Checkmarx Software Composition Analysis Reviews

Name: Checkmarx Software Composition Analysis
Brand: Checkmarx
Rating: 4.5 (13 reviews)

4.5 out of 5

13 reviews
100% willing to recommend

What is Checkmarx Software Composition Analysis?

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Get the Checkmarx Software Composition Analysis Buyer's Guide and find out what your peers are saying about Checkmarx Software Composition Analysis, GitLab, Snyk and more!

Checkmarx Software Composition Analysis is the #8 ranked solution in top Software Composition Analysis (SCA) solutions. PeerSpot users give Checkmarx Software Composition Analysis an average rating of 9.0 out of 10. Checkmarx Software Composition Analysis is most commonly compared to GitLab: Checkmarx Software Composition Analysis vs GitLab. Checkmarx Software Composition Analysis is popular among the large enterprise segment, accounting for 80% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 36% of all views.

Buyer's Guide

Checkmarx Software Composition Analysis

June 2025

Get the report

Helped 856,873 peers since 2012

Featured Checkmarx Software Composition Analysis reviews

Tharindu Malwenna

Senior Application Security Engineer at Wiley

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Sujata Sujata Ghadage

Sr Manager consultant - Digital assurance Services at adrosonic

I am more into the SAST side, which is related to Checkmarx Software Composition Analysis. Checkmarx recently introduced DAST and software composition analysis, but I am not aware much about it. Checkmarx Software Composition Analysis is a good tool with many rules, ensuring that the product offers vulnerability detection and provides good coverage. Though my company has not integrated Checkmarx Software Composition Analysis into SDLC, we do plan to do it in the future. The product helped our company deal with a major security breach when we had to deal with a lot of SQL-related issues stemming from some of the codes, which were written earlier not using a proper framework, owing to which there were many vulnerabilities in respect to LDAP, cross-site attacks and SQL injection. The product's most effective part for identifying vulnerabilities stems from the tool's SAST capabilities. The product's dashboard has improved our company's vulnerability management processes. The tool shows a proper dashboard and offers frequent remediation options and proper compliance status, which helps to know about the number of vulnerabilities and the dashboards. The accuracy of the product's vulnerability detection is 95 percent. At an organizational level, the product is hosted on the cloud. In my company, we use the product to scan reports. I don't see anything complex in the solution from the maintenance point of view. The product is deployed in a single location where multiple people use it. The product can be described as an access-based solution. For a particular project or depending on an assignment, access is given to certain people for a month or two. After the completion of a project or assignment, the product's access to a person is removed and given to another person who needs the solution for another project. I recommend the product to those who plan to use it. It is one of the best tools in the market. The product provides good coverage and ensures that the users experience a return on investment from its use in their environment. The tool is also helpful in dealing with vulnerabilities and false positives. I rate the overall tool a nine out of ten.

Read full review

Harsh Soni

Cyber Security Engineer at Rah Infotech Pvt Ltd

The integration part is easy. It will also be compatible with a developer because a lot of tools are needed to write code, just like in Java. And then, users have the Eclipse software tool that writes code in Java, while Checkmarx also supports integration with Eclipse. So it becomes much easier for developers to find the vulnerabilities and see if they are correct or if they need to be correct. Checkmarx will highlight those lines and words which will be vulnerable on that code. They will highlight, and they will prompt, but we have to correct it.

Read full review

Checkmarx Software Composition Analysis mindshare

As of June 2025, the mindshare of Checkmarx Software Composition Analysis in the Software Composition Analysis (SCA) category stands at 2.6%, down from 3.0% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Software Composition Analysis (SCA)

PeerResearch reports based on Checkmarx Software Composition Analysis reviews

Type	Title	Date
Category	Software Composition Analysis (SCA)	Jun 15, 2025	Download
Product	Reviews, tips, and advice from real users	Jun 15, 2025	Download
Comparison	Checkmarx Software Composition Analysis vs Black Duck	Jun 15, 2025	Download
Comparison	Checkmarx Software Composition Analysis vs Snyk	Jun 15, 2025	Download
Comparison	Checkmarx Software Composition Analysis vs Veracode	Jun 15, 2025	Download

Title	Rating	Mindshare	Recommending
GitLab	4.3	4.3%	97%	84 interviews Add to research
Snyk	4.0	14.5%	100%	47 interviews Add to research

Valuable Features

Checkmarx Software Composition Analysis offers ease of use and seamless CICB pipeline integration, enabling fast incremental scans. Users value its ability to identify component vulnerabilities, provide security from development start, and offer comprehensive visibility into software security. It supports integration with developer tools, offers configurability, and provides actionable remediation advice. The tool highlights potential license issues, offers comprehensive security scans, shows library vulnerabilities, and suggests version upgrades. The user-friendly interface and AI integration improve identification and scalability.

