Checkmarx

What is Checkmarx?

Checkmarx One is an application security platform for finding and fixing vulnerabilities across the software lifecycle. Static analysis (SAST) scans source code in any language, software composition analysis (SCA) checks open-source dependencies and builds SBOMs, and add-on engines cover dynamic testing, API security, container images, infrastructure-as-code and hardcoded secrets. A posture layer correlates results into one risk view and produces audit-ready reports mapped to PCI DSS, HIPAA, SOC 2 and NIST. Optional AI agents under the Assist name triage findings, suggest fixes in pull requests and check generated code inside IDEs such as Cursor, Windsurf and VS Code. Checkmarx One runs as SaaS or self-hosted. It is sold as Essentials, Professional and Enterprise packages through a custom quote based on developers, applications and usage, with no public list price and no self-serve trial. Developer Assist alone is listed at $25 per month per user.

Use cases

• Scan source code for vulnerabilities
• Check open-source dependencies and licenses
• Detect hardcoded secrets before release
• Secure AI-generated code in the IDE
• Scan Terraform and Kubernetes configs
• Generate SBOMs and AI-BOMs
• Prioritize findings by business risk

Who it's for

• Security teams
• Developers
• DevSecOps engineers
• Enterprises

Why use Checkmarx

• Covering code, dependencies, APIs and containers on one platform avoids stitching separate scanners together.
• Context-based risk scoring helps teams spend time on vulnerabilities that actually matter.
• Checking generated code inside the IDE catches issues before commit.
• Packages are modular, so modules can be added or tiers upgraded later without a rebuild.
• Audit-ready reporting maps findings to common compliance frameworks.

Checkmarx features

• SAST for source code across every language
• SCA with reachability analysis and SBOM generation
• API discovery and security testing
• Container image and IaC scanning
• Secrets detection with 170+ patterns and live validation
• Malicious package protection for typosquatted and compromised packages
• ASPM with risk scoring and portfolio-wide dashboards
• Compliance reporting for PCI DSS, HIPAA, SOC 2 and NIST
• Developer Assist agent for real-time fixes in Cursor, Windsurf, VS Code and Kiro
• Triage Assist and Remediation Assist AI agents
• Checkmarx MCP to connect security data to AI coding agents
• SaaS and self-hosted deployment

Checkmarx integrations

• Cursor
• Windsurf
• VS Code
• JetBrains
• Eclipse
• AWS Kiro
• Claude
• GitHub Copilot
• Terraform
• Kubernetes

How to get started with Checkmarx

1. Request a quote or demo and pick a package or build a custom bundle of engines.
2. Connect repositories, CI/CD pipelines and supported IDEs to Checkmarx One.
3. Scanners analyze code, packages, APIs, containers and infrastructure files.
4. Findings are correlated and scored in the posture dashboard, with optional AI triage and fix suggestions.
5. Developers fix issues in the IDE or pull requests and security teams track reports.

Checkmarx limitations

• No public list price; packages are quoted per environment
• No self-serve free trial, only a personalized demo
• Modules such as DAST, Container Security and Secrets Detection vary by package or are add-ons
• AI Assist agents are optional paid add-ons with their own pricing basis

Checkmarx pricing

Checkmarx is sold on custom quotes, so its prices aren't published. Paid plans start at $25 per month, according to the official pricing page on 24 Oct 2026.

Checkmarx plans

• Essentials

  Custom

  • SAST
  • SCA
  • API Security
  • ASPM

• Professional

  Custom

  • Everything in Essentials
  • Malicious Package Protection
  • Repository Health
  • DAST
  • Container Security

• Enterprise

  Custom

  • Everything in Essentials and Professional
  • IaC Security
  • Secrets Detection
  • Codebashing

• Developer Assist

  $25/month/user

  1-month free trial available

  • Runs in your AI-powered IDE
  • Real-time explainable fixes
  • Safe Refactor with non-breaking fixes
  • Pre- and post-commit remediation

Plans as listed on the official pricing page on 24 Oct 2026. Prices can change and may vary by country or exclude tax. Check the official pricing page.

Checkmarx alternatives

The main Checkmarx alternatives listed on Debuly are Veracode, Semgrep, Nullify, Corgea, DeepCode AI and DeepSource. The table compares pricing and platforms; order is A–Z.

1. 

   Corgea

   AI-native application security platform that scans code, dependencies, containers and infrastructure and proposes fixes in pull requests.

   CodingDeveloper platformsAutomation and agents
   FreemiumVisit Corgea (official site)
2. 

   DeepCode AI

   Snyk's security-focused AI engine that finds vulnerabilities in source code, suggests autofixes and prioritizes risk across the Snyk platform.

   CodingDeveloper platforms
   FreemiumVisit DeepCode AI (official site)
3. 

   DeepSource

   AI code review platform that pairs static analysis with AI review and Autofix on every pull request, with a 14-day free trial.

   CodingDeveloper platforms
   Free trialVisit DeepSource (official site)
4. 

   Nullify

   Autonomous product security platform that finds vulnerabilities, proves exploitability and opens merge-ready fix pull requests.

   CodingAutomation and agentsDeveloper platforms
   Contact salesVisit Nullify (official site)
5. 

   Semgrep

   Application security platform for static analysis, supply chain and secrets scanning, with AI-assisted triage and fixes for developers and coding agents.

   Developer platformsCoding
   FreemiumVisit Semgrep (official site)
6. 

   Veracode

   Application security platform for static, dynamic and open-source scanning, supply chain protection and AI-assisted fixes.

   Developer platformsCoding
   Contact salesVisit Veracode (official site)

Checkmarx FAQ

Sources & verification

Facts on this page come from the official sources below, each with the date we read it. Written by Debuly; the vendor did not review this page.

Image credits

• Logo: from checkmarx.com · fetched 23 Oct 2026 · Vendor trademark, used only to identify the product; removed on request
• Cover: none collected yet, so a generated tile is shown.

Spot an error? Report an issue with this listing. We also remove a logo or image on the owner's request.