Checkmarx vs. Digital.ai Agility vs. Snyk

If you are going with SAST process or want to improve overall security posture then go for it like integrating it with post deployment steps. If you are more concerned about proactive controls better choose other options such as pee-commit hooks and CI security. Also choose other tools for DAST and API scans.

Incentivized

Scenarios where it works well: 1) Retros can be very well facilitated & notes/action items
can be captured against the sprint. 2) Product Owner can effectively track the story
progress with all the test-cases, design etc. 3) Being good scaling support, it provides good visibility
across multiple teams, programs and agile portfolios, providing a centralized
environment where all our stakeholders can easily work together regardless of location. 4) It provides easy tracking all of your epics,
stories, themes, defects, tasks, tests and issues 5) I like its intuitive UI as for moving stories
around, burning hours. 6) It allows top leadership to visualize
and report their strategic plans, giving all stakeholders the relevant data
that they need to stay dedicated to the project priorities. 7) It can be easily integrated with slack
so for few teams we used slack for collaboration Scenarios where it did not work well: 1) Test Management need improvement in
terms of tracking tests, team had hard time tracking regression test cases. 2) Version one comes with lot of features like
Rally but here we don’t get customizations which is there in Jira where from workflow
to issue everything can be customized based on your team/program/portfolio
requirements. 3) Lot of navigation to access basic
stuff. Example I want to go to bug attachment , there are lt of clicks &
navigation need to do which should be pretty straightforward I feel.

Incentivized

Scenarios Where Snyk Is Well-Suited CI/CD Pipeline Integration (Node.js, Python, etc.) Container Security Open Source License Compliance Infrastructure as Code (IaC) SecurityScenarios Where Snyk May Be Less Appropriate Scanning Proprietary or Custom Code for Unknown Vulnerabilities Complex Monorepos with Custom Build Tools Organizations Requiring Custom Security Rules Advanced Security Teams Needing Correlation and Deep Triage.

Incentivized

• Detects security vulnerabilities in source code with accuracy and detail.
• Integrates seamlessly with CI/CD pipelines, IDEs, and repositories.
• Provides clear reports and actionable fix recommendations for developers.

Incentivized

• Automated saving of changes, no records can be lost because all items are saved in real-time.
• The watch function, optional but beneficial when managing multiple teams or projects.

Incentivized

• Helps in dependency management
• SAST - Static Application Security Testing
• Infra Code Scan ( Terraform , Cloud Formation , Docker image scan)
• OSSG

Incentivized

• Scan duration
• False positives
• Integration with other tools like Jenkins comes with some inconveniences.

Incentivized

• Although Digital.ai Agility supports customizations, they can be somewhat cumbersome to set up and maintain
• The Analytics engine's user experience for digging into the data does not have the same feel as the rest of the system and, as a result, can be hard to work with

Incentivized

• The tool itself has many capabilities but using them operationally within the platform on a day to day basis for managing vulnerabilities is not a good experience.
• Our company was in desparate need of a tool to help us manage vulnerabilities so we could achieve a SOC 2 assurance report without findings.

Incentivized

Their API based customizations which I leveraged to create an ASPM package, which is developer friendly and can extend above the dashboard features, other ones are UI which is great and feels clutter free. Menu and navigation is also good so as support. Only drawback is sometimes scan takes longer which I feel so can be reduced

Incentivized

Developer-Centric Design - Snyk integrates directly into IDEs (like VS Code and IntelliJ), CI/CD pipelines, GitHub/GitLab, and container registries. Clear, Actionable Vulnerability report issues are categorized by severity.


Reports include fix recommendations, pull request suggestions, and links to remediation advice.

Incentivized

VersionOne provides outstanding training. They have Product Owner training that I recommend every Product Owner attend. They have scrum master training and other agile training that was well worth the money paid because it made the teams more productive. And the support for the tool is incredible. These people live and breathe Agile and are evangelists and enthusiasts.

Incentivized

Checkmarx is easier to integrate with development tools and gives quick feedback during coding, which is helpful for developers. Veracode is more focused on scanning and reporting for compliance, but it’s more complex to set up. We chose Checkmarx because it fits better into our development process, offering faster scans and more useful suggestions for fixing problems

Incentivized

JIRA appears to be more extensible with the ability for Scrum, Kanban, bug/incident tracking, and the ability to customize dashboards. However, VersionOne's performance over the same teams is extremely fast in comparison and therefore allows users to be more productive over the same amount of time.

Incentivized

Unfortunately, neither cover all of the use cases that we would like so we need to use both but they are both excellent tools as part of our vulnerability management. We find that Snyk helps us better with improving our MTTR of identified vulnerabilities when compared to inspector but that may be more based on how we have implemented both tools

Incentivized

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• It has made it easier to implement Agile processes. Since our team is fairly new to Agile, this has been extremely helpful.
• Our organization is quickly growing, and V1 has made it easier for new hires to look at everything that our team has in the works.

Incentivized

• Increased developer experience
• Better productivity due to shift left as Vulnerabilities are caught earlier in the SDLC process
• Improved Vulnerability Management
• Common dashboard for various stages in CI/CD

Incentivized