Checkmarx vs. Micro Focus Fortify on Demand

Chechmarx is really suited for finding wide range of security risks. It although identifies false positives which can be confusing at times. It can do better in terms of scan duration. They are better alternate competitors in the market who can do equally good or even better. It all depends on the scope of the problem you want to address

Incentivized

Integrated as part of our CI / CD chain. Scans are done in an automated fashion and defects are reported out and tracked. Easy to use, easy to integrate. Very pleased with the product. It does not perform cross module analysis scanning for vulnerabilities that may cross applications as well as it could, but it's pretty close.

Incentivized

• Reporting
• Language support
• Fix recommendations

Incentivized

• SAST
• DAST
• Manage Software Security Risk
• Automation
• Compliance
• Integration

Incentivized

• Lots of false positives
• Hard to integrate with CI

Incentivized

• Cross module compliance

Incentivized

Always receive excellent support from the vendor. No issues there.

Incentivized

We actually use Checkmarx along with the other tools. However, the reason we chose Checkmarx is its wide support for languages and useful fix recommendations. The flowcharts help better understand the data flow and give a clear picture of what needs to be fixed and how. Also, developers can make a note of what should be avoided in the future. Overall, it's a great tool and would be a good investment to make.

Incentivized

CAST in my opinion provides a far superior product in that it can parse in an entire suite of applications and do scans across modules. HP Fortify probably has deeper and more current scanning so I think both products complement each other. I would not rely solely on Fortify and would try to have that as part of the mix of products. Overall it's a good product. We use Fortify because the Enterprise has made that a mandatory part of our security suite.

Incentivized

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• Good as part of our security suite to help prevent successful attacks.
• Reporting of defects helps to educate developers.
• Worth the price we paid.

Incentivized