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."
"It has improved identification capabilities, scalability, and integration with AI, such as the AI-powered suggestions."
"The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all libraries that are vulnerable and the extent of their vulnerability."

Room for Improvement

Checkmarx Software Composition Analysis requires enhancements in pricing and licensing models, user interface, scanning speed, integration with systems like MuleSoft, and handling of false positives. Users desire faster updates to address vulnerabilities and improvements in dynamic analysis and API functionality. Support quality, performance during scans, and user-friendly implementation also need attention. Customer feedback highlights the need for more accurate vulnerability assessments and a "what if" feature to simulate changes without full reruns.

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."
"The solution could improve by determining the success factor of an upgrade, which is currently lacking."
"Checkmarx Software Composition Analysis should improve dynamic analysis."

Pricing

Enterprise users find Checkmarx Software Composition Analysis pricing to be on the higher side, with a complex licensing model based on user numbers, project scans, and additional factors. The high cost can be challenging for small organizations, though larger companies benefit significantly. Compared to competitors, pricing appears less competitive, necessitating careful evaluation of value versus expense. Enterprises typically opt for annual subscriptions, although usage can be limited to specific team sizes.

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."
"My customers need to pay for the licensing part, and they need to opt for an annual subscription."
"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

Popular Use Cases

Checkmarx Software Composition Analysis is mainly used by IT security and development teams for detecting vulnerabilities in open-source components of applications. Commonly integrated into CI/CD pipelines, it performs static code analysis and checks the integrity of libraries, focusing on .NET and Java applications. It facilitates security scanning and vulnerability identification in various domains, including banking and insurance, and helps manage legal and licensing risks associated with open-source software.

Service and Support

Checkmarx Software Composition Analysis has responsive and dedicated customer service. Their team often resolves issues quickly, with same-day responses. Support is available 24/7 and rates high in effectiveness. Users appreciate helpful assistance during installation and for queries, highlighting good documentation. Some feedback suggests a decline in support quality compared to previous years. Integrators are recognized for being knowledgeable and customer-friendly, providing excellent assistance through various communication channels.

Deployment

Users found Checkmarx Software Composition Analysis's initial setup straightforward and user-friendly, often describing it as easy and uncomplicated. While some highlighted effortless plug-and-play installation, others mentioned minimal deployment times, ranging from a couple of hours to a few days. Technical support was noted as helpful in some cases. Organizations appreciated the seamless integration with platforms like GitHub and Jenkins, guided effectively by available documentation, allowing for management by individuals with limited technical expertise.

Scalability

Checkmarx Software Composition Analysis exhibits strong scalability. Multiple users commend its capacity to support unlimited projects and its efficient data consumption. Ratings for scalability generally fall between seven to ten, reflecting positive experiences with adaptability across various projects. Despite some limited usage, several users highlight its ability to perform well with diverse applications, including SaaS and code batching solutions. The number of users often fluctuates, contributing to its flexibility and resource optimization.

Stability

Checkmarx Software Composition Analysis is highly stable according to users who report it performing as expected without major issues even during upgrades. They indicate it supports numerous projects and scans efficiently. Stability ratings average between eight and nine out of ten. Some note occasional performance bottlenecks, especially when using a European-based cloud, which can slow scans significantly. However, most agree it is a stable platform as the company progresses.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our Checkmarx Software Composition Analysis Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

36%

Manufacturing Company

12%

Computer Software Company

Educational Organization

Government

Healthcare Company

Insurance Company

Transportation Company

Comms Service Provider

Energy/Utilities Company

Logistics Company

Performing Arts

University

Wholesaler/Distributor

Media Company

Non Profit

Pharma/Biotech Company

Real Estate/Law Firm

Retailer

Construction Company

Outsourcing Company

Legal Firm

Consumer Goods Company

Hospitality Company

Compare Checkmarx Software Composition Analysis with alternative products

Learn more about Checkmarx Software Composition Analysis

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Checkmarx Software Composition Analysis was previously known as CxSCA.