Acunetix vs Checkmarx One vs Veracode comparison

Read 208 Veracode reviews

19,227 Views
11,536 Comparison Views

89% willing to recommend

Acunetix

Checkmarx One

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Acunetix, Checkmarx One, and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: February 2026).

Application Security Tools

February 2026

Download the complete report

Helped 885,376 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

ROI

Sentiment score

6.6

Entities saw 300% ROI with reduced risk, time savings, cost reduction, and improved security, justifying continued tool use.

Sentiment score

5.6

Checkmarx One enhances security by automating vulnerability detection, reducing costs, and improving development efficiency through CI/CD integration.

Sentiment score

6.5

Veracode optimizes development by automating vulnerability detection, reducing costs, improving security, compliance, and enhancing software reliability.

It saves a significant amount of time by covering attack surfaces.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

I have seen a return on investment, as Acunetix helps reduce the man-days and effort needed for scanning bulk applications through automated assessments.

For more quotes and insights, download the Acunetix report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

Overall, between the fast scanning, automation, automatic reporting, and easy detection, it has reduced manual effort enough that we did not need an extra reviewer, even as our codebase or team size grew.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

Based on my interactions with the clients, I can tell that there is a return on investment because if something is not profitable and it's not helping to save costs or vulnerabilities, clients wouldn't come back to renew their license year after year.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

For more quotes and insights, download the Checkmarx One report

The scanners of Veracode bring status of the weaknesses in the current infrastructure. It scans and provides reports regarding the servers, the network, and the applications running on those servers.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

Regarding price, the evaluation should focus on how efficiently they will recover their investment, considering the time saved through the use of Veracode Fix, for example, and the ability to fix code at dev time compared to the problems faced when fixing after the product is already deployed.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

We did see a return on investment with Veracode, as we segregated our remediation efforts, which reduced our time to delivery as well as the number of engineers needed to help us in delivering a secure solution.

reviewer2774562

DevSecOps Engineer at a tech services company with 11-50 employees

For more quotes and insights, download the Veracode report

Customer Service

Sentiment score

6.5

Acunetix support is responsive and helpful, but response times vary, with some delays for high-severity issues noted.

Sentiment score

7.0

Checkmarx One support is praised for quick responses and knowledgeable staff, despite some reporting delays in technical support.

Sentiment score

7.2

Veracode's support is praised for responsiveness and expertise, though some experience delays with complex issues.

For high-severity issues, they reach out within two to three hours, and for critical issues, a response is received within 15 minutes.

Himanshu_Tyagi

Lead Cybersecurity at TBO

The technical support from Invicti is very good and fast.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

Support staff not being familiar with the problem.

For more quotes and insights, download the Acunetix report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

If you raise a support case with Checkmarx, it is handled smoothly.

RiteshWalia

ML Engineer - Specialist at a tech vendor with 10,001+ employees

The customer support team is amazing and they provide on-phone call, email support, and on-website support.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

I have relied on Checkmarx One customer support hundreds of times for several things, and Checkmarx One support is very proactive and very responsive.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

Access to the engineering team is crucial for faster feedback on the product fix process.

SrikanthRaghavan

Principal Architect at a consultancy with 11-50 employees

I have communicated with the technical support of Veracode a couple of times, and this was a really great experience because these professionals know their material.

Andrei Kriukov

Application Security Specialist at Herrenknecht

They share detailed information via email, including screenshots or further clarification about the issue.

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

For more quotes and insights, download the Veracode report

Scalability Issues

Sentiment score

6.9

Acunetix is praised for scalability across various environments, despite some dynamic scan issues and the need for Linux support.

Sentiment score

7.0

Checkmarx One is scalable for large workloads, but some users report challenges with configurations and licensing requirements.

Sentiment score

7.4

Veracode offers efficient scalability with cloud architecture, supporting diverse applications and user roles across industries despite minor scan delays.

Acunetix can handle increasing workloads and more applications easily.

For more quotes and insights, download the Acunetix report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

Approximately four billion lines of code are being scanned monthly.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

Since it is cloud-based, the infrastructure and PaaS, IaaS, and SaaS are taken care of by the cloud marketplace.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Checkmarx One's scalability has changed my organization because the strong collaboration between the development and security team helps us to do things much faster.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

Cloud solutions are easier to scale than on-premise solutions.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

It has a good capacity to scale effectively.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

Implementing these features into our normal CI/CD was good, so I can say that scalability is really good.

Andrei Kriukov

Application Security Specialist at Herrenknecht

For more quotes and insights, download the Veracode report

Stability Issues

Sentiment score

8.1

Acunetix offers stable, reliable scans with minimal issues and high satisfaction, despite occasional upgrade glitches and initial speed concerns.

Sentiment score

7.3

Checkmarx One is generally stable but faces issues with large codebases, memory use, and session inconsistencies.

Sentiment score

7.8

Veracode is praised for stability and performance despite minor glitches, with continuous improvements ensuring reliability and minimal downtime.

No quotes available

For more quotes and insights, download the Acunetix report

I would rate the stability of this solution a nine on a scale of 1 to 10 where one is low stability and 10 is high.

Syed Hasan

Specialist Leader at Deloitte

Checkmarx One is often down when the cloud provider experiences issues.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

For more quotes and insights, download the Checkmarx One report

If the Veracode server is down, we experience many issues during the scan.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

I have observed that it is not that reliable in terms of security because Veracode was not able to find some security threats in our application that existed since the product was developed.

Yash Shende

Software Development Engineer II at Rocket Software

It's not that easy to onboard, but once they have been onboarded on the platform, and the pipeline configured alongside the product configured, it works effectively.

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

For more quotes and insights, download the Veracode report

Room For Improvement

Acunetix needs improvements in speed, accuracy, usability, integration, and support to enhance functionality and user satisfaction.

Checkmarx One needs enhancements in accuracy, speed, integration, UI, support, pricing, and features for enterprise usability.

Veracode requires improvements in reducing false positives, enhancing speed, improving integration, flexibility, support, UI, and customer service.

The main concern is related to false positives; Acunetix needs to work on identifying valid and invalid findings.

Himanshu_Tyagi

Lead Cybersecurity at TBO

I could supply it with maybe a Swagger file or a JSON file, and Acunetix would pick it up, scan all the endpoints according to the OWASP Top Ten, and give me remediation and actionable remediation reports.

Adetunji Adeoje

Team Lead, Application Security at a financial services firm with 5,001-10,000 employees

Acunetix should have better integration with newer tools such as GitHub and Azure DevOps.

KashifJamil

CEO at Xcelliti

For more quotes and insights, download the Acunetix report

Integration into the IDE being used would be beneficial so that code does not need to be uploaded to the website and an IDE-friendly report could be generated.

reviewer2783283

Senior Software Engineer at a financial services firm with 10,001+ employees

It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from.

Syed Hasan

Specialist Leader at Deloitte

If you can improve the speed optimization, it takes around 30 to 40 minutes for checking a build. If you can make it within five minutes or 10 minutes, that would be great.

Rohit Kaushish

Senior Software Engineer at a tech vendor with 10,001+ employees

For more quotes and insights, download the Checkmarx One report

If it could be integrated directly with code repositories such as Bitbucket or GitHub, without the need to create a pipeline to upload and decode code, it would simplify the code scan process significantly.

Himadri Subudhi

Works

We had issues with scanning large applications. Scanning took a lot of time, so we kept it outside the DevOps pipeline to avoid delaying deployments.

Brintha Prabakar

Lead Automation Quality Engineer in Leading UK Bank at a consultancy with 10,001+ employees

A nice addition would be if it could be extended for scenarios with custom cleansers.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

For more quotes and insights, download the Veracode report

Setup Cost

Acunetix pricing is seen as high and complex, impacting renewal decisions due to cost transparency and fluctuation issues.

Checkmarx One is often costly but provides quality and security, with costs varying by team size and selected modules.

Veracode's higher pricing offers comprehensive security for enterprises, posing challenges for smaller businesses, with negotiable licensing options.

The pricing cost is affordable for small and mid-sized organizations, and when compared to Checkmarx, it is significantly affordable, as Checkmarx is quite expensive.

Himanshu_Tyagi

Lead Cybersecurity at TBO

We secured a special licensing model for penetration testing companies, which is cost-effective.

Abdullah Ozkan

Information Security Engineer at Tübitak Bilgem

The pricing of Acunetix is pretty expensive and could be improved.

Srinivas Walikar

Senior Business Development Manager at Intouch World

For more quotes and insights, download the Acunetix report

For a small team under 50 developers, normal expenses come under 30 to 60K.

For more quotes and insights, download the Checkmarx One report

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Due to the number of years I've implemented Checkmarx One, there are rebates and discounts from the OEM which makes it a lot more profitable.

Gideon Anichi

Chief Technology Officer at 3CS Aquarah Limited

The pricing should be reasonable, matching what we are paying for.

Swetha Dhanasekar

Senior GenAI Engineer at a tech vendor with 10,001+ employees

It's not the most expensive solution.

AlejandroMosso

Senior Solutions Architect at IDS Comercial

Overall, Veracode's pricing is lower and more scalable than many alternatives in the market.

reviewer2753535

DevSecOps Engineer at a tech services company with 1,001-5,000 employees

If there's a security gap, you'll never know the cost or effect.

Himadri Subudhi

Works

For more quotes and insights, download the Veracode report

Valuable Features

Acunetix provides efficient, comprehensive vulnerability scanning with user-friendly features, accurate detection, and seamless integration, enhancing security management.

Checkmarx One offers comprehensive vulnerability scanning, seamless CI/CD integration, and enhances productivity with ease of use and automation.

Veracode offers comprehensive code analysis, seamless integration, and efficient vulnerability detection, improving security and development speed with minimal manual effort.

