Company Recognized for its Ability to Execute and Completeness of Vision

Veracode, the global leader in application risk management, has once again been positioned as a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing (AST)¹. This marks the company’s 11^th consecutive time as a Leader since the report was first published. The analysis represents one of the industry’s most in-depth and unbiased evaluations of market competitors.

“Over nearly two decades, Veracode has earned a reputation as a trusted partner for thousands of organizations worldwide,” said Derek Maki, Senior Vice President & Head of Product at Veracode. “From pioneering security integration into the software development lifecycle to redefining AI-powered application risk management, we’ve always been at the forefront of innovation. We believe our continued position as a Leader in the Gartner Magic Quadrant reflects our unwavering commitment to customer success and the meaningful impact we deliver to business leaders, developers, and security teams every day. As AI fundamentally transforms how software is built, we’re ensuring security evolves just as rapidly.”

Modern Software Security in a Unified Platform

The 2025 Gartner® Magic Quadrant™ for AST examines key themes shaping the application security landscape, including the need for secure software development across the entire software development lifecycle, managing vulnerabilities in complex supply chains, and the increasing focus on cloud-native applications. Veracode is evaluated for both Ability to Execute and Completeness of Vision.

Veracode is committed to holistic risk management, providing assurance, context, and continuity to customers with global support and dedicated success management. The company’s advanced AI-powered engine analyzes code in hundreds of languages to identify and resolve vulnerabilities at their core. Its unified Application Security Posture Management (ASPM) solution also provides root cause analysis to help prioritize and neutralize threats, minimizing risk and empowering teams to build securely from the start.

Advanced Protection for the Software Supply Chain

With 70 percent of critical security debt originating from third-party code and the software supply chain, enterprises are under enormous pressure to prevent, detect, and respond to cyber threats. Veracode has transformed itself into a comprehensive Application Risk Management (ARM) platform through strategic acquisitions, including Longbow Security in 2024 (now integrated as Veracode Risk Manager [VRM]) to provide application security posture management capabilities. The company further enhanced its software supply chain security capabilities through the acquisition of Phylum in 2025, adding real-time malicious package blocking and automated threat intelligence that stops supply chain attacks at the point of entry—before compromised code ever touches an organization’s environment.

“The reality is that modern applications are AI-assisted, API-connected, and assembled at unprecedented speed,” said Maki. “Our platform is built for this reality—not just yesterday's monolithic applications. With our recent acquisitions of Longbow and Phylum, we're not just scanning code anymore; we're providing real-time risk intelligence across the entire software supply chain. This means our customers can actually prevent malicious packages from entering their codebase, not just discover vulnerabilities after the fact. That's the difference between traditional AppSec and true application risk management.”

Today, Veracode offers a comprehensive suite of application security testing capabilities through its cloud-native ARM platform. These include Static Analysis Security Testing (SAST), Dynamic Analysis Security Testing (DAST), Software Composition Analysis (SCA), Package Firewall, container scanning, Infrastructure as Code (IaC) scanning, penetration testing as a service, application security program management support, remediation consulting, and security training for developers offered in both hands-on experiential and course-based formats.

Pioneering AI-Powered Security Innovation

Launched in 2023 as the first solution of its kind to combine AI and human insight, Veracode Fix generates automated fix suggestions, covering more than 70 percent of detected flaws across 10 supported programming languages. The tool enables developers to burn down accumulated security debt quickly and efficiently.

A Strong Vision for the Future

Continuous, integrated, and automated risk management is the bedrock of modern software security. Veracode has evolved its platform to address this critical requirement for security and development teams.

With a strong vision to lead the future of application risk management, Veracode remains committed to innovating and supporting customers’ expanding needs. The company will continue to invest in technology, resources, and talent to help create a trustworthy, transparent, and resilient digital infrastructure.

To learn more about Veracode’s platform evaluation, download a complimentary copy of the full 2025 Gartner® Magic Quadrant™ for Application Security Testing on Veracode’s website.

To understand more about AI-powered application risk management, please visit: https://www.veracode.com/products

Gartner does not endorse any vendor, product or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally, and MAGIC QUADRANT is a registered trademark of Gartner, Inc. and/or its affiliates and are used herein with permission. All rights reserved.

¹ Gartner, Magic Quadrant for Application Security Testing, By Jason Gross, Mark Horvath, Giles Williams, Shailendra Upadhyay, Dionisio Zumerle, Aaron Lord, 6 October 2025

About Veracode

Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, Malicious Package Detection, and Penetration Testing.

Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.

Copyright © 2025 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.

View source version on businesswire.com: https://www.businesswire.com/news/home/20251010276937/en/

Veracode has once again been positioned as a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing (AST)¹. This marks the company’s 11th consecutive time as a Leader since the report was first published.