Checkmarx vs. FossID Workbench

Overview
ProductRatingMost Used ByProduct SummaryStarting Price
Checkmarx
Score 8.8 out of 10
N/A
Checkmarx, an Israeli headquartered company with US offices, provides a suite of application security software delivered via the Checkmarx Software Security Platform. Individual modules and capabilities include Checkmarx Static Application Security Testing, Checkmarx Software Composition Analysis, Checkmarx Interactive Application Security Testing (CxIAST)N/A
FossID Workbench
Score 0.0 out of 10
Enterprise companies (1,001+ employees)
FossID supports software auditing and compliance. FossID’s Software Composition Analysis (SCA) tool, Workbench, and professional services are designed to ensure comprehensive open source compliance and security in software development. Software Composition Analysis (SCA) FossID Workbench enables precise identification of open source components and vulnerabilities. It integrates into software development cycles, providing license recognition, proactive…N/A
Pricing
CheckmarxFossID Workbench
Editions & Modules
No answers on this topic
No answers on this topic
Offerings
Pricing Offerings
CheckmarxFossID Workbench
Free Trial
NoNo
Free/Freemium Version
NoNo
Premium Consulting/Integration Services
NoYes
Entry-level Setup FeeNo setup feeNo setup fee
Additional DetailsFossID pricing considers several factors such as number of contributors, type of deployment, add-ons, and success accelerator services.
More Pricing Information
Community Pulse
CheckmarxFossID Workbench
Best Alternatives
CheckmarxFossID Workbench
Small Businesses
GitLab
GitLab
Score 8.6 out of 10

No answers on this topic

Medium-sized Companies
Veracode
Veracode
Score 9.2 out of 10
Veracode
Veracode
Score 9.2 out of 10
Enterprises
Veracode
Veracode
Score 9.2 out of 10
Veracode
Veracode
Score 9.2 out of 10
All AlternativesView all alternativesView all alternatives
User Ratings
CheckmarxFossID Workbench
Likelihood to Recommend
8.5
(5 ratings)
-
(0 ratings)
Usability
7.5
(2 ratings)
-
(0 ratings)
User Testimonials
CheckmarxFossID Workbench
Likelihood to Recommend
Checkmarx
If you are going with SAST process or want to improve overall security posture then go for it like integrating it with post deployment steps. If you are more concerned about proactive controls better choose other options such as pee-commit hooks and CI security. Also choose other tools for DAST and API scans.
Read full review
FossID
No answers on this topic
Pros
Checkmarx
  • Detects security vulnerabilities in source code with accuracy and detail.
  • Integrates seamlessly with CI/CD pipelines, IDEs, and repositories.
  • Provides clear reports and actionable fix recommendations for developers.
Read full review
FossID
No answers on this topic
Cons
Checkmarx
  • Scan duration
  • False positives
  • Integration with other tools like Jenkins comes with some inconveniences.
Read full review
FossID
No answers on this topic
Usability
Checkmarx
Their API based customizations which I leveraged to create an ASPM package, which is developer friendly and can extend above the dashboard features, other ones are UI which is great and feels clutter free. Menu and navigation is also good so as support. Only drawback is sometimes scan takes longer which I feel so can be reduced
Read full review
FossID
No answers on this topic
Alternatives Considered
Checkmarx
Checkmarx is easier to integrate with development tools and gives quick feedback during coding, which is helpful for developers. Veracode is more focused on scanning and reporting for compliance, but it’s more complex to set up. We chose Checkmarx because it fits better into our development process, offering faster scans and more useful suggestions for fixing problems
Read full review
FossID
No answers on this topic
Return on Investment
Checkmarx
  • Improved ability to provide high level of IA confidence
  • Improved confidence in application-level security
Read full review
FossID
No answers on this topic
ScreenShots

FossID Workbench Screenshots

Screenshot of a scan of repositories that detects all Free and Open Source Software (FOSS) from complete components, packages, and libraries to small snippets of open source.Screenshot of a Software Bill of Materials (SBOMs). FossID Workbench can automatically export and import Software Package Data Exchange (SPDX) reports containing license text, copyright statements, vulnerabilities and even snippet level information.Screenshot of a presentation of license-related risks in software that helps to remain compliant. Workbench detects over 2000 different licenses encountered overed years of open source auditing from strong/weak copyleft to the most obscure source-available and non-commercial licenses. Workbench helps users to understand all license related risks that could affect your products and services.Screenshot of Workbench’s comprehensive policy management that can prevent usage of strong/weak copyleft or source-available software licenses in products and services.Screenshot of VulnSnippet Finder: Snippet detection for vulnerable open source snippets. FossID’s Knowledge Base snippet detection capabilities include special detection of vulnerable open source snippets. While most security scanners assume open source vulnerabilities based on component and version, VulnSnippet Finder bases its search on the exact lines of code/snippets that make software vulnerable.