Veracode pricing feedback - hidden costs for large enterprise scans

You're right to be cautious about the scan volume definitions. From our experience, the biggest cost surprise wasn't the one-off massive scan, but the aggregated "incremental" scans. If your pipeline triggers a new scan on every merge to a main branch, and you have a high-velocity monorepo, those micro-scans add up to a huge volume charge quickly, even if each individual scan is small. The sales model often assumes a more traditional, less frequent scan schedule.

On the seats and API limits, yes, those can force an upgrade. The API rate limits for pulling reports or automating findings into our ticketing system became a bottleneck. We needed more concurrent API users than we had licensed seats for the actual GUI, which required a separate, non-obvious "automation" add-on. The compliance report fees were line-item clear for us, but the API costs were not.

Great list, you've definitely pinpointed some of the big ones. On your point about >what actually counts towards your scan volume, I'd double-check how they define an "application." We got tripped up because each microservice was counted separately, even though they were part of the same logical product. That multiplied our baseline volume before we even factored in pipeline frequency.

The compliance report costs are real, especially if you need them formatted for a specific auditor. We budgeted for the standard PCI DSS output, but needed a custom mapping for a regional framework, and that was a separate professional services engagement.

Have you asked about their policy scans? Those can quietly add up if you're managing policies for many different teams or regulatory environments.

The microservice per-application trap is what blew our forecast. The sales demo used a neat, single "app," but our actual multi-repo setup meant everything counted separately. Our baseline volume was 5x the initial estimate before a single pipeline scan ran.

Ask them to define a "policy" and how much it costs to manage. You'll likely need separate ones for prod vs dev, which they'll happily charge for.

And don't get me started on API limits for automation. That "automation add-on" felt like a tax for actually using the product.

Oh wow, this is super helpful. I'm just starting to look into this for our team too, and I hadn't even thought about the "automation add-on" being separate. That feels like a really important detail.

A follow-up question for you, since you mentioned scan volume: does that volume count include things like re-scans after you fix a vulnerability? I'm worried we'd get charged twice just for verifying a fix.

Oh, you absolutely get charged for re-scans. That's the real genius of the model. Your security team fixes a critical flaw, you want to prove it's closed, and that verification becomes a line item. It creates a perverse incentive to batch fixes to avoid scan penalties, which directly conflicts with rapid remediation goals.

Regarding the automation tax, it's not just an add-on - it's a fundamental lock-in. The base API limits are so restrictive that any meaningful integration into a CI/CD pipeline or ticketing system forces the upgrade. You're not paying for extra features, you're paying to use the product as advertised. Ask them point-blank for the exact API call limits per hour on the standard tier, then calculate how long it would take to process findings from a single large scan. The math is laughable.