Security Labs is Veracode's developer training product, and its format is the right one. Each lab gives you a live, containerised application with a real vulnerability. You exploit it first, so you understand why it matters, then fix the code and check the exploit no longer works. That loop is much better than reading about XSS and answering five questions. For years the best part, from my point of view, was the free Community Edition, a cut-down version for individuals with a selection of labs from beginner to advanced.
Veracode's own documentation now says it was deprecated on 31 July 2026 and points former users to a 14-day free trial of the full product. So anything you read that recommends it as a free resource is out of date. What is left is a solid enterprise product. Managers can require modules with deadlines and pull progress for SOC 2, HITRUST or PCI evidence, and there are leaderboards and CTF events to keep people engaged. Pricing is not public. The AI gap is the same one I see across this category.
Developers now ship a lot of code they did not write line by line, and the skill that matters is spotting the insecure pattern in a plausible AI suggestion. There is no specific track for that, and nothing on LLM integration risks like prompt injection. Search interest is tiny, around 20 searches a month in the US, and down a third year on year. My take: good labs, wrong audience for most readers now. Companies comparing secure coding tools should trial it. Individuals should use PortSwigger's free labs instead.