Checkmarx is an application security testing and application security posture management platform that scans first-party code (SAST), open-source dependencies (SCA), infrastructure-as-code, APIs, and secrets while providing developer training and enterprise governance via the cloud-based Checkmarx One platform.
Published Oct 22, 2026
| Starting Price | Custom quote; marketplace examples show per-license annual starter packages and minimum deal sizes in listings | Custom quote (commonly) | Subscription/self-serve plus enterprise tiers; pricing varies widely |
| Best For | Enterprises needing broad AST + ASPM capabilities with optional on-prem/hybrid deployment and centralized governance | Enterprises prioritizing a mature SaaS AST program and governance workflows | Developer-centric organizations focused on open-source security, containers, and IaC with emphasis on developer workflow integration |
| Key Strength | Breadth of coverage across SAST/SCA/API/IaC/ASPM and optional training add-ons | Market positioning around precision and remediation automation (vendor positioning) | Developer adoption, fast SCA workflows, and ease of use (market perception) |
| Key Weakness | Review themes: false positives, scanning performance, dashboard/reporting and modular cost structure | Market feedback often cites premium pricing and enterprise process overhead | Perceived limitations for governance or enterprise breadth in some buyer scenarios |
Competitor content positions Veracode as having lower false positives out of the box and emphasizes automated fixes. This is biased competitor content but aligns with some reviewer comments about false positives; validation via POC is required.
Vendor comparisons claim Snyk is less enterprise-ready; other market materials position Snyk as developer-centric. If an organization is heavily GitHub-centric and prioritizes developer experience over centralized governance, Snyk or GitHub Advanced Security may be operationally simpler.
Vendor materials report growth and ARR figures for Checkmarx One; these are vendor claims and were not independently verified in the materials reviewed.