Checkmarx One Reviews

Name: Checkmarx One
Brand: Checkmarx
Rating: 3.8 (71 reviews)

3.8 out of 5

71 reviews
87% willing to recommend

3,522 followers

What is Checkmarx One?

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Get the Checkmarx One Buyer's Guide and find out what your peers are saying about Checkmarx One, SonarQube Server (formerly SonarQube), Wiz and more!

Checkmarx One is the #3 ranked solution in application security solutions, #3 ranked solution in AST tools, #3 ranked solution in top Static Code Analysis solutions, #4 ranked solution in top DevSecOps solutions, #5 ranked solution in API Security Solutions, #9 ranked solution in top Risk-Based Vulnerability Management solutions, and #24 ranked solution in top Vulnerability Management solutions. PeerSpot users give Checkmarx One an average rating of 7.6 out of 10. Checkmarx One is most commonly compared to SonarQube Server (formerly SonarQube): Checkmarx One vs SonarQube Server (formerly SonarQube). Checkmarx One is popular among the large enterprise segment, accounting for 69% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 21% of all views.

Helped 856,873 peers since 2012

Featured Checkmarx One reviews

Syed Hasan

Specialist Leader at Deloitte

In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

Read full review

Rohit Kesharwani

Manager, Engineering at 7-Eleven

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

ScottDenton

Senior regional manager at AppDome

The interactive application security testing, or IAST, where code scans are being ran on an application that lives in a runtime environment on a server or virtual machine, needs improvement. There was limited support from different languages. It didn't support everything under the sun, so you would lose revenue since you didn't have support for Scala or some other language that your developer was fluent in. They needed to improve on language support. That is about it, really. The dev team did everything that they said they were going to do. If they said they were going to hit a mark, they'd hit a mark. That release would come out. Typically, they would do four major releases a year, quarterly, with two-point releases in between, or based on any additional hotfixes that may be needed. In most cases, however, IAST was the part of the product that needed to be improved the most. Codebashing is a really cool product from the aspect of teaching developers how to write secure code. However, it would be even cooler if you could not only point out and teach someone how to do it while also making the appropriate recommendation on how to rewrite the code itself, using machine learning or AI. Instead of you, the developer learning how to do it and then writing the code yourself, it'd be cooler if you could push a button, have it analyzed, scans the code, find the code, find the issue within the line of code, and then go ahead and automatically rewrite that code for you. Then, by repetition, it just teaches you through muscle memory how to do that as opposed to, "Hey, you've found this problem. This is where the problem's located, within this particular line of code." Right now, do you know how to rewrite Java? Well, if you're not familiar with how to do that, then go push on this button. Now, take this test and go through this exercise.” It doesn't make a recommendation. It's not like providing a script that fixes the problem. It's just teaching you on how to write the code in that form in that manner.

Read full review

Checkmarx One mindshare

Product category:

As of June 2025, the mindshare of Checkmarx One in the Application Security Tools category stands at 10.0%, down from 14.5% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

PeerResearch reports based on Checkmarx One reviews

Type	Title	Date
Category	Application Security Tools	Jun 15, 2025	Download
Product	Reviews, tips, and advice from real users	Jun 15, 2025	Download
Comparison	Checkmarx One vs SonarQube Server (formerly SonarQube)	Jun 15, 2025	Download
Comparison	Checkmarx One vs Veracode	Jun 15, 2025	Download
Comparison	Checkmarx One vs GitHub Advanced Security	Jun 15, 2025	Download

Title	Rating	Mindshare	Recommending
SonarQube Server (formerly SonarQube)	4.0	23.5%	81%	116 interviews Add to research
Wiz	4.5	N/A	95%	22 interviews Add to research

Valuable Features

Checkmarx One offers valuable features like vulnerability identification with detailed reports, easy-to-use interface, and integration with key platforms. It supports multiple programming languages without code compilation, reducing false positives and negatives. Users appreciate its comprehensive scanning for both SAST and SCA, intuitive user interface, quick scanning speed, and configurable reporting. It provides clarity in pinpointing vulnerabilities and recommended fixes, enhancing developers' secure coding capabilities while being user-friendly and effective for various organizations.

