# Burp Suite vs Veracode

**Leader by vioscaleAI score:** Veracode

| Attribute | Burp Suite | Veracode |
|---|---|---|
| **vioscaleAI score** | 41.2 (43% (low)) | 73 (52% (medium)) |
| content.faq | `[{"answer":"A dynamic analysis security testing tool that automatically scans APIs and applications to identify security vulnerabilities. It supports automated testing, API discovery through OpenAPI definitions, and integrates with CI/CD workflows for continuous security scanning. It is indexed under DevSecOps Tools.","source":"https://portswigger.net/burp","question":"What is Burp Suite?","confidence":0.6},{"answer":"Burp Suite does not publish its prices. Pricing is quoted on request, so the figure depends on your seat count and requirements. We record this as a pricing-transparency signal rather than guessing a number. Pricing changes often, so verify at source before relying on it.","source":"https://portswigger.net/burp","question":"How much does Burp Suite cost?","confidence":0.6},{"answer":"We have independently confirmed HIPAA and GDPR for Burp Suite. Certifications we do not list are ones we have not been able to verify from public sources, which is not the same as Burp Suite not holding them. Always confirm compliance directly before you rely on it.","source":"https://portswigger.net/compliance","question":"What security certifications does Burp Suite have?","confidence":0.7}]` | - |
| deployment.options | - | `{"cloud":true}` |
| description.long | A dynamic analysis security testing tool that automatically scans APIs and applications to identify security vulnerabilities. It supports automated testing, API discovery through OpenAPI definitions, and integrates with CI/CD workflows for continuous security scanning. | A comprehensive platform for identifying, prioritizing, and fixing application security vulnerabilities across code, dependencies, containers, and infrastructure. It combines static and dynamic testing with AI-driven remediation to reduce security risk while maintaining developer velocity. |
| features.capabilities | `{"dast":true,"ci_native":true}` | `{"sca":true,"dast":true,"sast":true,"hosting":"cloud","ci_native":true,"ide_plugin":true,"auto_fix_pr":true,"iac_scanning":true,"reachability":true,"container_scanning":true,"license_compliance":true}` |
| integrations.count | - | 25 |
| integrations.list | - | `[{"name":"GitHub","native":true,"category":"repository","direction":"inbound"},{"name":"GitLab","native":true,"category":"repository","direction":"inbound"},{"name":"AWS","native":true,"category":"cloud","direction":"inbound"},{"name":"Google Cloud","native":true,"category":"cloud","direction":"inbound"},{"name":"Microsoft Defender for Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Snyk","native":true,"category":"security","direction":"inbound"},{"name":"Checkmarx","native":true,"category":"security","direction":"inbound"},{"name":"Contrast Security","native":true,"category":"security","direction":"inbound"},{"name":"Fortify OnDemand","native":true,"category":"security","direction":"inbound"},{"name":"Rapid7 InsightAppSec","native":true,"category":"security","direction":"inbound"},{"name":"Qualys","native":true,"category":"vulnerability","direction":"inbound"},{"name":"JFrog Xray","native":true,"category":"security","direction":"inbound"},{"name":"AWS Config","native":true,"category":"compliance","direction":"inbound"},{"name":"AWS Inspector","native":true,"category":"security","direction":"inbound"},{"name":"Prisma Cloud","native":true,"category":"security","direction":"inbound"},{"name":"Wiz","native":true,"category":"security","direction":"inbound"},{"name":"CrowdStrike","native":true,"category":"security","direction":"inbound"},{"name":"Orca","native":true,"category":"security","direction":"inbound"},{"name":"SecurityScorecard","native":true,"category":"security","direction":"inbound"},{"name":"Terraform Cloud","native":true,"category":"iac","direction":"inbound"}]` |
| platform.support | - | `{"cli":true,"web":true}` |
| pricing | `{"type":"quote","summary":"Free trial available on request","sourceUrl":"https://portswigger.net/burp","retrievedAt":"2026-09-04T11:12:55.040Z"}` | - |
| pricing.model | quote | commercial |
| pricing.price_level | unknown | - |
| reliability.status_page | yes | yes |
| security.fedramp | yes | yes |
| security.gdpr | yes | yes |
| security.hipaa | yes | yes |
| security.iso27001 | - | yes |
| security.pci | yes | yes |
| security.soc2 | - | yes |
| security.trust_center | - | https://www.veracode.com/security/ |

## Capabilities (DevSecOps Tools)

| Capability | Burp Suite | Veracode |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | - | ✓ |
| DAST (dynamic analysis) | ✓ | ✓ |
| SCA / dependency scanning | - | ✓ |
| Secret scanning | - | - |
| Container / image scanning | - | ✓ |
| IaC misconfiguration scanning | - | ✓ |
| **Governance** |  |  |
| OSS licence compliance | - | ✓ |
| SBOM generation (SPDX/CycloneDX) | - | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | - | ✓ |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | - | ✓ |
| **Deployment** |  |  |
| Hosting | - | Cloud only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | - | ✓ |
| **Licensing** |  |  |
| OSS engine available | - | - |

*Source: vioscaleAI. Generated 2026-10-16T21:42:15.224Z. "-" = undocumented, not absent.*