Veracode

Veracode

Company type	Private
Industry	Application security, Software as a service (SaaS)
Founded	2006
Founder	Chris Wysopal, Christien Rioux
Headquarters	Burlington, Massachusetts , United States
Area served	Worldwide
Key people	Brian Roche (CEO)
Products	Application security testing platform including static analysis, dynamic analysis, software composition analysis
Parent	TA Associates

Veracode is a company specializing in application security, based in Burlington, Massachusetts. Established in 2006 by Chris Wysopal (Co-Founder, CTO, and CISO) alongside Christien Rioux (Co-Founder), Veracode delivers SaaS solutions that embed application security testing directly into the software development lifecycle.

The Veracode platform integrates various security testing methods, such as static analysis, dynamic analysis, and software composition analysis. Serving a global clientele exceeding 2,500 organizations, the company had analyzed over 25 trillion lines of code by early 2021.

History

Veracode originated from former engineers at @stake, a Cambridge-based security consultancy recognized for its ethical hacking expertise. Much of the company’s software was crafted by Rioux. In 2007, Veracode introduced SecurityReview, an automated vulnerability scanning service designed as an alternative to conventional penetration testing.

In November 2011, Robert T. Brennan, previously CEO of Iron Mountain Incorporated, was named CEO of Veracode. By 2014, the firm had secured three of the top four Fortune 100 banks as clients. Although preparations were made for an initial public offering in 2015, the IPO did not materialize. In September 2014, Veracode raised $40 million in a late-stage funding round led by Wellington Management.

The company’s yearly cybersecurity reports have underscored persistent challenges within application security, highlighting government agencies’ slow remediation of vulnerabilities and widespread shortcomings in web application security standards.

In March 2017, CA Technologies acquired Veracode for approximately $614 million. After Broadcom purchased CA Technologies in November 2018, it became Veracode’s parent company. On that same day, private equity firm Thoma Bravo acquired Veracode from Broadcom for $950 million and appointed Sam King as CEO.

Veracode’s 2020 report disclosed that half of identified application security issues remained unaddressed six months after discovery. That year alone, the platform scanned over 11 trillion lines of code and detected roughly 16 million vulnerabilities.

In March 2022, private equity firm TA Associates acquired Veracode at a valuation of $2.5 billion. Following the acquisition of Longbow Security in April 2024, Brian Roche replaced Sam King as CEO. In January 2025, Veracode broadened its detection capabilities by acquiring Phylum Inc., enhancing its proficiency in identifying malicious components within open-source libraries.

Technical integrations

Veracode’s Static Application Security Testing (SAST) tool is compatible with most leading workflow platforms, increasing its attractiveness to large-scale enterprise customers.

Channel model

Veracode utilizes a hybrid channel approach that combines direct sales to multinational enterprises with partnerships involving local resellers across North America, Latin America, EMEA, and Asia-Pacific regions. Its "Find a Partner" feature assists clients in locating authorized resellers and supports continuous expansion through frequent additions to its reseller network.

See also

• Compilation of static code analysis tools