Try our new research platform with insights from 80,000+ expert users
Checkmarx One Logo

Checkmarx One Reviews

Vendor: Checkmarx
3.8 out of 5
Badge Leader
Leave a review

What is Checkmarx One?

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Get the Checkmarx One Buyer's Guide and find out what your peers are saying about Checkmarx One, SonarQube, Wiz and more!
Checkmarx One is the #2 ranked solution in top Static Code Analysis solutions, #2 ranked solution in top Dynamic Application Security Testing (DAST) solutions, #2 ranked solution in top DevSecOps solutions, #3 ranked solution in application security solutions, #3 ranked solution in AST tools, #3 ranked solution in API Security Solutions, #3 ranked solution in top Application Security Posture Management (ASPM) solutions, #3 ranked solution in top AI Security solutions, #8 ranked solution in top Risk-Based Vulnerability Management solutions, #15 ranked solution in Container Security Solutions, and #16 ranked solution in top Vulnerability Management solutions. PeerSpot users give Checkmarx One an average rating of 7.6 out of 10. Checkmarx One is most commonly compared to SonarQube: Checkmarx One vs SonarQube. Checkmarx One is popular among the large enterprise segment, accounting for 66% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 19% of all views.
Buyer's Guide
Checkmarx One
December 2025
Get the report
Helped 879,259 peers since 2012

Featured Checkmarx One reviews

Read more reviews

Checkmarx One mindshare

Product category:
Application Security Tools
As of December 2025, the mindshare of Checkmarx One in the Application Security Tools category stands at 10.2%, down from 12.1% compared to the previous year, according to calculations based on PeerSpot user engagement data.
Application Security Tools Market Share Distribution
ProductMarket Share (%)
Checkmarx One10.2%
SonarQube19.2%
Veracode6.1%
Other64.5%
Application Security Tools

PeerResearch reports based on Checkmarx One reviews

TypeTitleDate
CategoryApplication Security ToolsDec 29, 2025Download
ProductReviews, tips, and advice from real usersDec 29, 2025Download
ComparisonCheckmarx One vs SonarQubeDec 29, 2025Download
ComparisonCheckmarx One vs VeracodeDec 29, 2025Download
ComparisonCheckmarx One vs GitHubDec 29, 2025Download
Suggested products
TitleRatingMindshareRecommending
SonarQube4.019.2%83%134 interviewsAdd to research
Wiz4.5N/A96%33 interviewsAdd to research
 
 
Key learnings from peers
Last updated Dec 7, 2025

Valuable Features

Checkmarx One excels in its code analysis, security vulnerability detection, and ease of use. It offers automatic scanning, SAST and SCA functionalities, integration with major SCM and CI/CD tools, and comprehensive language support. Developers benefit from its intuitive interface, false positive management, and in-depth reporting. Features like Codebashing enhance secure coding skills. Organizations appreciate its time-saving capabilities, centralized dashboards, and seamless integration in DevSecOps workflows, ultimately improving code security and developer productivity.
  • "Checkmarx One has positively impacted our organization as we tend to find vulnerabilities very early in the development cycle."
  • "Checkmarx One has positively impacted the organization by providing resolution strategies and indicating which vulnerabilities need to be fixed."
  • "Once you implement Checkmarx One, you can be sure that you're getting value from the solution almost immediately because Checkmarx One also handles false positives very effectively, saving you time and saving your developers time."

Room for Improvement

Checkmarx One requires improvement in role management, false positive reduction, and language support, including Swift and legacy languages. The user interface and reporting features need enhancement. More tutorials for developers, dynamic code validation, and compatibility with additional IDEs are desired. The pricing and licensing model should be more flexible. Faster scanning speeds and better integration with CI/CD pipelines and DevSecOps are necessary. API and DAST features need strengthening, focusing on reducing manual verification and improving vulnerability accuracy.
  • "For Checkmarx One, I think that adding repositories and scanning impromptu code could improve it."
  • "Checkmarx One can be improved by reducing noise and improving false positive filtering."
  • "Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context."

ROI

Organizations experience significant value from Checkmarx One. It accelerates secure development and reduces manual review time by up to 30%. Checkmarx One aids in early vulnerability detection, decreases rework costs, and facilitates faster production launches. Users report a reduction in troubleshooting expenses and acknowledge overall cost-effectiveness. There's an improvement in security practices and substantial savings by preventing potential breaches. Many commit to long-term use, acknowledging the financial efficiency in reduced employee needs and enhanced automation.

