Checkmarx vs. Quixxi Security

Chechmarx is really suited for finding wide range of security risks. It although identifies false positives which can be confusing at times. It can do better in terms of scan duration. They are better alternate competitors in the market who can do equally good or even better. It all depends on the scope of the problem you want to address

Incentivized

If you are developing mobile apps, you should be doing regular vulnerability scans. Quixxi Scan does this quickly and easily from your working app code. Furthermore, if your company requires compliance with any of the major software development or industry-standard data security standards like SOC -2, the Quixxi scan reports are ideal and can be used "as is."

• Reporting
• Language support
• Fix recommendations

Incentivized

• Simple to understand but comprehensive PDF report. Ideal for compliance reporting.
• Provides recommendations to resolve vulnerabilities.
• Uses industry standard OWASP framework for vulnerability identification.

• Lots of false positives
• Hard to integrate with CI

Incentivized

• Would like to see dynamics scanning added.
• Would like to see code snippets for examples.

Very good. I only had one problem when implementing it and the Support team was online via chat and helped me straight away.

We actually use Checkmarx along with the other tools. However, the reason we chose Checkmarx is its wide support for languages and useful fix recommendations. The flowcharts help better understand the data flow and give a clear picture of what needs to be fixed and how. Also, developers can make a note of what should be avoided in the future. Overall, it's a great tool and would be a good investment to make.

Incentivized

It was the best value for money and it was easy to use. It was recommended in the top 10 vulnerability scanners.

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• It's cheap and comprehensive.
• It's quick and easy to use.
• It can be integrated into X-Code or Android Studio to run as a part of Git code checking or app deployment in the testing stage.