We performed a comparison between Checkmarx One and OWASP Zap based on real PeerSpot user reviews.
Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"The most valuable features of Checkmarx are the automation and information that it provides in the reports."
"The setup is fairly easy. We didn't struggle with the process at all."
"The most valuable feature is that it actually identifies the different criteria you can set to meet whatever standards you're trying to get your system accredited for."
"The only thing I like is that Checkmarx does not need to compile."
"The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes."
"The setup is very easy. There is a lot of information in the documents which makes the install not difficult at all."
"The solution has good performance, it is able to compute in 10 to 15 minutes."
"The community edition updates services regularly. They add new vulnerabilities into the scanning list."
"It can be used effectively for internal auditing."
"The best feature is the Zap HUD (Heads Up Display) because the customers can use the website normally. If we scan websites with automatic scanning, and the website has a web application firewall, it's very difficult."
"It scans while you navigate, then you can save the requests performed and work with them later."
"The OWASP's tool is free of cost, which gives it a great advantage, especially for smaller companies to make use of the tool."
"The product helps users to scan and fix vulnerabilities in the pipeline."
"The ZAP scan and code crawler are valuable features."
"The interface is easy to use."
"Checkmarx could improve the REST APIs by including automation."
"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."
"You can't use it in the continuous delivery pipeline because the scanning takes too much time."
"We can run only one project at a time."
"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."
"Checkmarx is not good because it has too many false positive issues."
"Some of the descriptions were found to be missing or were not as elaborate as compared to other descriptions. Although, they could be found across various standard sources but it would save a lot of time for developers, if this was fixed."
"I expect application security vendors to cover all aspects of application security, including SAST, DAST, and even mobile application security testing. And it would be much better if they provided an on-premises and cloud option for all these main application security features."
"The product reporting could be improved."
"The documentation needs to be improved because I had to learn everything from watching YouTube videos."
"The product should allow users to customize the report based on their needs."
"The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more."
"The port scanner is a little too slow."
"It doesn't run on absolutely every operating system."
"As security evolves, we would like DevOps built into it. As of now, Zap does not provide this."
"I prefer Burp Suite to SWASP Zap because of the extensive coverage it offers."
Checkmarx One is ranked 3rd in Static Application Security Testing (SAST) with 67 reviews while OWASP Zap is ranked 7th in Static Application Security Testing (SAST) with 37 reviews. Checkmarx One is rated 7.6, while OWASP Zap is rated 7.6. The top reviewer of Checkmarx One writes "The report function is a great, configurable asset but sometimes yields false positives". On the other hand, the top reviewer of OWASP Zap writes "Great for automating and testing and has tightened our security ". Checkmarx One is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and Fortify Application Defender, whereas OWASP Zap is most compared with SonarQube, Acunetix, Qualys Web Application Scanning, PortSwigger Burp Suite Professional and Fortify WebInspect. See our Checkmarx One vs. OWASP Zap report.
See our list of best Static Application Security Testing (SAST) vendors.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
