# Veracode SCA: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 10 judge labels across 1 category by 7 of 14 models. Page: https://www.gane.ai/index/it/vendors/veracode-sca

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 27 | 30% | 10 |

## What the models said for it

- "Enterprise Security & Compliance Suites: *Checkmarx, Veracode, Mend.io (formerly WhiteSource), Sonatype Nexus*" (Gemini 3.5 Flash, SCA)
- "Choose Veracode if you want SCA inside a broader appsec program." (GPT-5.4 mini, SCA)

## And against it

- "Use with Caution (If You Don’t Already Use Veracode) ... Veracode is likely overkill and more expensive than specialized tools." (Qwen 3.7 Flash, SCA)
- "setup effort, pricing models, and potential overkill for non-enterprise users are common complaints" (Grok 4.20, SCA)
- "pricing is quote-only, less transparent, and tends to be on the higher end" (DeepSeek V4 Flash, SCA)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-5.4 mini | 0 | 1 | 0 | 0 | 1 |
| Gemini 3.5 Flash | 0 | 1 | 1 | 0 | 2 |
| Perplexity Sonar | 0 | 0 | 0 | 0 | 0 |
| Grok 4.20 | 0 | 0 | 2 | 1 | 3 |
| Mistral Small | 0 | 0 | 1 | 0 | 1 |
| DeepSeek V4 Flash | 0 | 0 | 0 | 1 | 1 |
| Llama 4 Maverick | 0 | 0 | 0 | 0 | 0 |
| Qwen 3.7 Flash | 0 | 0 | 0 | 1 | 1 |
| Kimi K2 | 0 | 0 | 1 | 0 | 1 |
| GLM 4.7 FlashX | 0 | 0 | 0 | 0 | 0 |
| MiniMax M2.5 | 0 | 0 | 0 | 0 | 0 |
| GPT-6 Luna | 0 | 0 | 0 | 0 | 0 |
| Muse Glimmer 30B | 0 | 0 | 0 | 0 | 0 |

## Sources returned with these answers

The sites and pages cited by the answers that named Veracode SCA, from 33 of the 36 answers that named it (only the models that return a source list).

### Domains cited

- sonatype.com: 14
- checkmarx.com: 13
- g2.com: 11
- linuxfoundation.org: 11
- mend.io: 11
- res.cloudinary.com: 11
- safeguard.sh: 9
- securityboulevard.com: 9
- raven.io: 8
- blog.jetbrains.com: 7

### Pages cited

- https://sonatype.com/compare/best-sca-tools: 13
- https://linuxfoundation.org/hubfs/Reports/An-Open-Guide-To-Evaluating-Software-Composition-Analysis-Tools_V2.pdf: 11
- https://res.cloudinary.com/snyk/image/upload/v1731508416/website-pdfs/The-Forrester-Wave-Software-Composition-Analysis-Software-Q4-2024.pdf: 11
- https://mend.io/blog/best-software-composition-analysis-sca-tools-top-solutions: 10
- https://raven.io/blog/best-software-composition-analysis-tools: 8
- https://blog.jetbrains.com/qodana/2025/09/best-software-composition-analysis-tools: 7
- https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026: 6
- https://upwind.io/glossary/10-best-software-composition-analysis-tools-for-sca: 6

## In its own words

What Veracode SCA's own pages state, read 2026-10-05. Stated by the vendor, not checked by the index.

- Positioning: Use Fix for SCA to generate code fixes and, optionally, apply them to vulnerabilities found in software composition analysis (SCA) scans using Veracode Fix for SCA. (https://docs.veracode.com/r/veracode_fix_sca)
- For: To manage and run SCA scans on your desktop (https://docs.veracode.com/r/Set_up_SCA_agents)
- Hosting: Commercial region, European region, United States Federal region

## What it publishes

Every page veracode.com exposes, read 2026-09-29: 1969 addresses. By kind, pages and the last 90 days:

- blog: 464 pages, 16 in the last 90 days, latest 2026-09-23
- case study: 29 pages, 1 in the last 90 days, latest 2026-09-08
- webinar or virtual event: 28 pages, 1 in the last 90 days, latest 2026-08-11
- conference or event: 55 pages, 1 in the last 90 days, latest 2026-08-04
- report or ebook: 66 pages, 6 in the last 90 days, latest 2026-09-08
- comparison: 10 pages, 1 in the last 90 days, latest 2026-08-18
- template or tool: 1 pages, 0 in the last 90 days, latest undated
- glossary or explainer: 11 pages, 0 in the last 90 days, latest 2025-12-29
- podcast or video: 2 pages, 0 in the last 90 days, latest 2024-11-04
- news or press: 2 pages, 0 in the last 90 days, latest 2024-10-25
- Recent: 2026-09-23 blog: Application risk intelligence september 23 https://www.veracode.com/blog/application-risk-intelligence-september-23
- Recent: 2026-09-22 blog: Application security software for business growth https://www.veracode.com/blog/application-security-software-for-business-growth
- Recent: 2026-09-17 blog: Application risk intelligence september 17 https://www.veracode.com/blog/application-risk-intelligence-september-17
- Recent: 2026-09-17 blog: Mature software supply chain security program https://www.veracode.com/blog/mature-software-supply-chain-security-program
- Recent: 2026-09-14 blog: Eu cyber resilience act 2026 compliance https://www.veracode.com/blog/eu-cyber-resilience-act-2026-compliance
- Recent: 2026-09-10 blog: Devsecops application security platform https://www.veracode.com/blog/devsecops-application-security-platform

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.