Checkmarx provides agentic application security, delivering enterprise-grade protection while lowering engineering costs and accelerating development velocity. The Checkmarx One platform scans trillions of lines of code each year for companies, cutting vulnerability density by more than half. Its autonomous security agents detect and counter AI-driven threats across the SDLC, providing prevention-first protection for legacy, modern, and AI-generated code at enterprise scale.
Do You Manage Peer Insights at Checkmarx?
Access Vendor Portal to update and manage your profile.
What I like most about CheckmarX is its ability to detect vulnerabilities and compliance issues throughout the Software Development Life Cycle (SDLC) and provide feedback into actionable items for remediation. This helps us strengthen our security posture by reducing risk before deploying the code to production.
Our team now has dedicated Appsec engineers to deal with false positive request. User interface is good but slow. Checkmarx users can view the results and navigate to the vulnerable code easily. Attack vectors are there for the input and output flow. With the latest version of Checkmarx SAST, the best fix line of code is also provided.
It allows product development teams to interact with it whatever they want: via Web UI, API or multiple CI platform integrations, usually via plugins. It is very important in a heterogenic environment. Another important fact is consistency with results, not too many false positives, configruabels policies and scan configuration.
The main challenge sometimes is the scan time as CheckmarX scans large repositories and projects.
Support lead from the product team. Issues in pipeline giving errors but errors are hard to understand.
The aformentioned web interface is very '90-tish, I believe it should be refreshed to catch up with other similar tools. It is pretty complex, sometimes not intuitive and noticeably slow, comparing to other popular security tools.