Checkmarx One Reviews

Name: Checkmarx One
Brand: Checkmarx
Rating: 3.8 (71 reviews)

3.8 out of 5

71 reviews
87% willing to recommend

What is Checkmarx One?

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Get the Checkmarx One Buyer's Guide and find out what your peers are saying about Checkmarx One, SonarQube Server (formerly SonarQube), Wiz and more!

Checkmarx One is the #3 ranked solution in application security solutions, #3 ranked solution in AST tools, #3 ranked solution in top Static Code Analysis solutions, #4 ranked solution in API Security Solutions, #4 ranked solution in top Dynamic Application Security Testing (DAST) solutions, #4 ranked solution in top DevSecOps solutions, #9 ranked solution in top Risk-Based Vulnerability Management solutions, #22 ranked solution in Container Security Solutions, and #23 ranked solution in top Vulnerability Management solutions. PeerSpot users give Checkmarx One an average rating of 7.6 out of 10. Checkmarx One is most commonly compared to SonarQube Server (formerly SonarQube): Checkmarx One vs SonarQube Server (formerly SonarQube). Checkmarx One is popular among the large enterprise segment, accounting for 69% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 20% of all views.

Helped 864,053 peers since 2012

Featured Checkmarx One reviews

Syed Hasan

Specialist Leader at Deloitte

In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

Read full review

Rohit Kesharwani

Manager, Engineering at 7-Eleven

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

Souhardyya Biswas

Software Engineer at a manufacturing company with 10,001+ employees

A non-developer may struggle with the solution. Codebashing is the learning platform that comes bundled with Checkmarx. The thing with Codebashing is that they give you tips on how to write secure code. However, I saw other developers complain about this. Instead of telling you what the good practices are, it would be more helpful, when we are writing the code, alongside that code, to have Codebashing tell us where exactly we are going wrong and how to help secure code and if there are specific scenarios we should be considering. Basically, the integration needs to be better. There's a general lack of space. Checkmarx has a slightly difficult compilation with the CI/CD pipeline. If it could be easily integrated into the CI/CD pipeline, then it would be much easier for developers rather than being an extra step that developers have to take to make the code secure.

Read full review

Checkmarx One mindshare

Product category:

As of August 2025, the mindshare of Checkmarx One in the Application Security Tools category stands at 10.3%, down from 13.9% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

PeerResearch reports based on Checkmarx One reviews

Type	Title	Date
Category	Application Security Tools	Aug 1, 2025	Download
Product	Reviews, tips, and advice from real users	Aug 1, 2025	Download
Comparison	Checkmarx One vs SonarQube Server (formerly SonarQube)	Aug 1, 2025	Download
Comparison	Checkmarx One vs Veracode	Aug 1, 2025	Download
Comparison	Checkmarx One vs GitHub Advanced Security	Aug 1, 2025	Download

Title	Rating	Mindshare	Recommending
SonarQube Server (formerly SonarQube)	4.0	22.4%	81%	116 interviews Add to research
Wiz	4.5	N/A	95%	22 interviews Add to research

Valuable Features

Checkmarx One offers valuable features like vulnerability identification with detailed reports, easy-to-use interface, and integration with key platforms. It supports multiple programming languages without code compilation, reducing false positives and negatives. Users appreciate its comprehensive scanning for both SAST and SCA, intuitive user interface, quick scanning speed, and configurable reporting. It provides clarity in pinpointing vulnerabilities and recommended fixes, enhancing developers' secure coding capabilities while being user-friendly and effective for various organizations.

"I have seen a return on investment from Checkmarx One."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process."

Room for Improvement

Checkmarx One requires improvements in reducing false positives, enhancing role management, and expanding language support. Integrations with third-party tools and more flexible licensing are needed. The user interface and reporting features could be more intuitive, while scanning speed and dynamic testing capabilities should be optimized. Better customization in dashboarding and diagnostic feedback in the GUI can enhance user experience. Support for emerging technologies and comprehensive tutorials are also desired enhancements.

"Some were valid and some were not applicable for us based on the scenario."
"The Dynamic Application Security Testing (DAST) feature should be better."
"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

ROI

Checkmarx One offers significant benefits by enhancing security during development, leading to faster, secure solution delivery. It identifies issues early, saving on troubleshooting costs and expediting production timelines significantly. Organizations report that the use of Checkmarx One finds code issues early, avoids costly breaches, and improves security practices. Despite some instances of uncertain return due to limited use, others confidently commit to it long-term, citing strong ROI across various security aspects.

Pricing

Checkmarx One licensing is often described as expensive, with various costs influencing the total price, such as user numbers, lines of code, and additional services. Many users find the pricing justified due to its flexibility and high-quality security features, though some note the need for clearer licensing details. Negotiations can offer discounts or custom packages. While some find it more costly than competitors, others appreciate its value for comprehensive application security.

"For around 250 users or committers, the cost is approximately $500,000."
"The tool's pricing is fine."
"The solution's price is high and you pay based on the number of users."

Popular Use Cases

Checkmarx One is primarily used for static application security testing, focusing on source code scanning to identify security vulnerabilities during software development. Users conduct periodic scans, evaluating code quality and adherence to compliance policies, while assessing potential vulnerabilities in applications hosted on various platforms. It integrates well with SCM solutions for efficient code scanning across numerous repositories, helping development and security teams detect, address, and rectify security flaws at an early stage.

Service and Support

Checkmarx One's customer service and support are consistently rated positively. Many express satisfaction with their knowledgeable and responsive support teams, highlighting swift response times and expert assistance. Some mention the value of dedicated account managers and effective resolutions, though others note occasional delays and ticket closure issues. Overall, the feedback reflects robust performance but with room for quicker service and more consistent response times. Most users rate the experience between seven and nine out of ten.

Deployment

Users find Checkmarx One's initial setup generally easy and straightforward, typically requiring minimal time and effort. Proper documentation helps guide users through the process. Some experiences differ, however, as users may encounter complexities requiring technical expertise or support interaction, especially when dealing with specific configurations or environments. While most users manage setup efficiently within a day, others experience longer durations due to additional parameters or integration with DevOps tools and larger setups.

Scalability

Checkmarx One scales effectively for diverse user bases. Many found it easily adjustable, supporting both small teams and larger organizations. Some mentioned its potential with appropriate resource allocation, while others pointed out limitations without sufficient memory. Licensing can affect scalability, but concurrent scans facilitate handling multiple projects. Users generally gave high ratings, with some suggesting improvements for enterprise-level scaling. Successful integration within larger infrastructures was noted by several developers and enterprises.

Stability

Checkmarx One is generally stable, yet memory and performance issues appear with large scans. Frequent updates improve functionality, though specific configurations can lead to crashing or freezing. Users mention stability rates between six to ten, indicating varying degrees of satisfaction. Suggestions include splitting large files and conducting regular full scans to enhance efficiency. Negative feedback is minimal, often due to user setup rather than Checkmarx One itself.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Checkmarx One Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

20%

Computer Software Company

14%

Manufacturing Company

10%

Government

Insurance Company

Healthcare Company

Educational Organization

Energy/Utilities Company

Retailer

Comms Service Provider

University

Media Company

Non Profit

Real Estate/Law Firm

Legal Firm

Outsourcing Company

Construction Company

Transportation Company

Performing Arts

Consumer Goods Company

Hospitality Company

Engineering Company

Wholesaler/Distributor

Recreational Facilities/Services Company

Logistics Company

Pharma/Biotech Company

Aerospace/Defense Firm

Compare Checkmarx One with alternative products

Learn more about Checkmarx One

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.