Try our new research platform with insights from 80,000+ expert users

AttackIQ vs Checkmarx One comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jun 8, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Zafran Security
Sponsored
Ranking in Vulnerability Management
18th
Average Rating
9.6
Reviews Sentiment
7.8
Number of Reviews
6
Ranking in other categories
Continuous Threat Exposure Management (CTEM) (2nd)
AttackIQ
Ranking in Vulnerability Management
70th
Average Rating
7.0
Reviews Sentiment
5.7
Number of Reviews
1
Ranking in other categories
Breach and Attack Simulation (BAS) (8th), Attack Surface Management (ASM) (37th), Continuous Threat Exposure Management (CTEM) (6th)
Checkmarx One
Ranking in Vulnerability Management
24th
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
71
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Static Code Analysis (3rd), API Security (5th), DevSecOps (5th), Risk-Based Vulnerability Management (9th)
 

Mindshare comparison

As of July 2025, in the Vulnerability Management category, the mindshare of Zafran Security is 0.8%, up from 0.0% compared to the previous year. The mindshare of AttackIQ is 0.2%, up from 0.1% compared to the previous year. The mindshare of Checkmarx One is 0.8%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Vulnerability Management
 

Featured Reviews

Israel Cavazos Landini - PeerSpot reviewer
Weekly insights and risk analysis facilitate informed security decisions
I appreciate the weekly insights Zafran provides, which include critical topics for networks and IT security, allowing us to evaluate which insights apply to our environment. The organization score feature is valuable to keep the leadership team updated on how our infrastructure fares security-wise. The applicable risk level versus base risk level feature is beneficial because prior to Zafran, we only used the base risk level, but now understand that risk depends on the asset itself. Zafran is an excellent tool.
BN
Overall, a good user experience and works well but is hard to set up
I can't think of any features that are lacking just now. It does everything I need it to do. I don't have too much experience with the solution. I need more time to really study the solution to see if there are any shortcomings. The initial setup was quite difficult and took a long time.
Syed Hasan - PeerSpot reviewer
Partner experiences excellent technical support and seamless initial setup
In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"We are able to see the real risk of a vulnerability on our environment with our security tools."
"We saw benefits from Zafran Security almost immediately after deploying it."
"Zafran has become an indispensable tool in our cybersecurity arsenal."
"Zafran is an excellent tool."
"Overall, we have seen about eighty-seven percent reduction of the number of vulnerabilities that require urgency to remediate, specifically the number of criticals."
"Overall, I've had a good experience with the product. It's worked well for me."
"The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete."
"Checkmarx pinpoints the vulnerability in the code and also presents the flow of malicious input across the application."
"It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx."
"Apart from software scanning, software composition scanning is valuable."
"The solution communicates where to fix the issue for the purpose of less iterations."
"The process of remediating software security vulnerabilities can now be performed (ongoing) as portions of the application are being built in advance of being compiled."
"The reports are very good because they include details on the code level, and make suggestions about how to fix the problems."
"The most valuable feature for me is the Jenkins Plugin."
 

Cons

"I think the ability to have some enhanced reporting capabilities is something they can improve on, as they have good reports but we have asked for some specific reporting enhancements."
"Initially, we were somewhat concerned about the scalability of Zafran due to our large asset count and the substantial amount of information we needed to process."
"The dashboarding and reporting functionality of Zafran Security is an area that definitely could use some improvements."
"The initial setup was quite difficult and took a long time."
"With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too."
"The Dynamic Application Security Testing (DAST) feature should be better."
"The solution's user interface could be improved because it seems outdated."
"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"The reports are good, but they still need to be improved considering what the UI offers."
"If it is a very large code base then we have a problem where we cannot scan it."
"The lack of ability to review compiled source code. It would then be able to compete with other scanning tools, such as Veracode."
"There is nothing particular that I don't like in this solution. It can have more integrations, but the integrations that we would like are in the roadmap anyway, and they just need to deliver the roadmap. What I like about the roadmap is that it is going where it needs to go. If I were to look at the roadmap, there is nothing that is jumping out there that says to me, "Yeah. I'd like something else on the roadmap." What they're looking to deliver is what I would expect and forecast them to deliver."
 

Pricing and Cost Advice

Information not available
Information not available
"The solution's price is high and you pay based on the number of users."
"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."
"I believe pricing is better compared to other commercial tools."
"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
report
Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.
862,543 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Computer Software Company
11%
Financial Services Firm
11%
Manufacturing Company
7%
Healthcare Company
6%
Financial Services Firm
19%
Computer Software Company
10%
Manufacturing Company
7%
Energy/Utilities Company
6%
Financial Services Firm
20%
Computer Software Company
14%
Manufacturing Company
10%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
No data available
 

Questions from the Community

What is your experience regarding pricing and costs for Zafran Security?
The current pricing of Zafran Security is fair overall. They were good to work with to accommodate our organization w...
What needs improvement with Zafran Security?
The dashboarding and reporting functionality of Zafran Security is an area that definitely could use some improvement...
What is your primary use case for Zafran Security?
Zafran Security is helping reduce the amount of critical vulnerabilities in our environments that require prompt reme...
Ask a question
Earn 20 points
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
 

Also Known As

No data available
DeepSurface
No data available
 

Overview

 

Sample Customers

Information Not Available
Information Not Available
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about Qualys, Wiz, Tenable and others in Vulnerability Management. Updated: July 2025.
862,543 professionals have used our research since 2012.