No more typing reviews! Try our Samantha, our new voice AI agent.

Apiiro vs Checkmarx One comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Apiiro
Ranking in Static Application Security Testing (SAST)
23rd
Ranking in API Security
15th
Ranking in Risk-Based Vulnerability Management
18th
Ranking in Application Security Posture Management (ASPM)
10th
Average Rating
8.6
Reviews Sentiment
6.4
Number of Reviews
4
Ranking in other categories
Software Composition Analysis (SCA) (15th), Software Supply Chain Security (10th)
Checkmarx One
Ranking in Static Application Security Testing (SAST)
2nd
Ranking in API Security
7th
Ranking in Risk-Based Vulnerability Management
10th
Ranking in Application Security Posture Management (ASPM)
4th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
81
Ranking in other categories
Application Security Tools (2nd), Vulnerability Management (13th), Container Security (15th), Static Code Analysis (2nd), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (3rd), AI Security (4th)
 

Mindshare comparison

As of November 2026, in the Application Security Posture Management (ASPM) category, the mindshare of Apiiro is 5.5%, up from 4.2% compared to the previous year. The mindshare of Checkmarx One is 8.6%, down from 11.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Posture Management (ASPM) Mindshare Distribution
ProductMindshare (%)
Checkmarx One8.6%
Apiiro5.5%
Other85.9%
Application Security Posture Management (ASPM)
 

Featured Reviews

Abimael Ferreira - PeerSpot reviewer
Security at Blaze Information Security
Centralized code analysis has improved my workflow and prioritizes critical vulnerabilities
Apiiro offers several features that I consider the best, such as the ability to have multiple developers and AppSec professionals working on the same project, and through the platform, we can see the number of vulnerabilities, generate reports, and integrate Snyk within our workflow. Before the code goes to production, Apiiro can read all that code and determine if everything is okay or if improvements are needed. The reports generated by Apiiro and its integration with Snyk contribute to my development process by giving us visibility into what is actually vulnerable, as automation like Apiiro makes it much easier to track vulnerabilities without spending too much time manually checking for issues, thus generating meaningful reports afterward. Apiiro manages permissions very effectively, which is interesting from an organizational standpoint because it allows us to separate which people can access a given project and designate project administrators who can approve or reject changes once a fix is made. I found the accuracy and reliability of Apiiro's results to be very good, as it can predict issues based on its existing data.
Shahzad Shahzad - PeerSpot reviewer
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution
Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance
Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The positive impact I have seen from working with Apiiro for my company includes the metrics that we get from Apiiro, which have been extremely helpful."
"The workflow automation is likely the best aspect of the solution."
"Apiiro manages permissions very effectively, which is interesting from an organizational standpoint because it allows us to separate which people can access a given project and designate project administrators who can approve or reject changes once a fix is made."
"Apiiro's secrets detection feature has saved us several times, which we appreciate greatly."
"Checkmarx is a nice, pleasant, and relatively easy company to work with."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"The biggest advantage we have seen is that we're able to develop and deliver secure solutions in a faster time."
"It moved our organization towards being agile vs. waterfall."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete."
"The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process."
"The consistency of code showed our team where they are inconsistent or where they have made simple omissions."
 

Cons

"My first feedback for Apiiro is that it is very slow, extremely slow."
"User management is a little bit clunky."
"The UI sometimes helps but can also be a bit confusing."
"I would like support for our self-hosted Git server, other than GitHub, just regular Git."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
"The lack of ability to review compiled source code. It would then be able to compete with other scanning tools, such as Veracode."
"For Checkmarx One, I think that adding repositories and scanning impromptu code could improve it."
"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."
"The stability of Checkmarx could improve. We're having issues with it, and the scan reliability is sometimes impacted so we sometimes have to restart the services to allow scans out of the queue."
"The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform."
"The Dynamic Application Security Testing (DAST) feature should be better."
"It provides us with quite a handful of false positive issues. If Checkmarx could reduce this number, it would be a great tool to use."
 

Pricing and Cost Advice

Information not available
"The interface used to create custom rules comes at an additional cost."
"The price of Checkmarx could be reduced to match their competitors, it is expensive."
"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."
"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."
"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."
"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."
"The pricing was not very good. This is just a framework which shouldn’t cost so much."
"The tool's pricing is fine."
report
Use our free recommendation engine to learn which Application Security Posture Management (ASPM) solutions are best for your needs.
921,028 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
14%
Manufacturing Company
11%
Computer Software Company
8%
Construction Company
8%
Financial Services Firm
14%
Manufacturing Company
9%
Outsourcing Company
8%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise9
Large Enterprise46
 

Questions from the Community

What needs improvement with Apiiro?
One area Apiiro could improve is reporting customization and dashboard flexibility with more advanced filtering and easier communication.
What is your primary use case for Apiiro?
Apiiro is primarily used for code scanning and integration with source code control. The main use cases include code scanning and code snippet analysis. Apiiro provides security and visibility by h...
What advice do you have for others considering Apiiro?
Based on my experience with Apiiro, I would recommend it to organizations looking to strengthen their application security processes and integrate security into their development workflows. One of ...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Checkmarx?
Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...
 

Comparisons

 

Also Known As

Apiiro Control Plane (ASOC), Apiiro API Security (SAST), Apiiro Open Source (SCA)
No data available
 

Overview

 

Sample Customers

Morgan Stanley, Rakuten, Jack Henry, SoFi, Colgate, Navan
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about Apiiro vs. Checkmarx One and other solutions. Updated: October 2026.
921,028 professionals have used our research since 2012.