Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs CoreOS Clair comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx One
Ranking in Container Security
22nd
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
71
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (23rd), Static Code Analysis (3rd), API Security (4th), Dynamic Application Security Testing (DAST) (4th), DevSecOps (4th), Risk-Based Vulnerability Management (9th)
CoreOS Clair
Ranking in Container Security
29th
Average Rating
8.6
Reviews Sentiment
7.6
Number of Reviews
2
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of August 2025, in the Container Security category, the mindshare of Checkmarx One is 2.1%, down from 3.5% compared to the previous year. The mindshare of CoreOS Clair is 0.5%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security
 

Featured Reviews

Syed Hasan - PeerSpot reviewer
Partner experiences excellent technical support and seamless initial setup
In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.
Felipe Giffu - PeerSpot reviewer
An operational system, similar to Linux where you can run your applications inside containers
With CoreOS, you can run your applications inside containers. For example, if you have an application that needs to run on Linux, you can create and install a container. However, it's important to note that you don't install CoreOS inside a container; CoreOS is the host operating system that manages containers. When you mentioned using Nacula as part of your CI/CD pipeline, it means your application is deployed and managed automatically through the CI/CD process. Containers are used to deploy your application within this pipeline, but CoreOS does not run inside these containers. Instead, CoreOS is the base operating system that supports and manages these containers.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Scan reviews can occur during the development lifecycle."
"The most valuable features of Checkmarx are the SCA module and the code-checking module. Additionally, the solutions are explanatory and helpful."
"Checkmarx has helped us deliver more secure products. We are able to do static code analysis with the tool before shipping our code to production. When the integration is in the pipeline, this tool gives us early notifications on code fixes."
"The solution allows us to create custom rules for code checks."
"The main thing we find valuable about Checkmarx is the ease of use. It's easy to initiate scans and triage defects."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"The user interface is modern and nice to use."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"With CoreOS, you can run your applications inside containers. For example, if you have an application that needs to run on Linux, you can create and install a container. However, it's important to note that you don't install CoreOS inside a container; CoreOS is the host operating system that manages containers."
"CoreOS Clair's best feature is detection accuracy."
 

Cons

"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"Checkmarx is not good because it has too many false positive issues."
"It would be really helpful if the level of confidence was included, with respect to identified issues."
"They should make it more container-friendly and optimized for the CI pipeline. They should make it a little less heavy. Right now, it requires a SQL database, and the way the tool works is that it has an engine and then it has an analysis database in which it stores the information. So, it is pretty heavy from that perspective because you have to have a full SQL Server. They're working on something called Checkmarx Light, which is a slim-down version. They haven't released it yet, but that's what we need. There should be something a little more slimmed down that can just run the analysis and output the results in a format that's readable as opposed to having a full, really big, and thick deployment with a full database server."
"We can run only one project at a time."
"Some were valid and some were not applicable for us based on the scenario."
"Checkmarx needs to be more scalable for large enterprise companies."
"I can't create a business case with multiple-factor authentication."
"An area for improvement is that CoreOS Clair doesn't provide information about the location of vulnerabilities it detects."
"It can be improved in its support response. They usually take up to seven days to resolve the issue."
 

Pricing and Cost Advice

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."
"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."
"We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."
"It is the right price for quality delivery."
"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."
"CoreOS Clair is open-source and free of charge."
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
865,384 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
20%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
Manufacturing Company
14%
Financial Services Firm
14%
Computer Software Company
11%
Performing Arts
9%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
What is your experience regarding pricing and costs for CoreOS Clair?
If you work with CoreOS or OpenShift, you don't need to pay for CoreOS separately. When you pay for OpenShift, you get CoreOS included, so you don't need to pay for the operating system separately....
What needs improvement with CoreOS Clair?
It can be improved in its support response. They usually take up to seven days to resolve the issue.
What is your primary use case for CoreOS Clair?
We use the tool to manage and secure the event file system. CoreOS Clair is an operational system that is very similar to Linux and offers benefits to other Linux operating systems. One major advan...
 

Overview

 

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
eBay, Veritas, Verizon, SalesForce
Find out what your peers are saying about Checkmarx One vs. CoreOS Clair and other solutions. Updated: August 2025.
865,384 professionals have used our research since 2012.