Pricing

Checkmarx One is perceived as a premium solution with a range of licensing models, including modular, LOC, and agreement-based options. Pricing can be costly due to its high-quality performance but offers competitive TCO and flexibility. Costs vary significantly, from $30K to $1M, based on team size and modules. Discounts through multi-year contracts or Azure Marketplace usage can reduce expenses. Negotiation and customization options are available, offering potential cost efficiencies for enterprises.
  • "For around 250 users or committers, the cost is approximately $500,000."
  • "The tool's pricing is fine."
  • "The solution's price is high and you pay based on the number of users."

Popular Use Cases

Checkmarx One is primarily used for Static Application Security Testing (SAST) and Security Composition Analysis (SCA). Companies integrate it into CI/CD pipelines to scan source code for vulnerabilities before production. Its role in ensuring compliance and security covers identifying application vulnerabilities, offering developers remediation suggestions, and facilitating secure coding practices. It is leveraged for vulnerability detection across various projects, ensuring code quality and security from early development stages.

Service and Support

Checkmarx One's customer service and technical support are generally described as knowledgeable, responsive, and helpful. While some find the support swift and effective, others mention delays and the need for proactive engagement. Services include on-call and email support with quick responses in many regions. The support team's skill and expertise are frequently praised, though some report challenges with unresolved tickets and varying response times based on regional representation.

Deployment

Checkmarx One's initial setup is described as straightforward by most users, with many noting the easy-to-follow steps and solid documentation. While some faced complex configurations requiring technical support, most reported quick deployment times ranging from 15 minutes to a few hours. Several users emphasized the platform's ease of integration with existing systems, particularly CI/CD tools and cloud environments, enhancing overall user experience and efficiency.

Scalability

Checkmarx One scales effectively for many organizations, handling large workloads and global needs with ease. Users report no major issues with scaling, with the ability to manage growing demands. They mention the importance of hardware and memory resources. The cloud-based infrastructure aids in scalability, supporting numerous concurrent scans. While some note licensing constraints, Checkmarx's flexibility allows for ease of expansion while accommodating various deployment scenarios and environments.

Stability

Checkmarx One exhibits stable performance, though some users note issues with large code scans and memory consumption. Stability varies with different configurations and deployment methods, impacting scan performance for large applications. Many users report it as reliable with few crashes. Ratings are mostly positive, ranging from 6 to 10 out of 10, highlighting consistent reliability. Regular updates and education technologies are well integrated, and some users emphasize its seamless integration into workflows.
These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.
Download our Checkmarx One Buyer's Guide for additional reliable information.

Review data by company size

By reviewers
Company SizeCount
Small Business24
Midsize Enterprise9
Large Enterprise40
By reviewers
By visitors reading reviews
Company SizeCount
Small Business621
Midsize Enterprise368
Large Enterprise1883
By visitors reading reviews

Top industries

By visitors reading reviews
Financial Services Firm
19%
Computer Software Company
12%
Manufacturing Company
10%
Government
5%
Insurance Company
4%
Energy/Utilities Company
4%
Healthcare Company
4%
Educational Organization
4%
Retailer
4%
Comms Service Provider
3%
University
3%
Outsourcing Company
3%
Media Company
3%
Performing Arts
3%
Real Estate/Law Firm
2%
Non Profit
2%
Legal Firm
2%
Consumer Goods Company
2%
Construction Company
1%
Transportation Company
1%
Wholesaler/Distributor
1%
Hospitality Company
1%
Engineering Company
1%
Recreational Facilities/Services Company
1%
Pharma/Biotech Company
1%
Aerospace/Defense Firm
1%
Logistics Company
1%

Compare Checkmarx One with alternative products

Go!

Learn more about Checkmarx One

Checkmarx One offers comprehensive application scanning across the SDLC:

  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • API security
  • Dynamic Application Security Testing (DAST)
  • Container security
  • IaC security
  • Correlation, prioritization, and risk management
  • Codebashing secure code training
  • AI security
  • Tech partnerships extending AppSec into runtime analysis
  • Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx One customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech

Case Study: Liveperson Implements Innovative Secure SDLC

Related questions

  • 60
What is the biggest difference between Veracode and Checkmarx?
  • 38
Checkmarx or Veracode. Which should we choose?
  • 371
What is the Biggest Difference Between Checkmarx and Fortify?
  • 39
What is the biggest difference between Checkmarx and SonarQube?
  • 98
Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode
  • 128
If you had to both encrypt and compress data during transmission, which would you do first and why?
  • 37
When evaluating Application Security, what aspect do you think is the most important to look for?
  • 92
What are the Top 5 cybersecurity trends in 2022?
  • 119
What are the threats associated with using ‘bogus’ cybersecurity tools?
  • 42
We're evaluating Tripwire, what else should we consider?

