CAST Highlight vs Checkmarx One comparison

 

Comparison Buyer's Guide

Executive Summary
 

Categories and Ranking

CAST Highlight
Average Rating
7.8
Number of Reviews
5
Ranking in other categories
Software Composition Analysis (SCA) (13th)
Checkmarx One
Average Rating
7.6
Number of Reviews
68
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (12th), Static Code Analysis (2nd), API Security (4th), DevSecOps (2nd), Risk-Based Vulnerability Management (5th)
 

Mindshare comparison

As of July 2024, in the Software Composition Analysis (SCA) category, the mindshare of CAST Highlight is 1.4%, up from 0.9% compared to the previous year. The mindshare of Checkmarx One is 5.2%, down from 8.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Software Composition Analysis (SCA)
Unique Categories:
No other categories found
Application Security Tools
13.0%
Static Application Security Testing (SAST)
11.1%
 

Featured Reviews

AS
Oct 20, 2022
Easy to set up with optimized and automated insights
We get some code insights from CAST. We get insights as to if this or that function has way too many comments or things like that. We would like to backtrace, and understand how dependent that is as per the application. For example, when you are writing code in C Sharp versus writing code in C++, obviously, C++ has more complexities within that. What CAST does is CAST aggregates for different languages, and if they could provide us inputs for each of these languages separately, then that'd be great. When they classify code between their own code and third-party code, they classify it based on the number of files, and not really the number of lines. I'm not sure how extensive of a change this is on their end; however, it would be nice if they could tell us the number of lines of code that are not theirs. There's a bit of a learning curve at the outset. We have come across bugs occasionally. Technical support could be better.
Rahul Mane - PeerSpot reviewer
Feb 19, 2023
A highly recommended tool for delivering secure products
We use the solution for SAST and DAST testing Checkmarx has helped us deliver more secure products. We are able to do static code analysis with the tool before shipping our code to production. When the integration is in the pipeline, this tool gives us early notifications on code fixes.…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"CAST Highlight is easy to use and has a good dashboard."
"The most valuable features of CAST Highlight are automation and speed."
"It offers good performance."
"The way it tells you which codebase is more ready for the cloud and which codebase is less ready is very valuable. It works seamlessly with most languages."
"The most valuable features of the CAST Highlight are the interface and there are three notations that are very simple to understand and communicate with."
"The UI is user-friendly."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"Apart from software scanning, software composition scanning is valuable."
"The reports are very good because they include details on the code level, and make suggestions about how to fix the problems."
"We were using HPE Security Fortify to scan code for security vulnerabilities, but it can scan only after a successful compile. If the code has dependencies or build errors, the scan fails. With Checkmarx, pre-compile scanning is seamless. This allows us to scan more code."
"It gives the proper code flow of vulnerabilities and the number of occurrences."
"The user interface is modern and nice to use."
"The most valuable feature is the application tracking reporting."
 

Cons

"CAST Highlight could improve to allow us to comment and do a deep analysis by ourselves."
"The ease of configuration and customization could be improved in CAST Highlight."
"The reports that describe the issues of concern are rather abstract and the issues should be more clearly described to the user."
"There's a bit of a learning curve at the outset."
"Its price should be better. It is a pretty costly tool. They have two products: CAST Highlight and CAST AIP. I would expect CAST Highlight to have the Help dashboard and the Engineering dashboard. These dashboards are currently a part of CAST AIP, and if these are made available in CAST Highlight, customers won't have to use two different products all the time."
"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."
"I really would like to integrate it as a service along with the SAP HANA Cloud Platform. It will then be easy to use it directly as a service."
"The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform."
"The pricing can get a bit expensive, depending on the company's size."
"It provides us with quite a handful of false positive issues. If Checkmarx could reduce this number, it would be a great tool to use."
"The cost per user is high and should be reduced."
"With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too."
"Checkmarx needs to be more scalable for large enterprise companies."
 

Pricing and Cost Advice

"CAST Highlight is an expensive solution. However, CAST Highlight is less expensive than the CAST AIP, but it remains too expensive and the professional services from CAST are also too expensive. The high price is part of the problem with the CAST solutions."
"Basic support is included with the standard licensing feed but it can be upgraded for an additional cost."
"CAST Highlight is an expensive solution."
"It is a pretty costly tool. A lot of customers are resistant to using it."
"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."
"We have purchased an annual license to use this solution. The price is reasonable."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"The solution is costly."
"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."
"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"It is the right price for quality delivery."
report
Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.
793,295 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
17%
Insurance Company
10%
Manufacturing Company
10%
Financial Services Firm
21%
Computer Software Company
15%
Manufacturing Company
10%
Government
5%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What do you like most about CAST Highlight?
The most valuable features of CAST Highlight are automation and speed.
What is your experience regarding pricing and costs for CAST Highlight?
CAST Highlight is an expensive solution. On a scale from one to ten, where one is cheap, and ten is expensive, I rate the solution's pricing an eight or nine out of ten.
What needs improvement with CAST Highlight?
The ease of configuration and customization could be improved in CAST Highlight.
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
 

Comparisons

 

Learn More

 

Overview

 

Sample Customers

Wells Fargo, Bank of NY Mellon, Northern Trust, Microsoft, Amazon, IBM, BMW, AT&T, US Army, US Air Force, US Navy, John Hancock, Marsh & McLennan, Ernst & Young, PwC, Volkswagen, Boston Consulting Group, London Stock Exchange, Telefonica, Saur France, Total Energies France, SNCF
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about CAST Highlight vs. Checkmarx One and other solutions. Updated: September 2022.
793,295 professionals have used our research since 2012.