Skip to content
Veracy Advisory Platform
← All tools

Checkmarx

Application security platform with AI-powered SAST, DAST, SCA, and supply chain security testing.

Listed Needs re-verification
Security IT Ops $$$ Mid-market Enterprise Technology Financial Services Healthcare Government

What it does

Checkmarx is an enterprise application security testing platform covering static analysis (SAST), software composition analysis (SCA), dynamic testing (DAST), API security, and supply chain security in a unified platform. AI capabilities include AI-powered triage that distinguishes genuine vulnerabilities from false positives automatically, AI-generated remediation guidance that explains how to fix each finding and provides corrected code examples, AI code risk prediction that identifies high-risk code areas before they are committed, and supply chain AI that detects malicious packages and dependency risks. Checkmarx integrates into the developer workflow - IDEs, pull request gates, and CI/CD pipelines - making security feedback available at the point of development.

Strengths

  • Mid-market engineering organizations use Checkmarx for comprehensive application security testing - SAST and SCA in the CI/CD pipeline catching vulnerabilities before code reaches production.
  • Large enterprises and regulated industries use Checkmarx for enterprise application security governance - comprehensive coverage across all security testing types with AI reducing the false positive burden on development teams.
  • Checkmarx is an enterprise application security testing platform covering static analysis (SAST), software composition analysis (SCA), dynamic testing (DAST), API security, and supply chain security in a unified platform.

Watch-outs

  • False positive rates require tuning: Like all SAST tools, Checkmarx generates false positives that require configuration and tuning — without active management, false positives erode developer trust and reduce the effectiveness of the security program.
  • Expensive for full platform access: Checkmarx's full platform covering SAST, SCA, DAST, and supply chain is priced for large enterprise security programs — smaller teams often get better ROI from focused tools like Snyk for SCA.
  • Developer experience requires investment: Getting developer adoption of security testing requires more than just deploying the tool — organizations need developer education, streamlined workflows, and responsive false positive management.

Pricing

Checkmarx pricing is not publicly disclosed. Contracts based on lines of code scanned and engines. Mid-market contracts typically start at $30,000 to $75,000 annually. Enterprise contracts negotiated.