Source: nasdaq.com (original report, April 2017)
CA Technologies Acquires Veracode for $614 Million
CA Technologies announced in April 2017 that it had completed the acquisition of Veracode, a Burlington, Massachusetts-based application security software company, for approximately $614 million in cash. The deal was originally signed in early March 2017 and closed following customary regulatory and closing conditions.
What Is Veracode?
Founded in 2006, Veracode provides cloud-based application security testing (AST) solutions that enable development and security teams to identify and remediate vulnerabilities throughout the software development lifecycle (SDLC). At the time of the acquisition, Veracode served more than 1,400 customers — including large enterprises such as Boeing and Thomson Reuters — helping them integrate security testing into their build and deployment pipelines without significantly slowing delivery cycles.
Veracode’s platform supports multiple testing methodologies, including static analysis (SAST), dynamic analysis (DAST), and software composition analysis (SCA), allowing organizations to detect security issues early in development rather than after deployment.
Strategic Rationale: Strengthening CA’s DevOps Portfolio
The acquisition was a deliberate move by CA Technologies to deepen its presence in the DevOps and application security markets. Key strategic benefits cited at the time included:
- Expanded DevOps toolchain: Veracode’s AST capabilities were intended to be integrated into CA’s DevOps and Management Cloud business, giving customers a more complete end-to-end delivery and security platform.
- Faster, more secure software delivery: Embedding security testing into CI/CD pipelines — a practice often called DevSecOps — allows teams to catch vulnerabilities earlier, reducing the cost and risk of remediation at later stages.
- Enterprise-scale reach: CA’s existing enterprise relationships provided a broader go-to-market channel for Veracode’s solutions, particularly for organizations already invested in CA’s IT management and automation tools.
- Inorganic growth strategy: The Veracode deal continued CA’s pattern of growing through targeted acquisitions that complement its core software portfolio, balancing investment for growth with returns to shareholders.
Security Testing in the DevOps Context
Application security testing was already a fast-growing segment of the software tooling market in 2017, driven by rising breach costs, increasing regulatory requirements, and the acceleration of software release cycles. Traditional security testing — typically performed as a gate at the end of development — was increasingly incompatible with agile and DevOps delivery models that demanded frequent, rapid releases.
Veracode’s cloud-based approach addressed this friction by allowing security scans to be triggered automatically within build pipelines, returning results quickly enough to remain actionable within a sprint or release cycle. This aligned directly with CA’s goal of helping enterprises automate and secure their software delivery at scale.
Post-Acquisition Integration
Following the close of the deal, Veracode was integrated into CA’s DevOps and Management Cloud business unit. CA’s stated intent was to embed Veracode’s security testing capabilities across its broader portfolio, enabling customers to address automation and security needs within a single vendor relationship rather than managing a fragmented set of point solutions.
CA also highlighted a unified “go-to-market” strategy that consolidated sales, marketing, brand management, and pricing functions — an approach intended to reduce overhead and improve the customer experience across its combined product lines.
Broader Implications for the DevSecOps Market
The CA–Veracode acquisition was one of several high-profile consolidation moves in the application security space around that period, reflecting growing enterprise demand for security tooling that integrates natively into modern development workflows. For DevOps practitioners, the deal signaled increasing vendor interest in positioning security not as a separate discipline but as an embedded component of the software delivery pipeline — what the industry now broadly refers to as DevSecOps.
Organizations evaluating application security platforms should consider how well a given tool integrates with their existing CI/CD infrastructure, the breadth of analysis types supported (SAST, DAST, SCA), and the speed of scan feedback — all factors that determine whether security testing accelerates or impedes delivery velocity.