Checkmarx One vs ExtraHop Reveal(x) 360 comparison

Checkmarx and ExtraHop Networks are both solutions in the Container Security category. Checkmarx is ranked #14 with an average rating of 8.3, while ExtraHop Networks is ranked #34 with an average rating of 8.5. Checkmarx holds a 3.0% mindshare in Container Security, compared to ExtraHop Networks’s 0.5% mindshare. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 100% of ExtraHop Networks users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One and ExtraHop Reveal(x) 360 based on real PeerSpot user reviews.

Find out in this report how the two Container Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Checkmarx One vs. ExtraHop Reveal(x) 360 Report (Updated: August 2026).

Buyer's Guide

Checkmarx One vs. ExtraHop Reveal(x) 360

August 2026

Download the complete report

Helped 909,725 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Qualys TotalCloud

Mindshare comparison

As of August 2026, in the Container Security category, the mindshare of Qualys TotalCloud is 1.6%, up from 1.0% compared to the previous year. The mindshare of Checkmarx One is 3.0%, up from 2.2% compared to the previous year. The mindshare of ExtraHop Reveal(x) 360 is 0.5%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Container Security Mindshare Distribution
Product	Mindshare (%)
Qualys TotalCloud	1.6%
Checkmarx One	3.0%
ExtraHop Reveal(x) 360	0.5%
Other	94.9%

Container Security

Featured Reviews

Robert Orłowski

IT Security Expert at Alior Bank S.A.

Unified risk scoring has improved our cloud visibility and simplifies remediation priorities

Qualys TotalCloud provides unified vulnerability and threat assessment across both IAS and SaaS. This solution provides a single prioritized view of risk, which helps reduce the work I would have to do. We are no longer based on CVSS; we are based on Qualys risk scoring, which is based on CVSS plus internal findings made by Qualys, and then assigns its own score. The TruRisk insight feature has found a small number of assets with high vulnerability scores, though I am cautious since some information is classified. Qualys TotalCloud has positively impacted our bank's performance, and we have definitely seen benefits after implementing this solution.

Read full review

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

reviewer2857197

Lead IT Service Analyst at a manufacturing company with 10,001+ employees

Cloud-native threat detection has improved incident investigations and now reduces breach risk

We have covered most of the features over the past three years and look forward to discovering more as we work closely with the ExtraHop technical team, who are open to sharing what they have developed. Pricing is on the higher side, typically based on load, volume of traffic, and deployment scale. The advanced detection capabilities provide significant value in reducing investigation time, making the licensing and pricing acceptable for larger organizations. ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments. ExtraHop Reveal(x) 360's SaaS environment is well-suited for cloud, on-premises, and hybrid environments, effectively addressing real-life scenarios involving east-west and north-south traffic. The platform is recommended for large organizations in need of comprehensive detection capabilities. I would rate this product overall as an 8 out of 10.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Qualys TotalCloud's most valuable feature is its agent versatility."

"Qualys TotalCloud has improved our security posture."

"Qualys TotalCloud has significantly reduced our workload in terms of managing risks, helping us to be more efficient and save substantial resources."

"Qualys TotalCloud's most valuable feature is its ability to link clusters of assets, providing a clear model of deployments, vulnerabilities, and statuses."

"One of Qualys' best features is its categorization, which allows us to see the types of assets, their security postures, and the AI-powered version of the tool."

"I like the web API security and IoT scanning features the most. The user-friendly design of TotalCloud's interface enables customers to navigate it and use its full potential easily"

"The best part I like is the on-demand scans."

"The best feature would be the ability to create policies. It is easy to control and update policies as required."

More Qualys TotalCloud pros

"It has all the features we need."

"The only thing I like is that Checkmarx does not need to compile."

"The license is fairly costly but worth the investment."

"It is very easy to insert the tool in the SDLC because there are a wide variety of ways to access the source-code, initiate scans, and review the results."

"It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx."

"The consistency of code showed our team where they are inconsistent or where they have made simple omissions."

"Checkmarx is probably one of the best static code analyzers available in the market at this point."

"The main thing we find valuable about Checkmarx is the ease of use, as it's easy to initiate scans and triage defects."

More Checkmarx One pros

"Their technical support is more effective and of better quality than other competitors."

"It is scalable."

"ExtraHop Reveal(x) 360 has undeniably improved our security posture, reduced manual investigation efforts, and facilitated fast threat detection mechanisms, which all help prevent costly potential breaches in enterprise environments."

"ExtraHop Reveal(x) 360 has positively impacted my organization by helping us detect abnormal activity on our network that we could not detect through our SIEM or XDR platform."

"It stands out for its intuitive and efficient user interface, robust detection capabilities with minimal false positives, and the ability to handle encrypted traffic, making it a valuable asset for network security and management."

"It is very easy to collect and handle data in ExtraHop Reveal(X) Cloud. Integration with Big Data is also easy. Many of our customers integrate it with Big Data platforms like Splunk or Elastic. It is also easy to handle and easy to understand."

Cons

"We encountered challenges identifying the correct resource category for certain items, such as those in containers or storage."

"Qualys TotalCloud needs to enhance its scanning capabilities in the IP domain, as it currently lacks the functionality to resolve IPs to their corresponding domain names."

"There should be improvement from a dashboard perspective when collecting and showcasing data to lead management."

"The vulnerability part is good, but the policy compliance module needs improvement because it involves a lot of manual work. Specifically, the remediation part of the controls requires enhancements."

"The response part of the Cloud Detection and Response (CDR) module can be improved."

"Regarding technical support from Qualys, they respond, but the response time can be too long. Sometimes we need to wait weeks for solutions to simple questions."

"TotalCloud could improve the classification of vulnerabilities. Specifically, it could enhance the categorization of what aspects fall under patches resolved by OS or software updates and what pertains to configuration adjustments."

"Enhancing clarity regarding its compliance capabilities would be beneficial, as the current scope is limited in geographic coverage."

More Qualys TotalCloud cons

"The pricing can get a bit expensive, depending on the company's size."

"I would like to see the rate of false positives reduced."

"It could be improved with more reporting of false positives and the understanding of file references."

"From an administrative standpoint, I would rate Checkmarx with a five out of ten."

"It takes around 30 to 40 minutes for checking a build. If you can make it within five minutes or 10 minutes, that would be great."

"The tool is currently quite static in terms of finding security vulnerabilities. It would be great if it was more dynamic and we had even more tools at our disposal to keep us safe. It would help if there was more scanning or if the process was more automated."

"Their licensing fees are rigid and this causes two main issues. One is a restriction in terms of scaling the product at an enterprise level."

"Checkmarx has a slightly difficult compilation with the CI/CD pipeline."

More Checkmarx One cons

"There needs to be more support."

"One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace."

"They can include integration with SAP. Currently, no vendor provides network performance monitoring in the SAP market. It is a very big market. We have around 400 customers for SAP in Korea. In the USA, there are more than 10,000 customers."

"Their professional service can be improved."

"I would like to see ExtraHop Reveal(x) 360 improved by integrating XDR features with NDR."

"A drawback includes bucket storage limitations for payload data, necessitating timely extraction for thorough investigations."

Pricing and Cost Advice

"As a middle management member, I do not have direct pricing knowledge, but based on the knowledge from our meetings, its pricing is competitive."

"Qualys TotalCloud offers good pricing that is affordable and competitive with the market. Our partnership also provides us with additional benefits."

"I am not sure about the pricing. From what I understand, it is a bit on the higher side, but I do not have the exact numbers."

"Qualys TotalCloud is expensive."

"Qualys TotalCloud is cost-efficient and was selected for its value compared to other products."

"Qualys TotalCloud is expensive, but it offers a premier solution with no headaches."

"The pricing for TotalCloud is attractive and competitive in the market. Given the features, especially the dashboard, I have no concerns regarding pricing."

"While Qualys TotalCloud's pricing is currently acceptable, it is becoming increasingly expensive and may soon be considered overpriced."

More Qualys TotalCloud pricing and cost advice

"Checkmarx is not a cheap scanning tool, but none of the security tools are cheap. Checkmarx is a powerful scanning tool, and it’s essential to have one of these products."

"The solution is costly."

"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."

"Be cautious of the one-year subscription date. Once it expires, your price will go up."

"It is an expensive solution."

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"For around 250 users or committers, the cost is approximately $500,000."

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

More Checkmarx One pricing and cost advice

"When compared to other solutions, it aligns with the market average, indicating a competitive pricing level."

See which vendors are best for you

Use our free recommendation engine to learn which Container Security solutions are best for your needs.

See recommendations

909,725 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

13%

Comms Service Provider

11%

Outsourcing Company

11%

Financial Services Firm

10%

Financial Services Firm

16%

Manufacturing Company

Computer Software Company

Outsourcing Company

Financial Services Firm

11%

Construction Company

Manufacturing Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	12
Midsize Enterprise	5
Large Enterprise	31

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

No data available

Questions from the Community

What is your experience regarding pricing and costs for Qualys TotalCloud?

