Checkmarx One vs Fortify Application Defender vs SonarQube comparison

Checkmarx and OpenText are both solutions in the Application Security Tools category. Checkmarx is ranked #2 with an average rating of 8.2, while OpenText is ranked #24 with an average rating of 8.0. Checkmarx holds a 9.9% mindshare in AS, compared to OpenText’s 1.2% mindshare. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 81% of OpenText users who would recommend it.

Checkmarx One

Read 81 Checkmarx One reviews

18,784 Views
13,524 Comparison Views

88% willing to recommend

Fortify Application Defender

Read 11 Fortify Application Defender reviews

1,665 Views
1,382 Comparison Views

81% willing to recommend

SonarQube

Read 135 SonarQube reviews

37,820 Views
26,474 Comparison Views

84% willing to recommend

Checkmarx One

Fortify Application Defender

SonarQube

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, Fortify Application Defender, and SonarQube based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: February 2026).

Buyer's Guide

Application Security Tools

February 2026

Download the complete report

Helped 885,444 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2026, in the Application Security Tools category, the mindshare of Checkmarx One is 9.9%, down from 11.0% compared to the previous year. The mindshare of Fortify Application Defender is 1.2%, up from 0.6% compared to the previous year. The mindshare of SonarQube is 16.3%, down from 26.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
SonarQube	16.3%
Checkmarx One	9.9%
Fortify Application Defender	1.2%
Other	72.6%

Application Security Tools

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

VinothSivam

CTO at Abcl

Useful for fast code review in devOps pipelines

I rate the tool's scalability a seven out of ten. However, I'm concerned about how it handles an increasing number of lines of code. As the complexity grows, so does the time it takes for the tool to review everything. I want more clarity on how Fortify Application Defender handles multiple threats. We have numerous endpoints, but the tool runs in our pipeline, meaning it operates in the cloud. All our code is configured there, and the tool runs integration testing, unit testing, user testing, and final production code tests. It's a day-to-day experience. It's utilized almost every day as part of our pipeline runs. Each team responsible for integration testing, human testing, user access testing, and preproduction testing runs it whenever they take a build.

Read full review

KarthikHarpanhalli

Sr Software Engineering Supervisor at Mozarc Medical

Gains control over rule customization and achieves reliable vulnerability assessment

The deployment process took me about 2 or 3 hours to deploy SonarQube Server (formerly SonarQube), although I do not remember exactly since it was done about 2 years back. Currently, about 10 of my developers are using SonarQube Server (formerly SonarQube) in my company. I do not have plans to increase the usage of SonarQube Server (formerly SonarQube) in the future as there will not be any requirement to increase. I am a senior software engineer and supervisor at Mozark Medical. My corporate email address is karthik.k.a.r.t.h.i.k.h.a.r.p.a.n.h.a.l.l.i@mozarkmedical.com. Overall, I would rate SonarQube Server (formerly SonarQube) as a 9 out of 10.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."

"We have used this product to verify the dev department's code in order to minimize security holes."

"The user interface is modern and nice to use."

"One of the most valuable features is it is flexible."

"Even if there are multiple vulnerabilities in the source coding, Checkmarx is able to identify which lines need to be corrected and then proceeds to automatically remediate the situation."

"The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process."

"In summary, this is a good application that you can use to scan every code language."

"It can integrate very well with DAST solutions. So both of them are combined into an integrated solution for customers running application security."

More Checkmarx One pros

"This is a great tool and the kind of support it provides is very helpful."

"The information from Fortify Application Defender on how to fix and solve issues is very good compared to other solutions."

"The most valuable feature is the ability to automatically feed it rules what it's coupled with the WebInspect dynamic application scanning technology."

"We are able to provide out customers with a secure application after development. They are no longer left wondering if they are vulnerable to different threats within the market following deployment."

"Fortify Application Defender's most valuable features are machine learning algorithms, real-time remediation, and automatic vulnerability notifications."

"The tool's most valuable feature is software composition analysis. This feature works well with my .NET applications, providing a better understanding of library vulnerabilities."