"I have seen a return on investment from Checkmarx One."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process."

Room for Improvement

Checkmarx One requires improvements in reducing false positives, enhancing role management, and expanding language support. Integrations with third-party tools and more flexible licensing are needed. The user interface and reporting features could be more intuitive, while scanning speed and dynamic testing capabilities should be optimized. Better customization in dashboarding and diagnostic feedback in the GUI can enhance user experience. Support for emerging technologies and comprehensive tutorials are also desired enhancements.

"Some were valid and some were not applicable for us based on the scenario."
"The Dynamic Application Security Testing (DAST) feature should be better."
"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

ROI

Checkmarx One offers significant benefits by enhancing security during development, leading to faster, secure solution delivery. It identifies issues early, saving on troubleshooting costs and expediting production timelines significantly. Organizations report that the use of Checkmarx One finds code issues early, avoids costly breaches, and improves security practices. Despite some instances of uncertain return due to limited use, others confidently commit to it long-term, citing strong ROI across various security aspects.

Pricing

Checkmarx One licensing is often described as expensive, with various costs influencing the total price, such as user numbers, lines of code, and additional services. Many users find the pricing justified due to its flexibility and high-quality security features, though some note the need for clearer licensing details. Negotiations can offer discounts or custom packages. While some find it more costly than competitors, others appreciate its value for comprehensive application security.

"For around 250 users or committers, the cost is approximately $500,000."
"The tool's pricing is fine."
"The solution's price is high and you pay based on the number of users."

Popular Use Cases

Checkmarx One is primarily used for static application security testing, focusing on source code scanning to identify security vulnerabilities during software development. Users conduct periodic scans, evaluating code quality and adherence to compliance policies, while assessing potential vulnerabilities in applications hosted on various platforms. It integrates well with SCM solutions for efficient code scanning across numerous repositories, helping development and security teams detect, address, and rectify security flaws at an early stage.

Service and Support

Checkmarx One's customer service and support are consistently rated positively. Many express satisfaction with their knowledgeable and responsive support teams, highlighting swift response times and expert assistance. Some mention the value of dedicated account managers and effective resolutions, though others note occasional delays and ticket closure issues. Overall, the feedback reflects robust performance but with room for quicker service and more consistent response times. Most users rate the experience between seven and nine out of ten.

Deployment

Users find Checkmarx One's initial setup generally easy and straightforward, typically requiring minimal time and effort. Proper documentation helps guide users through the process. Some experiences differ, however, as users may encounter complexities requiring technical expertise or support interaction, especially when dealing with specific configurations or environments. While most users manage setup efficiently within a day, others experience longer durations due to additional parameters or integration with DevOps tools and larger setups.

Scalability

Checkmarx One scales effectively for diverse user bases. Many found it easily adjustable, supporting both small teams and larger organizations. Some mentioned its potential with appropriate resource allocation, while others pointed out limitations without sufficient memory. Licensing can affect scalability, but concurrent scans facilitate handling multiple projects. Users generally gave high ratings, with some suggesting improvements for enterprise-level scaling. Successful integration within larger infrastructures was noted by several developers and enterprises.

Stability

Checkmarx One is generally stable, yet memory and performance issues appear with large scans. Frequent updates improve functionality, though specific configurations can lead to crashing or freezing. Users mention stability rates between six to ten, indicating varying degrees of satisfaction. Suggestions include splitting large files and conducting regular full scans to enhance efficiency. Negative feedback is minimal, often due to user setup rather than Checkmarx One itself.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Checkmarx One Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

21%

Computer Software Company

14%

Manufacturing Company

10%

Government

Insurance Company

Healthcare Company

Energy/Utilities Company

Educational Organization

Retailer

Comms Service Provider

Media Company

University

Non Profit

Real Estate/Law Firm

Legal Firm

Construction Company

Outsourcing Company

Transportation Company

Performing Arts

Hospitality Company

Consumer Goods Company

Engineering Company

Wholesaler/Distributor

Logistics Company

Recreational Facilities/Services Company

Pharma/Biotech Company

Aerospace/Defense Firm

Compare Checkmarx One with alternative products

Learn more about Checkmarx One

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.