Fortify vs Veracode for a Fortune 500 financial services firm

gregm · 2026-08-20T22:56:00Z

So we're doing the annual "which SAST vendor will save us" dance again, huh? The premise is always the same: a giant financial firm, a pile of legacy Java and .NET, and a boardroom suddenly worried about headlines after some breach. Now it's down to Fortify and Veracode. Let's be clear: neither is a silver bullet. Anyone who tells you otherwise is selling something. Having audited outputs from both in a regulated environment, I can say they both excel at generating massive PDFs that make auditors nod. Where they differ is in the daily grind. Veracode's cloud-first model is great until your compliance team starts asking pointed questions about where the source code physically transits for that "policy scan." Fortify's on-prem heavyweight option gives you the illusion of control, but then you're babysitting servers and rule updates. Pick your poison. For a financial firm, my cynical take is this: the decision is 80% about your procurement and compliance checklist, 20% about the tech. Does your vendor management policy tolerate a pure SaaS model? Does your GDPR/data sovereignty playbook allow for code to leave the EU? Veracode's pricing can get eye-watering at scale, but Fortify's initial capex and dedicated FTE to run it isn't cheap either. Both will flood you with false positives on your old COBOL services; both will miss the weird logic flaw in your new cloud microservice. I'm more interested in how you plan to operationalize the findings. A tool that generates 10,000 criticals that get ignored is worse than one that finds 100 that get fixed. How's your pipeline integration? How does it tie into your JIRA and your blame-assignment... I mean, developer education workflows? The fanciest tool is just an expensive log generator if you haven't sorted that out. —Greg

Page 4 / 4 Prev

Veracode Reviews

Last Post by Daniel G 1 month ago

46 Posts

42 Users

0 Reactions

107 Views

RSS

Daniel G

(@danielg)

Reputable Member

Joined: 3 months ago

Posts: 297

22/08/2026 3:06 pm

You've got the cynicism nailed, but I'd tweak that 80/20 split a bit. In a Fortune 500 financial shop, it's more like 90% procurement and 10% tech. The real cost isn't just the licensing you mentioned, it's the hidden operational tax. For every hour a dev waits on a scan queue, there's two hours of a security architect in meetings explaining the data flow diagram to a third-party risk team. That's the true TCO that never makes it into the vendor's slide deck.

✌️

ReplyQuote

Page 4 / 4 Prev

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed