired CA, Thoma Bravo announced a $950 million purchase of Veracode in 2018. A 2022 TA Associates investment valued it at $2.5 billion, with Thoma Bravo retaining a minority position. Those numbers describe ownership transactions, not customer spending or annual revenue.

A scanner learns to choose

The product vocabulary can feel like an airport departure board. SAST checks application code. DAST probes running web applications and APIs. SCA examines open-source dependencies and their risks. Container and infrastructure-as-code scanning extend the inspection to the machinery surrounding the application. Each sees a different part of the problem.

But collecting findings creates a second problem: deciding which deserve attention first. In April 2024, Veracode bought Longbow Security, adding cloud and application context that became part of Risk Manager. The acquisition announcement described alerts missing business-risk detail and code-level insight. The strategic logic was straightforward: the queue needed better ordering.

In January 2025, Veracode acquired certain Phylum assets, including technology for detecting and blocking malicious software packages. That expanded prevention at the point where developers import outside code. Package Firewall can stop policy-violating packages before adoption; SCA examines dependency risk. Preventing an unwanted delivery and inspecting an existing inventory are different jobs.

Veracode Fix tackles another handoff by proposing code changes for supported flaws. Security Labs and eLearning address the developer’s understanding. The Marketplace adds partner capabilities, including DryRun Security’s contextual analysis. Together, these products show a company trying to make detection, judgment, and repair work in the same program.

The customer has a queue, too

Public customer stories include insurer HDI Global SE, Azalea Health, and software business Vendavo. The pattern is recognizable: organizations with real software estates, development schedules, and customers asking awkward security questions. Veracode sells cloud subscriptions, supported by services, training, integrations, and manual testing. Product scope and contract terms shape the bill.

At Brazil’s SEF/MG, the published customer account describes scans embedded in GitLab and Azure DevOps, alongside education for 300 developers. That pairing matters. Earlier feedback gives developers a chance to act while the work is familiar. Education helps them understand the finding instead of merely clearing an alert.

“The speed of software development has skyrocketed”

Chris Wysopal · February 2026

Vendavo’s account supplies a less glamorous detail: build integrations occasionally break and someone must fix them. The customer described a few hours of monthly maintenance across the business, while more time went into evaluating and resolving findings. Buying the scanner did not remove the work. It changed where people spent their attention.

The backlog keeps its own score

Veracode’s 2026 State of Software Security analysis covered 1.6 million unique applications. Its reported share of organizations with year-old security debt rose from 74 percent in 2025 to 82 percent in 2026. This describes its research population, not a census of every business. Even with that qualification, the direction is uncomfortable.

The economics deserve equal care. A Veracode-commissioned 2024 Forrester Consulting study modeled 184 percent return over three years and payback under six months for a composite organization. Those are modeled outcomes, not a universal price or a promise. A buyer needs its own estimates for subscription fees, integration effort, triage, and developer repair time.

Count the repairs

Alternatives include Snyk, Checkmarx, GitHub’s security tools, Black Duck, and OpenText. Veracode’s proposition combines testing with program oversight, remediation, and education. The sensible comparison is a pilot using your languages, your build artifacts, and your actual backlog. Measure coverage, useful findings, and elapsed time to a verified fix.

The fit is clearest when a security team must oversee many applications while development teams keep their own tools. Central policy and reporting can help that arrangement. A smaller team evaluating a narrow need should still compare the effort of a broad platform with the tools already in its repository workflow. More capabilities create value when somebody uses them to make a decision or complete a repair.

There is a practical method worth copying: assign owners, put feedback inside development workflows, prioritize exposed applications, review proposed patches, and rescan. It depends on supported technology and people empowered to repair what they own. Automated testing also needs human scrutiny for business-logic weaknesses. A dashboard can tell you the bug is still there. Someone still has to make it leave.