Name: Checkmarx
Rating: 8.8 (22 reviews)
Author: Checkmarx

Help Desk

Web and Video Conferencing

Customer Support

Mobile App Development

Push Notifications

Development

Online Proctoring Software

Education

Audit

Business Intelligence (BI)

Collaboration

Data Analytics  and BI Services

Embedded Business Intelligence (BI)

Partner Relationship Management

Visual Collaboration

Enterprise

Accounting

Spend Management

Finance and Accounting

Applicant Tracking

Contractor Management

Corporate Learning Management

HR Management

Job Board

Payroll

Talent Intelligence

Talent Management

Workforce Analytics

Workforce Management

Human Resources

Application Server

Browser

Bug Bounty

Cloud Storage

Data Center Power

Data Quality

Desktop Management

Disk Based Backup

Extended Detection and Response (XDR)

Fraud Detection

Hadoop-Related

IT Operations Analytics

Identity Management

Infrastructure-as-Code (IaC)

Integration Platform as a Service (iPaaS)

Internet of Things (IoT)

MLOps

Network Performance Monitoring

Process Mining

Requirements Management

Smart Contracts

Tower Servers

Information Technology

A/B Testing

Ad Serving & Retargeting

All-in-One Marketing

Appointment Scheduling

Competitive Intelligence

Content Management

Email Marketing

Marketing Automation

Social Media Management

Survey & Forms Building

Text to Speech

Web Analytics

Marketing

AI Meeting Assistants

Project Management

Task Management

Professional Services

Cross-Border eCommerce

Customer Relationship Management (CRM)

Lead Generation Services

Multichannel Retail

Sales

Certificate Lifecycle Management

Security

Estate Planning

Hotel Management

Insurance Underwriting and Rating

Mental Health

Multiple Listing Service (MLS)

Plagiarism Checker

Smart Cities

Telemedicine

Vertical-Specific

Find top rated software and services based on in-depth reviews from verified users. 400+ software categories including PaaS, NoSQL, BI, HR, and more.

SonarQube Server

SonarSource Sarl

Veracode

Snyk

Cloudflare Zero Trust Services

Cloudflare

Palo Alto Networks Prisma Cloud

Palo Alto Networks

Fortify by OpenText

OpenText

F5 Distributed Cloud Bot Defense

GitGuardian

Trend Vision One Email and Collaboration Security

Trend Micro

Carbon Black App Control

Broadcom

Acunetix by Invicti

Invicti Security

Rencore Code (SPCAF)

Rencore

VMware AppDefense (discontinued)

Discontinued Products

Avatao

Users have provided the following recommendations for Checkmarx:

- Provide a free edition: Many users would like to see Checkmarx offer a free edition of their software. This would allow potential customers to try out the product before making a purchase, helping them evaluate its capabilities and determine if it meets their specific needs.

- Lower the price: Some users feel that Checkmarx is comparatively expensive compared to other similar tools on the market. They recommend reducing the price of the software or offering more flexible pricing options, particularly for small businesses or individual developers who may have budget constraints.

- Improve customer support: Several users have mentioned difficulties in reaching customer support when encountering issues or needing assistance with the software. They suggest enhancing the support system by providing faster response times, more knowledgeable support staff, and additional channels for communication such as live chat or phone support.

To address these recommendations, Checkmarx could consider offering a free edition for trial purposes, adjusting their pricing model to be more competitive, and prioritizing improvements in customer support for a better user experience.

Valuable Code Scanning and Accurate Results: Many users have found Checkmarx to be a valuable tool for scanning code and providing accurate results. It allows for in-depth analysis by providing the flow of code from source to execution.

User-Friendly Interface and Intuitive Nature: The easy-to-understand interface and user-friendly nature of Checkmarx have been appreciated by reviewers. They find it very intuitive, making reducing code and scanning for vulnerabilities simple.

Effective Security Threat Identification: Checkmarx has received praise for its ability to scan any application and identify security threats effectively. Users appreciate its reliability in identifying all security vulnerabilities, making their code more secure.

High Number of False Positives: Some users have expressed frustration with Checkmarx reporting a high number of false positives, making it difficult to analyze and control the actual security issues. These users suggest reducing the number of false positives and improving the rules set to minimize this issue.

Complex User Interface: The user interface of Checkmarx is considered complex and not user-friendly by some users. They suggest updating the UI to make it more intuitive and easier to navigate, improving the overall user experience.

Lack of Free Version: Users have mentioned their disappointment in not finding a free version of Checkmarx in the market. Instead, they had to contact sales representatives for an initial comparison, although they found the sales representatives responsive.

Checkmarx, an Israeli headquartered company with US offices, provides a suite of application security software delivered via the Checkmarx Software Security Platform. Individual modules and capabilities include Checkmarx Static Application Security Testing, Checkmarx Software Composition Analysis, Checkmarx Interactive Application Security Testing (CxIAST)

SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.

Community

Developer EDITION

Enterprise EDITION

Data Center EDITION

Detectify is an automated External Attack Surface Management solution from the company of the same name in Stockholm, powered by an ethical hacker community. By leveraging hacker insights, security teams using Detectify can map out their attack surface to find anomalies and detect the latest business critical vulnerabilities,  especially in third-party software.

Deep Scan

Asset Monitoring

Detectify

Checkmarx

Application Security Tools scan web applications for vulnerabilities, provide automated testing, locate and eliminate malware, and perform other tasks and services related to ensuring web applications perform correctly and reliably, without misconfigurations and vulnerabilities.

