Checkmarx vs. F5 Distributed Cloud Bot Defense

Chechmarx is really suited for finding wide range of security risks. It although identifies false positives which can be confusing at times. It can do better in terms of scan duration. They are better alternate competitors in the market who can do equally good or even better. It all depends on the scope of the problem you want to address

Incentivized

F5 Distributed Cloud Bot Defense is well suited for large Enterprises that face advanced bot attacks from Web
Scraping, Credential Stuffing, Carding/Credit Card Stuffing, Fake Account
Creation, and more where the collection of the Client-Side signals helps clearly show if the attackers are telling lies vs. other bot solutions that place a lot of the responsibility on their customers to tune bot scores.

• Reporting
• Language support
• Fix recommendations

Incentivized

• Quickly helps mitigate the retooling and newer advanced bot attacks
• Excellent customer service from our f5 bot Defense team/partners
• Easy to do Traffic Analysis/False Positive reviews with their dashboard of data
• Our F5 Security/Solutions Architect and TAM is always there for us whenever we need them
• First class service by the F5 Distributed Cloud Bot DefenseSOC, the Tactics Team, the F5 Testing person that helps us, the mobile SDK experts, the Client-Side Signals experts and F5 management
• Industry best Threat Briefings
• Not only is F5 Distributed Cloud Bot Defense great at stopping the advanced bot attacks, they also have protection against any tampering or replay attacks.

• Lots of false positives
• Hard to integrate with CI

Incentivized

• On a technical side, we've had a lot of deployment issues. This is not a one-sprint solution.
• We ran into undocumented failure modes and had to rely on L2 and L3 customer support, delaying troubleshooting significantly [in our experience].
• Accurate log ingestion is a larger challenge than one would want in a security tool.

Support is quick to respond. They help guide you through any issues you have and ensure everything has been resolved before disconnecting. Wait times can vary, but it depends on the time of day. Eventually, excellent support is reached, and you can learn a few things from them as well.

Incentivized

F5 Distributed Cloud Bot Defense and our partners are great at helping us with in-depth Traffic Analysis of protected endpoints first in Monitoring Mode. After 7-14 days of Traffic Analysis/False Positive reviews, we can clearly tell when we are ready to place protected endpoints into Mitigation Mode.

We actually use Checkmarx along with the other tools. However, the reason we chose Checkmarx is its wide support for languages and useful fix recommendations. The flowcharts help better understand the data flow and give a clear picture of what needs to be fixed and how. Also, developers can make a note of what should be avoided in the future. Overall, it's a great tool and would be a good investment to make.

Incentivized

We have tried a whole bunch of solutions before we got Shape bot defense solution. But non of them worked for us the way F5 Shape solution worked

Incentivized

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• [F5] Shape [Security] established a clear negative trend line in bot traffic to our retail site.
• [F5] Shape [Security's] anti-automation has moved our business out of reach for ROI for attackers.
• So far, [F5] Shape [Security] has not caused any incidents as a technology, and has stifled attacks which would have certainly landed as a Sev 2 without this protection.