Checkmarx

Name: Checkmarx
Brand: Checkmarx

Checkmarx is an application security testing and application security posture management platform that scans first-party code (SAST), open-source dependencies (SCA), infrastructure-as-code, APIs, and secrets while providing developer training and enterprise governance via the cloud-based Checkmarx One platform.

Est 2006|Valuation $2.8B|Raised $10M|69 Ref Customers

LinkedIn 129K|Web traffic 92K|FTEs 900|HQ Paramus, New Jersey, US

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)Code Security SAST

Published Oct 22, 2026

01Common complaints

- Organizations that are cost-constrained or small (<50 developers): marketplace minimum deal sizes and modular add-ons may make the platform economically mismatched for small organizations. - Organizations that require ultra-fast CI scans: reviewer reports of slower scans versus some alternatives make performance validation essential for high-velocity pipelines. - Organizations that cannot tolerate higher false-positive rates: language- or rule-specific false positive reports suggest an investment in tuning is likely required. - Organizations seeking a GitHub-native operational model without multi-repo/platform governance needs: GitHub Advanced Security may be simpler if all repositories are GitHub and centralized governance features are not required. - Organizations committed to exclusively open-source tooling: while Checkmarx supports and maintains open-source projects (for example, KICS), the core platform is commercial.

Deal disqualifiers (poor fit)

Small teams that need low-cost, self-serve tooling.
Teams intolerant of triage noise or slow scans without sufficient AppSec staffing to tune rules and maintain baselines.
Buyers that require transparent public pricing and simple monthly billing.

Known limitations suggested by customers

False positives reported in multiple reviews, sometimes language-specific.
Dashboard and reporting UX could be improved according to reviewer feedback.
Scan time and performance concerns reported by some reviewers.

Vendor-acknowledged limitations

Vendor public pages do not present an explicit limitations list; however, pricing pages emphasize packages and add-ons rather than explicit feature gaps. Buyers should request documented product limitations, supported languages matrix, and documented performance benchmarks.

Roadmap / upcoming capabilities

Vendor materials describe the Tromzo acquisition as related to autonomous/agentic security capabilities. Buyers should verify what features are generally available (GA) versus roadmap items and whether additional licensing or professional services costs apply.

02Why they buy

Unique selling points supported by evidence

Broad platform breadth: packaging and reviews indicate coverage across SAST, SCA, API, IaC, ASPM, and training add-ons.
IaC security via KICS: KICS is an Apache 2.0 open-source project with an active community and CI/CD integration guidance.

Unique selling points that should be verified

Vendor claims of large-scale scanning metrics and specific percentage reductions in vulnerabilities or cost per fix should be validated for methodology and representativeness before relying on them as procurement evidence.

Areas where competitors may have an advantage

Out-of-the-box noise reduction and remediation automation: some competitors emphasize precision and automated remediation in their positioning; these claims should be validated in a neutral POC.
Developer-first simplicity and self-serve adoption: some competitors win for smaller teams and faster adoption curves.

03Field reports

Review platform snapshots

G2: Checkmarx is well rated on G2, with common pros/cons including UI, implementation ease, and recurring reference to false positives and missing features.
Capterra: Checkmarx One has mid-range ratings in small sample sizes; sample sizes should be treated as directional.

Positive review summaries (examples)

Reviewers often note:

Ease of integration into existing repositories and CI/CD pipelines and generally usable vulnerability descriptions and remediation guidance.
Scanning tools across IaC, SAST, SCA, and API are reported positively by some reviewers, and some reviewers report satisfactory customer support experiences.

Negative review summaries / recurring complaints (examples)

Recurring themes in reviews include:

Reports of false positives in certain languages and frameworks were reported by some reviewers.
Support responsiveness that varies by region or contract tier.
Scanning performance concerns in some reviewer reports.
Cost and modular licensing complexity noted by multiple reviewers.

Why customers choose Checkmarx (as suggested by reviews)

Broad coverage across SAST, SCA, IaC, API testing, and the ability to integrate into CI/CD pipelines are commonly cited.
Developer-facing guidance (vulnerability descriptions and remediation hints) is a frequently noted value.

Why some customers may churn / consider alternatives

Based on review complaints and competitor messaging:

False positives (noise) can push teams toward platforms that emphasize precision or reachability/prioritization.
Licensing and cost concerns (modular pricing, enterprise minimums).
Performance or scan speed complaints.

These are recurring themes that should be validated in a proof of concept (POC) rather than assumed universal.

Vendor-published outcomes (treated as vendor-reported until validated)

Vendor materials report outcomes such as: - Reductions in vulnerability counts per project and reductions in average cost per fix for certain case studies. - Example customer stories include rapid onboarding and decreases in vulnerability density for specific customers. Critical evaluation: - These metrics are vendor-published and methodology is not disclosed (sample size, definitions, timeframe, baselines, selection bias). - Buyers should request underlying study design, whether results are median or mean, distributions, and whether results were independently audited.

Independent case studies

No detailed independent third-party case studies with full methodology were identified in the materials reviewed for this report. Buyers should request referees and independent validations during evaluation.

04Best fit

Best-fit organizations

Company profile: organizations with multiple product teams and established AppSec governance; strongest fit for mid-market to large enterprises where AppSec governance and compliance requirements exist.
Maturity: teams that already run CI/CD and want policy-driven security gates.

Industries (common fit)

Regulated and security-sensitive verticals (financial services, healthcare, airlines, large technology companies). This inference is based on enterprise customer examples and vendor positioning.

Personas

AppSec leaders / security engineering managers
DevSecOps engineers
Platform engineering / CI owners
Development teams needing IDE and pipeline integration

Qualification criteria

Good fit when:

Organizations require a unified program (SAST + SCA + API + IaC + ASPM) under centralized governance.
The organization can invest in tuning and rollout to manage false positives.
The organization can meet enterprise commercial constraints such as minimum deal sizes reported in marketplace listings.

05The pitch

What the product does (objective value proposition)

Checkmarx is an Application Security Testing (AST) and Application Security Posture Management (ASPM) vendor that provides tools to identify and remediate security issues across: - First-party code (SAST) - Open-source dependencies (SCA / supply chain) - Infrastructure as Code (IaC) scanning via KICS - API security testing - Secrets detection - Developer training (Codebashing) The current flagship platform is Checkmarx One, a cloud-based AppSec platform with modular add-ons and enterprise support.

Target market and positioning

Checkmarx primarily targets mid-market to large enterprise engineering organizations with formal AppSec/DevSecOps programs and CI/CD pipelines. Evidence includes:

G2 reviews skewing to mid-market/enterprise reviewers and use cases around integrating into existing repositories and CI/CD.
Marketplace listings that present list pricing examples and commercial constraints, which suggests enterprise procurement and higher annual contract structures.

Get a comprehensive analysis of Checkmarx including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →