Checkmarx One vs Coverity Static vs Veracode comparison

Read 207 Veracode reviews

21,114 Views
12,457 Comparison Views

89% willing to recommend

Checkmarx One

Coverity Static

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, Coverity Static, and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Veracode, Checkmarx and others in Static Application Security Testing (SAST).

To learn more, read our detailed Static Application Security Testing (SAST) Report (Updated: April 2026).

Static Application Security Testing (SAST)

Download the complete report

Helped 887,041 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2026, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx One is 10.1%, down from 10.8% compared to the previous year. The mindshare of Coverity Static is 3.3%, down from 8.1% compared to the previous year. The mindshare of Veracode is 4.8%, down from 9.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Mindshare Distribution
Product	Mindshare (%)
Veracode	4.8%
Checkmarx One	10.1%
Coverity Static	3.3%
Other	81.8%

Static Application Security Testing (SAST)

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

Kasiraja Thangapandian

Software Engineering Manager at Visteon Corporation

Using tools for compliance is beneficial but cost concerns persist

We have been using Coverity for quite a long period. It has been fine for our needs. I would rate Coverity between eight to nine, though the cost is high. I would rate their support from Coverity as six. That is the main complaint, but we still appreciate having it.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."

"From my point of view, it is the best product on the market."

"The solution has good performance, it is able to compute in 10 to 15 minutes."

"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."

"The feature that I have found most valuable is that its number of false positives is less than the other security application platforms. Its ease of use is another good feature. It also supports most of the languages."

"Once you implement Checkmarx One, you can be sure that you're getting value from the solution almost immediately because Checkmarx One also handles false positives very effectively, saving you time and saving your developers time."

"It shows in-depth code of where actual vulnerabilities are."

"The most valuable feature is the application tracking reporting."

More Checkmarx One pros

"We were very comfortable with the initial setup."

"The most valuable feature is the integration with Jenkins."

"Coverity is scalable."

"I encountered a bug with Coverity, and I opened a ticket. Support provided me with a workaround. So it's working at the moment, or at least it seems to be."

"The most valuable feature of Coverity is its interprocedural analysis, which is advantageous because it compares favorably with other tools in terms of security and code analysis."

"The most valuable feature of Coverity is the wrapper; we use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server."

"The product has deeper scanning capabilities."

"Coverity provides developers with a good, best practice, coding advice, and tracks risks of poor coding quality."

More Coverity Static pros

"Veracode has positively impacted our organization by giving us a good chance to focus on development as we don't need to focus as much on compliance-related matters after we have ensured this level of security on the security posture management for our application."

"In three years, we have not had any breaches or seen any reduction in Shadow IT."

"Allows us to track the remediation and handling of identified vulnerabilities."

"The most valuable feature is the SAST capability and its integration into the Veracode pipelines."

"Regarding Software Composition Analysis, an exceptional feature is that during a SAST scan, SCA is seamlessly conducted in the background."

"Overall, it does a very good job of preventing vulnerable code from going into production."

"I like Veracode's API. You can put it into a simple bash script and run your own security testing from your MacBook in less than 15 minutes."

"It has given our management a view into issues with all of our product lines, and as a result, the project lead for each product has taken measures to improve things."

More Veracode pros

Cons

"The integration could improve by including, for example, DevSecOps."

"If it is a very large code base then we have a problem where we cannot scan it (if more then ~ 30 mb zip file provided - scan is crashes or takes a lot of time)."

"Checkmarx needs to be more scalable for large enterprise companies."

"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."

"The reports are good, but they still need to be improved considering what the UI offers."

"The pricing can get a bit expensive, depending on the company's size."

"Presently they support micro-services, but the supporting methodology of the micro-services is not good enough at the moment."

"Its user interface could be improved and made more friendly."

More Checkmarx One cons

"Right now, the Coverity executable is around 1.2GB to download. If they can reduce it to approximately 600 or 700MB, that would be great. If they decrease the executable, it will be much easier to work in an environment like Docker."

"The tool needs to improve its reporting."

"Its price can be improved. Price is always an issue with Synopsys."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"The solution could use more rules."

"The solution is a bit complex to use in comparison to other products that have many plugins."

"The product could be enhanced by providing video troubleshooting guides, making issue resolution more accessible. Troubleshooting without visual guides can be time-consuming."

"Coverity is far from perfection, and I'm not 100 percent sure it's helping me find what I need to find in my role."

More Coverity Static cons

"The sandbox could use some improvement; when creating a sandbox, it requires us to put the application name in twice, which seems unnecessary."

"Overall, I would rate Veracode as a five out of 10, because the functionality is there, but to me, the usability of the user interface is very important and it's still not there."

"I would also like to see some improvement in the speed. Our developers are saying, "It takes 72 hours to scan it.""

"Their documentation is awful and their response time wasn't ideal."