"Its ability to find security defects is valuable."

More Fortify Application Defender pros

"Stability has never been a problem."

"Using SonarQube has helped us to identify areas of technical debt to work on, resulting in better code, fewer vulnerabilities, and fewer bugs."

"Before you even compile, it can catch known vulnerability issues or patterns."

"SonarQube is good for checking and maintaining code quality."

"This product is leading its class in the open-source community."

"The reports from SonarCloud are very good."

"The stability is good."

"Apart from the security point of view, I like that it makes it easy to detect code smells and other issues in terms of code quality and standards."

More SonarQube pros

Cons

"This product requires you to create your own rulesets. You have to do a lot of customization."

"We can run only one project at a time."

"I really would like to integrate it as a service along with the SAP HANA Cloud Platform. It will then be easy to use it directly as a service."

"It would be really helpful if the level of confidence was included, with respect to identified issues."

"When we have many applications to check, I need to wait a long time in the queue."

"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

"With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too."

"The cost per user is high and should be reduced."

More Checkmarx One cons

"The false positive rate should be lower."

"Fortify Application Defender could improve by supporting more code languages, such as GRAAS and Groovy."

"The biggest complaint that I have heard concerns additional platform support because right now, it only supports applications that are written in .NET and Java."

"The licensing can be a little complex."

"I encountered many false positives for Python applications."

"The biggest complaint that I have heard concerns additional platform support because right now, it only supports applications that are written in .NET and Java."

"Fortify Application Defender gives a lot of false positives."

"Fortify Application Defender could improve by supporting more code languages, such as GRAAS and Groovy."

More Fortify Application Defender cons

"In terms of what can be improved, the areas that need more attention in the solution are its architecture and development."

"If the product could assist us with fixing issues by giving us more pointers then it would help to resolve more of the warnings without such a commitment in terms of time."

"SonarCloud can improve the false positives. Sometimes the gates sometimes act a little weird, and we then need to manually go and mark the false positive."

"In discussions with the security team, there are many other products that are available that perform better."

"The UI can be improved."

"This solution finds issues that are similar to what is found by Checkmarx, and it would be nice if the overlap could be eliminated."

"There is no automation. You need to put the code there and test."

"Predefined rules/overriding rules caused some issues."

More SonarQube cons

Pricing and Cost Advice

"The solution is costly."

"The number of users and coverage for languages will have an impact on the cost of the license."

"For around 250 users or committers, the cost is approximately $500,000."

"The interface used to create custom rules comes at an additional cost."

"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."

"The pricing was not very good. This is just a framework which shouldn’t cost so much."

"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."

"We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."

More Checkmarx One pricing and cost advice

"The base licensing costs for the SaaS platform is about $900 USD per application, per year."

"Fortify Application Defender is very expensive."

"The price of this solution could be less expensive."

"I rate the solution's pricing a five out of ten. It comes as an annual cloud subscription. The tool's pricing is around 50 lakhs."

"The product’s price is much higher than other tools."

"The licensing is very complex, it's project based and can range from $10,000 to $200,000+ depending on the project type and size."

"SonarQube enterprise, I am not sure of the price but from what I understand they are charging a fee. It's is not clear if it is an annual fee or a one-off."

"We use the free version; there are no hidden costs or licensing required."

"The costs for this application, for the kind of job it does, are pretty decent."

"The beauty of this solution is the free open-source version is capable enough in doing pretty much what an enterprise-level version can do."

"The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable."

"We're using the Community Edition, and we don't pay for anything."

"Some of the plugins that were previously free are not free now."

"The price point on SonarQube is good."

More SonarQube pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

885,444 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Manufacturing Company

10%

Computer Software Company

Government

Financial Services Firm

16%

Manufacturing Company

10%

Construction Company

Computer Software Company

No data available

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	3
Midsize Enterprise	1
Large Enterprise	8

By reviewers
Company Size	Count
Small Business	42
Midsize Enterprise	24
Large Enterprise	79

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

See all answers

What needs improvement with Checkmarx?

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If i...

