Hey everyone, been lurking for a bit and finally decided to post. I'm helping my team evaluate our application security tooling, and we've been using Veracode for the past two years. The recent renewal quote really took us by surprise—it was significantly higher than before, even though our app footprint hasn't grown dramatically.
We ended up moving to Fortify on Demand after running a proof of concept. The main driver was definitely cost savings, but I'm curious if others have had a similar experience. The feature sets seemed broadly comparable for our needs (static and dynamic scanning), but the pricing models felt very different.
What was the tipping point for anyone else who made a switch? Was it purely cost, or did you run into specific workflow or integration issues? Also, for those who stayed with Veracode, did you manage to negotiate the pricing down? I'm wondering if we could have done more there before jumping ship.
The transition itself was smoother than expected, though there's always a learning curve with any new platform. So far, Fortify seems to be doing the job, but it's only been a few months. I'd love to hear any long-term comparisons, especially around things like scan accuracy, support responsiveness, and how they handle newer languages or frameworks.