"There needs to be better API integration to the development team's pipeline, which is something that is missing and needs to be improved."

"Veracode scans provide a higher number of false positives."

"Their platform is not consistent. It needs a lot of user experience updates. It's slow performing, and they log you out of the system every 15 minutes, so using the platform is challenging from a developer's perspective because you always have to log in."

"One of the things that we have from a reporting point of view, is that we would love to see a graphical report. If you look through a report for something that has come back from Veracode, it takes a whole lot of time to just go through all the pages of the code to figure out exactly what it says. We know certain areas don’t have the greatest security features but those are usually minor and we don’t want to see those types of notifications."

More Veracode cons

Pricing and Cost Advice

"We have purchased an annual license to use this solution. The price is reasonable."

"Be cautious of the one-year subscription date. Once it expires, your price will go up."

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."

"It is a good product but a little overpriced."

"I believe pricing is better compared to other commercial tools."

"This solution is expensive. The customized package allows you to buy additional users at any time."

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

More Checkmarx One pricing and cost advice

"The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten."

"The pricing is very reasonable compared to other platforms. It is based on a three year license."

"Coverity is very expensive."

"Offers varying prices for different companies"

"I would rate the pricing a six out of ten, where one is low, and ten is high price."

"The licensing fees are based on the number of lines of code."

"The solution is affordable."

"I would rate the tool's pricing a one out of ten."

More Coverity Static pricing and cost advice

"It can be expensive to do this, so I would just make sure that you're getting the proper number of licenses. Do your analysis. Make sure you know exactly what it is you need, going in."

"Veracode's price is reasonable."

"Pricing/licensing is complicated."

"Veracode provides value for the cost, with no additional charges apart from the standard licensing fee."

"Regarding licensing, pay very close attention to what applications you're going to need to do dynamic scanning for, versus static. Right now, the way the licensing is set up, if you don't have any static elements for a website, you can certainly avoid some costs by doing more dynamic licenses. You need to pay very close attention to that, because if you find out later that you have static code elements - like Java scripts, etc. - that you want to have scanned statically, having the two licenses bundled together will actually save you money."

"It's too expensive for the European market. That is why, in a big bank with 400 applications, we are able to use it only for 10 of them. But the other solutions are also expensive, so it wasn't a differentiator."

"Veracode is a very expensive product."

"The pricing is reasonable compared to other tools."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

887,041 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Manufacturing Company

Computer Software Company

Government

Manufacturing Company

30%

Computer Software Company

10%

Financial Services Firm

Comms Service Provider

Financial Services Firm

16%

Computer Software Company

11%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	8
Midsize Enterprise	6
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	45
Large Enterprise	114

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

What needs improvement with Checkmarx?

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If i...

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and securi...

What is your experience regarding pricing and costs for Coverity?

I do not know about the pricing.

What needs improvement with Coverity?

The price is a concern, and there are a lot of false positives coming through. Support with Coverity is adequate, but...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

SonarQube vs Checkmarx One

Comparisons

Compared 38% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

TrendAI Vision One – Cloud Security vs Checkmarx One

Compared 1% of the time

More Checkmarx One Competitors

SonarQube vs Coverity Static

Compared 20% of the time

Klocwork vs Coverity Static

Compared 7% of the time

CodeSonar vs Coverity Static

Compared 6% of the time

Polyspace Code Prover vs Coverity Static

Compared 5% of the time

GitHub Code Scanning vs Coverity Static

Compared 4% of the time

More Coverity Static Competitors

SonarQube vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

OWASP Zap vs Veracode

Compared 3% of the time

Mend.io vs Veracode

Compared 2% of the time

More Veracode Competitors

Product Reports

Checkmarx One

Download Checkmarx One product report

Coverity Static

Download Coverity Static product report

Download Veracode product report

March 2026

Also Known As

No data available

Synopsys Static Analysis

Crashtest Security , Veracode Detect

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Coverity gives you the speed, ease of use, accuracy, industry standards compliance, and scalability that you need to develop high-quality, secure applications. Coverity identifies critical software quality defects and security vulnerabilities in code as it’s written, early in the development process, when it’s least costly and easiest to fix. With the Code Sight integrated development environment (IDE) plugin, developers get accurate analysis in seconds in their IDE as they code. Precise actionable remediation advice and context-specific eLearning help your developers understand how to fix their prioritized issues quickly, without having to become security experts.

Coverity seamlessly integrates automated security testing into your CI/CD pipelines and supports your existing development tools and workflows. Choose where and how to do your development: on-premises or in the cloud with the Polaris Software Integrity Platform (SaaS), a highly scalable, cloud-based application security platform. Coverity supports more than 20 languages and 200 frameworks and templates.

Black Duck

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

SAP, Mega International, Thales Alenia Space

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Static Application Security Testing (SAST)