See all answers

What do you like most about Fortify Application Defender?

I find the configuration of rules in Fortify Application Defender useful. Its integration is also easy.

See all answers

What needs improvement with Fortify Application Defender?

The product should integrate industry-standard code review tools internally with its system. This would streamline th...

See all answers

What is your primary use case for Fortify Application Defender?

We use the solution for fast code review. It is integrated into our DevOps pipeline.

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which ...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and securi...

See all answers

Comparisons

Veracode vs Checkmarx One

Compared 4% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

TrendAI Vision One – Cloud Security vs Checkmarx One

Compared 1% of the time

More Checkmarx One Competitors

Veracode vs Fortify Application Defender

Compared 6% of the time

Klocwork vs Fortify Application Defender

Compared 5% of the time

GitGuardian Platform vs Fortify Application Defender

Compared 4% of the time

GitHub Advanced Security vs Fortify Application Defender

Compared 4% of the time

Sonatype Lifecycle vs Fortify Application Defender

Compared 4% of the time

More Fortify Application Defender Competitors

Snyk vs SonarQube

Compared 9% of the time

GitHub Advanced Security vs SonarQube

Compared 4% of the time

Coverity Static vs SonarQube

Compared 4% of the time

OpenText Core Application Security vs SonarQube

Compared 4% of the time

Semgrep vs SonarQube

Compared 3% of the time

More SonarQube Competitors

Product Reports

Buyer's Guide

Checkmarx One

March 2026

Download Checkmarx One product report

Buyer's Guide

Application Security Tools

February 2026

Download Fortify Application Defender product report

Buyer's Guide

SonarQube

March 2026

Download SonarQube product report

Also Known As

No data available

HPE Fortify Application Defender, Micro Focus Fortify Application Defender

Sonar, SonarQube Cloud

Interactive Demo

Demo not available

Checkmarx

Demo not available

OpenText

SonarSource Sàrl

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Micro Focus Security Fortify Application Defender is a runtime application self-protection (RASP) solution that helps you manage and mitigate risk from homegrown or third-party applications. It provides centralized visibility into application use and abuse while protecting from software vulnerability exploits and other violations in real time.

OpenText

SonarQube leads automated code review, enhancing code quality and security in AI-driven SDLCs. It analyzes pull requests, providing developers with actionable feedback and AI-driven fixes before code merges. Trusted by top enterprises, it supports SaaS and self-managed deployments.

SonarQube supports a wide range of programming languages and integrates seamlessly with CI/CD tools like Jenkins. It is renowned for its static code analysis, code coverage, and security vulnerability detection. While its open-source foundation and scalability are praised, users seek enhanced integration across multiple languages, better security features, and improved documentation. Despite challenges, its ability to automate code inspections and ensure compliance with coding standards makes it essential in software development processes, facilitating continuous improvement.

What are the most important features?

Language Support: Extensive support for multiple programming languages.
Custom Coding Rules: Allows defining project-specific rules.
Integration: Seamlessly works with Jenkins and CI/CD pipelines.
Quality Gates: Simplifies monitoring code quality.
Dashboards: Facilitates easy monitoring and management.
Static Code Analysis: Detects issues early in development.
Security Detection: Identifies vulnerabilities automatically.

What benefits should users look for?

Improved Code Quality: Enhances reliability and maintainability.
Security Assurance: Strengthens code against vulnerabilities.
Technical Debt Reduction: Ensures cleaner, maintainable code.
Efficient Feedback: Speeds up development cycles.
Standards Compliance: Aids in adhering to best practices.

In industries like finance, healthcare, and automotive, SonarQube is leveraged for static code analysis, automating code inspections, and ensuring compliance with stringent standards. Teams integrate it into their CI/CD pipelines to maintain high-quality code, identify security vulnerabilities, and enhance code maintainability.

SonarSource Sàrl

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

ServiceMaster, Saltworks, SAP

Snowflake, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company.

Buyer's Guide

Application Security Tools

February 2026

Download Free Report

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: February 2026.

DOWNLOAD NOW

885,444 professionals have used our research since 2012.