The price is very expensive, actually.

See all answers

What needs improvement with Qualys TotalCloud?

To be totally honest, I do not have any best features because I have had a bad experience using this tool, especially...

See all answers

What is your primary use case for Qualys TotalCloud?

My main use case for Qualys TotalCloud is vulnerability management and exposure management. I use this tool to evalua...

See all answers

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed Ap...

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

See all answers

What needs improvement with ExtraHop Reveal(x) 360?

One challenge with ExtraHop Reveal(x) 360 is its pricing, which tends to be comparatively high in the marketplace. In...

See all answers

What advice do you have for others considering ExtraHop Reveal(x) 360?

We have covered most of the features over the past three years and look forward to discovering more as we work closel...

See all answers

What is your primary use case for ExtraHop Reveal(X) Cloud?

I use ExtraHop Reveal(x) 360 as our cloud-native NDR platform, with primary use cases including monitoring real-time ...

See all answers

Comparisons

Wiz vs Qualys TotalCloud

Compared 10% of the time

Microsoft Defender for Cloud vs Qualys TotalCloud

Compared 8% of the time

JupiterOne vs Qualys TotalCloud

Compared 6% of the time

Prisma Cloud by Palo Alto Networks vs Qualys TotalCloud

Compared 6% of the time

AWS Security Hub vs Qualys TotalCloud

Compared 5% of the time

More Qualys TotalCloud Competitors

SonarQube vs Checkmarx One

Compared 25% of the time

Veracode vs Checkmarx One

Compared 3% of the time

Checkmarx SAST vs Checkmarx One

Compared 2% of the time

Snyk vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

Vectra AI vs ExtraHop Reveal(x) 360

Compared 12% of the time

NetWitness NDR vs ExtraHop Reveal(x) 360

Compared 9% of the time

ExtraHop Reveal(x) vs ExtraHop Reveal(x) 360

Compared 6% of the time

Fortinet FortiGate vs ExtraHop Reveal(x) 360

Compared 6% of the time

TrendAI Vision One – Cloud Security vs ExtraHop Reveal(x) 360

Compared 6% of the time

More ExtraHop Reveal(x) 360 Competitors

Product Reports

Buyer's Guide

Qualys TotalCloud

August 2026

Download Qualys TotalCloud product report

Buyer's Guide

Checkmarx One

August 2026

Download Checkmarx One product report

Buyer's Guide

ExtraHop Reveal(x) 360

August 2026

Download ExtraHop Reveal(x) 360 product report

Also Known As

Qualys TotalCloud with FlexScan

No data available

ExtraHop Reveal(X) Cloud, Reveal(X) Cloud

Overview

Qualys TotalCloud enhances security posture across cloud environments with continuous monitoring, vulnerability management, and risk visualization, ensuring efficient threat assessment and automated remediation for improved cyber risk reduction.

Qualys TotalCloud offers a robust suite of security tools essential for organizations managing multi-cloud infrastructures. By integrating cloud accounts and automating workflows, it supports AWS, Azure, and GCP, offering comprehensive vulnerability management and zero-day detection. The platform's user-friendly design, combined with its extensive risk management and unified threat assessment capabilities, enables organizations to prioritize and remediate vulnerabilities effectively. TruRisk Insights provides clear insights on cyber risks, while the automation options streamline patch management and scanning processes. API integration across IaaS and SaaS environments further enhances resource allocation efficiency and saves time, addressing misconfigurations across cloud environments.

What are the most important features of Qualys TotalCloud?

Accurate Vulnerability Reports: Delivers precise and actionable insights for risk mitigation.
Zero-Day Detection: Identifies and addresses zero-day vulnerabilities proactively.
Unified Threat Assessment: Offers comprehensive evaluation of threats across the environment.
Extensive Risk Management: Manages risks effectively with advanced insights and prioritization.
Continuous Monitoring: Provides non-stop surveillance for vulnerabilities and threats.
Cloud-Native Automation: Streamlines processes and reduces manual efforts using automation.
FlexScan for Internet-Facing VMs: Scans external VMs efficiently to detect vulnerabilities.
Dashboard Risk Visualization: Clear visualization helps prioritize vulnerabilities.

What benefits and ROI should users look for?

Improved Security Posture: Enhances threat detection and response across clouds.
Time Savings: Automation reduces time spent on manual vulnerability management.
Resource Efficiency: Better allocation of resources through streamlined workflows.
Enhanced Risk Prioritization: Focus on critical vulnerabilities for effective mitigation.
Integrated Cloud Accounts: Facilitates seamless cloud management and security.

Qualys TotalCloud is deployed in sectors needing rigorous vulnerability management, such as finance and healthcare. Companies utilize it to secure multi-cloud environments like AWS, Azure, and GCP, focus on compliance, and integrate security into CI/CD pipelines to detect and remedy threats pre-deployment.

Qualys

Checkmarx One delivers robust security through seamless integration with SCM and CI/CD tools, ensuring reliable SAST and SCA. Primarily used by organizations for vulnerability detection, it supports cloud and on-premises deployment to enhance secure coding practices.

Checkmarx One provides organizations with comprehensive tools for secure software development, integrating effectively with CI/CD pipelines to scan thousands of applications. Its capabilities extend to identifying vulnerabilities in both code bases and third-party software. Enhancing workflow by supporting SCM solutions, it assists in maintaining secure coding standards and compliance. While excelling in various areas, it requires improvements in scan speed, reduction of false positives, and broader platform integration, particularly for COBOL and Swift. Its pricing model is noted as high, and demand exists for better tutorials and documentation.

What are the key features of Checkmarx One?

Comprehensive Integration: Seamlessly connects with SCM, CI/CD tools to streamline security workflows.
Accurate SAST and SCA: Precisely identifies vulnerabilities down to the exact line of code.
Custom Rules Configuration: Allows tailored security measures to match specific needs.
Quick Scanning: Provides fast analysis to speed up the development process.
Automated Code Remediation: Helps in efficiently fixing code vulnerabilities.

What benefits should users expect in reviews?

Improved Security: Enhances code safety, reducing vulnerabilities efficiently.
Effective False Positivity Management: Optimizes time spent on genuine issues.
Enhanced Development Processes: Integrates smoothly to boost secure coding initiatives.
Comprehensive Language Support: Facilitates scanning in multiple programming languages, accommodating diverse needs.

Industries implement Checkmarx One for secure coding compliance and vulnerability management across varying environments, choosing between cloud and on-premises deployment based on requirements. Its extensive language support and integration with DevSecOps practices make it a popular choice for organizations aiming to enhance software security.

Checkmarx

ExtraHop Reveal(x) 360 offers advanced network detection and response capabilities, designed to provide real-time situational awareness and threat detection across hybrid and multi-cloud environments.

Built to meet the demands of modern enterprises, ExtraHop Reveal(x) 360 enhances visibility into network activities, delivering comprehensive security insights. It uses high-speed data analysis to identify anomalous behaviors and potential threats, helping security teams respond effectively. With centralized visibility, it ensures quick detection and thorough investigation of threats within complex infrastructures, including cloud, edge, and on-premises environments.

What key features does ExtraHop Reveal(x) 360 offer?

Real-Time Threat Detection: Monitors network traffic in real-time for immediate threat identification.
Centralized Visibility: Offers a unified dashboard for observing activities across diverse environments.
Automated Response: Enables predefined actions to mitigate threats swiftly without manual intervention.
Integration Capabilities: Seamlessly integrates with tools for enhanced incident management.
Advanced Analytics: Utilizes machine learning to detect sophisticated threats promptly.

What benefits should users look for in reviews of ExtraHop Reveal(x) 360?

Improved Security Posture: Evidence of enhanced organizational security through faster threat detection and response.
Operational Efficiency: Reduction in time and effort for IT teams due to automated processes.
Scalability: Flexibility to expand with organizational growth and technology changes.
Cost-Effectiveness: Attractive pricing compared to functionality and outcomes offered.

ExtraHop Reveal(x) 360 is implemented across industries such as financial services, healthcare, and retail, where robust security measures are paramount. In these sectors, the capabilities of ExtraHop Reveal(x) 360 align with the need for secure handling of sensitive data and compliance with industry regulations, providing valuable protection and detection capabilities.

ExtraHop Networks

Sample Customers

Information Not Available

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Wizards of the Coast

Buyer's Guide

Checkmarx One vs. ExtraHop Reveal(x) 360

August 2026

Free Report: Checkmarx One vs. ExtraHop Reveal(x) 360

Find out what your peers are saying about Checkmarx One vs. ExtraHop Reveal(x) 360 and other solutions. Updated: August 2026.

DOWNLOAD NOW

909,725 professionals have used our research since 2012.

See our Checkmarx One vs. ExtraHop Reveal(x) 360 report.

See our list of best Container Security vendors.

We monitor all Container Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.