Its most valuable role is in enhancing security by identifying potential vulnerabilities efficiently.

Srinivas Walikar

Senior Business Development Manager at Intouch World

The solution is excellent at detecting SQL injection and cross-site scripting vulnerabilities.

KashifJamil

CEO at Xcelliti

For more quotes and insights, download the Acunetix report

Senior Engineer - Penetration Tester at a government with 10,001+ employees

Since replacing the previous tool, SAST and SCA scans are conducted in a couple of minutes instead of hours or days.

Ricardo Sousa da Silva

Cyber Security Expert at Nestle

The best features Checkmarx One offers, over the past years, include broad language and technical support that Checkmarx provides, covering most languages.

RiteshWalia

ML Engineer - Specialist at a tech vendor with 10,001+ employees

Checkmarx One has positively impacted our organization as we tend to find vulnerabilities very early in the development cycle.

Adarkum Kumar

Product security engineer at a tech vendor with 10,001+ employees

For more quotes and insights, download the Checkmarx One report

It offers confidence by preventing exposure to vulnerabilities and helps ensure that we are not deploying vulnerable code into production.

Kv Rao

Site Leader (India) at Industrial Scientific

The best features in Veracode include static analysis and the early detection of vulnerable libraries; it integrates with tools such as Jenkins.

Himadri Subudhi

Works

It fixes issues directly in the IDE while you're doing it.

reviewer2700198

IT App Security Senior Analyst at a transportation company with 10,001+ employees

For more quotes and insights, download the Veracode report

Mindshare comparison

As of April 2026, in the Application Security Tools category, the mindshare of Acunetix is 2.1%, down from 2.5% compared to the previous year. The mindshare of Checkmarx One is 9.9%, down from 11.0% compared to the previous year. The mindshare of Veracode is 4.6%, down from 10.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Checkmarx One	9.9%
Veracode	4.6%
Acunetix	2.1%
Other	83.4%

Application Security Tools

Featured Reviews

Identifies vulnerabilities across bulk web applications but needs better support and cleaner reports

Senior Engineer - Penetration Tester at a government with 10,001+ employees

The best feature Acunetix offers is the centralized dashboard and the quality of reports it generates, which includes various options for selecting reports and developer options for directly sharing the reports with developers. The centralized dashboard of Acunetix gives visibility into the security aspects of mass applications; for instance, with more than 200 applications, it provides a valuable overview of findings and necessary fixes, along with a high-level summary that helps us achieve compliance through monthly and sometimes weekly scanning. In terms of reporting, Acunetix is excellent because it can generate different types of reports, such as an executive summary report, detailed reports, and developer reports that can be shared directly with developers. Acunetix positively impacts my organization by helping identify outdated libraries and applications, including legacy applications vulnerable to old attacks based on OWASP Top 10, thus aiding in compliance checks for PCI DSS and OWASP. Acunetix provides a centralized report with compliance-related aspects and a vulnerability timeline, effectively helping reduce vulnerabilities and save time.

Read full review

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

885,376 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

No data available

Financial Services Firm

17%

Manufacturing Company

10%

Computer Software Company

Government

Financial Services Firm

15%

Computer Software Company

12%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	15
Midsize Enterprise	7
Large Enterprise	18

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	45
Large Enterprise	114

Questions from the Community

What is your primary use case for Acunetix Vulnerability Scanner?

My main use of Acunetix is to scan my web application. I mostly deal with web applications and with Acunetix Network ...

What advice do you have for others considering Acunetix Vulnerability Scanner?

I am still working with Acunetix, and we have even moved to their new platform, Invicti. I have requested a demo for ...

What is your experience regarding pricing and costs for Acunetix?

I would say the pricing is average, but still, it is higher than low.

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

What needs improvement with Checkmarx?

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If i...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

PortSwigger Burp Suite Professional vs Acunetix

Comparisons

OWASP Zap vs Acunetix

Compared 10% of the time

Compared 8% of the time

Invicti vs Acunetix

Compared 6% of the time

SonarQube vs Acunetix

Compared 4% of the time

Tenable.io Web Application Scanning vs Acunetix

Compared 3% of the time

More Acunetix Competitors

SonarQube vs Checkmarx One

Compared 43% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

SonarQube vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

OWASP Zap vs Veracode

Compared 3% of the time

Snyk vs Veracode

Compared 2% of the time

More Veracode Competitors

Product Reports

Download Acunetix product report

Acunetix

March 2026

Download Checkmarx One product report

Checkmarx One

March 2026

Download Veracode product report

March 2026

Also Known As

AcuSensor

No data available

Crashtest Security , Veracode Detect

Overview

Acunetix Web Vulnerability Scanner is an automated web application security testing tool that audits your web applications by checking for vulnerabilities like SQL Injection, Cross site scripting, and other exploitable vulnerabilities.

Invicti

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Joomla!, Digicure, Team Random, Credit Suisse, Samsung, Air New Zealand

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.