Application Security

Checkmarx One™ Application Security Platform Demo Video

How to Integrate Checkmarx with AWS CodePipeline

I源碼安全檢測工具I Checkmarx – Demo of CxSAST Static Code Analysis Solution

Sponsor Demo - Checkmarx Application Security Testing (CxAST) Platform Demo

I源碼安全檢測工具I Checkmarx – AppSec Coach Demo Video

Sponsor Demo - Checkmarx - Supply Chain Assurance in DevOps

Checkmarx One™ SCS (Supply Chain Security) Demonstration

Information Technology & Services

Telecommunications

Circles

DevSecOps Engineer II

Likelihood to Recommend

Usability

Checkmarx 2025-07-02 05:12:53

Bugcrowd

Tenable Nessus

Tenable Web App Scanning

Checkmarx 2024-12-22 20:44:13

Checkmarx 2023-02-01 01:26:27

Qualys Web Application Scanning (WAS) app

Rapid7 InsightAppSec

Checkmarx 2021-05-03 12:34:13

Checkmarx 2016-08-26 17:06:28

TrustRadius is a technology and business research firm based in Austin, Texas. The company is known as a review platform for verified B2B technology and software reviews through a proprietary algorithm and human verification.

TrustRadius

False positives

Additional plugins

Hard to integrate

Report designer

Custom reports

Creating custom reports

False positive

Data flow

Number of languages

Large variety

Language support

Set up

Home

Application Security Tools

Checkmarx was uses as a reactive security sast control in my org, to detect code security scans, secret detection and license scanning. We also used it to assess our overall sast structure by dashboards and metrics such as MTTR etc. There were lot of grey areas where devs needed assistance with the vulnerable piece of code and checkmarx used to provide great insights on that.

Code security scans where issues needs to be tagged as Critical or High and needs to be merged into PR
Secrets that are hardcoded in the code or comments of the PR
License scanning where devs will be having an idea if they are using right set of open source packages

DAST capability can be the one where it does not support native use case of using OTP based arch
API Scanning is something that lacks a bit due to not much customizations
Branch wise reports for SAST is not available

One product usually for all the SAST need helped us evaluate our security posture

We use Checkmarx to scan our code for security vulnerabilities during development. It helps us find and fix issues early, reducing the risk of security breaches. Our developers and security team mainly use the tool to ensure our applications are safe before release. It addresses the challenge of maintaining secure code in a fast-paced development cycle.

Detects security vulnerabilities in source code with accuracy and detail.
Integrates seamlessly with CI/CD pipelines, IDEs, and repositories.
Provides clear reports and actionable fix recommendations for developers.

Scans can be slow for large codebases, which may disrupt development workflows.
The interface can overwhelm new users, making navigation and setup challenging.
Reports occasionally flag non-issues, requiring extra time for manual validation.

Checkmarx helps us identify security issues early, reducing the risk of costly breaches.
It saves time by automating security scans, allowing developers to focus on other tasks.
It improves code quality, leading to a more secure product and greater customer trust.

Bugcrowd, Tenable Web App Scanning, Tenable Nessus

Checkmarx is used in our organization to scan code base or applications and perform security analysis. The SAST tool of the Checkmarx is used for scanning the code and finding the security defects. It addresses the security concerns and eliminates manual security review. The scope includes 75% of the organization's code base.

Recommendations to fix the security findings
Reports
Finds wide range of security risks

Time taken for scan
False positives
Integrations with other systems

SAST scanning tool
Reporting
Recommendations to fix security defects

Reduced manual effort to analyse and fix the code
Can easily summarize findings through reports

It is used by the information security team in our company. We run various static code analysis tools on our source code and Checkmarx is one of them. What it helps us with is to generate reports that we can share with our Developers as it is comprehensive and easy to understand.

Reporting
Language support
Fix recommendations

Scan duration
False positives
Integration with other tools like Jenkins comes with some inconveniences.

Static application security testing.
Variety of bugs it identifies.
Best fix location recommendations.

Great diversity of vulnerabilities covered.
Quicker scans
They are feature rich compared to other tools I used in the past.
Dashboards are not customizable enough.
High number of false positives take up time and sometimes make our report look bad.

Veracode, Rapid7 InsightAppSec, Qualys Web Application Scanning (WAS)

As part of R&amp;D projects for military contracts, we used Checkmarx to help our engineering team improve information assurance and reduce potential security risks in our software. We specifically used it to scan applications written in PHP. Through the many months of use, we found it often had a very large amount of false-positives but the things it did catch was helpful. We refactored several components, libraries and classes and upgraded some of dependencies to reduce the number of results Checkmarx returned. It never found a truly significant security risk, but we were a team of security experts so I'm rather glad about that. Downsides I did see was that it was completely impossible to get set up locally or through a continuous integration system. This was partially because the way Checkmarx was designed, and partially because the security requirements we held in configuring our development and staging environments made it so. We had to interact with Checkmarx by exporting a zip of our codebase and uploading it, and it was a rather large codebase, so it took awhile to scan. Overall, it was a helpful took, but cumbersome to use.

Supports a large number of languages
Finds a large variety of potential risks

Lots of false positives
Hard to integrate with CI

Improved ability to provide high level of IA confidence
Improved confidence in application-level security

Checkmarx

Overview

What is Checkmarx?