Product Categories

Product Categories
Application Security Tools
Static Application Security Testing (SAST)
Vulnerability Management
Container Security
Static Code Analysis
API Security
Dynamic Application Security Testing (DAST)
DevSecOps
Risk-Based Vulnerability Management
Application Security Posture Management (ASPM)
AI Security

Popular Comparisons

Popular Comparisons
SonarQube vs Checkmarx One Logo
SonarQube vs Checkmarx One
Wiz vs Checkmarx One Logo
Wiz vs Checkmarx One
SentinelOne Singularity Cloud Security vs Checkmarx One Logo
SentinelOne Singularity Cloud Security vs Checkmarx One
Snyk vs Checkmarx One Logo
Snyk vs Checkmarx One
Microsoft Defender for Cloud vs Checkmarx One Logo
Microsoft Defender for Cloud vs Checkmarx One
Prisma Cloud by Palo Alto Networks vs Checkmarx One Logo
Prisma Cloud by Palo Alto Networks vs Checkmarx One
GitLab vs Checkmarx One Logo
GitLab vs Checkmarx One
Veracode vs Checkmarx One Logo
Veracode vs Checkmarx One
Coverity Static vs Checkmarx One Logo
Coverity Static vs Checkmarx One
Imperva Application Security Platform vs Checkmarx One Logo
Imperva Application Security Platform vs Checkmarx One
CrowdStrike Falcon Cloud Security vs Checkmarx One Logo
CrowdStrike Falcon Cloud Security vs Checkmarx One
GitHub Advanced Security vs Checkmarx One Logo
GitHub Advanced Security vs Checkmarx One
JFrog Xray vs Checkmarx One Logo
JFrog Xray vs Checkmarx One
Orca Security vs Checkmarx One Logo
Orca Security vs Checkmarx One
Tenable Vulnerability Management vs Checkmarx One Logo
Tenable Vulnerability Management vs Checkmarx One
See all alternatives
 
Checkmarx One Reviews Summary
Author infoRatingReview Summary
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution3.5I’ve used Checkmarx One extensively to improve developer workflow and application security, appreciating its strong SAST, SCA, and CI/CD integrations, though it could benefit from faster scans, deeper language support, and more contextual IDE guidance.
Senior Software Engineer at a tech vendor with 10,001+ employees4.5I've been using Checkmarx One for years to streamline code validation, improve quality, and ensure compliance, saving significant time weekly, though I’d like to see faster reporting speeds and a more intuitive UI.
Cyber Security Expert at a manufacturing company with 10,001+ employees4.5I use Checkmarx One for SAST and SCA scans, appreciating its CI/CD integration and SCM support; while reporting could improve, it’s boosted our speed to market and handles extensive global code scanning effectively.
Senior GenAI Engineer at a tech vendor with 10,001+ employees4.0I've used Checkmarx One for three years to streamline vulnerability detection through CI/CD integration, saving time and reducing manual reviews, though it could improve scan speed, false positives, and integration with modern development tools.
ML Engineer - Specialist at a tech vendor with 10,001+ employees4.5I've used Checkmarx One extensively in DevSecOps for secure code scanning and CI/CD integration; it's versatile and stable, though scan speed and false positives could improve. It supports many languages and helps ensure compliance in cloud and on-prem environments.
Chief Technology Officer at 3CS Aquarah Limited4.0I implement Checkmarx One for clients, and it's reliable, easy to set up, and delivers quick results, especially in secure code development. Its Codebashing feature stands out, though I’d like to see RASP capabilities in the future.
Specialist Leader at Deloitte4.5I work as a partner with Checkmarx One and find its initial setup straightforward, although hybrid deployment is preferred. The tool shows clear ROI, but automated code fixing would enhance its capabilities. Enterprise clients benefit from its effective security scans.
Senior Software Engineer at a financial services firm with 10,001+ employees3.5I've used Checkmarx One for about three years to run SAST scans via our CI/CD pipeline, finding it effective though sometimes noisy with false positives; its CWE summaries and fix guidance are particularly useful in my daily work.