Checkmarx One vs Fortify Software Security Center vs Veracode comparison

Fortify Software Security C...

Read 208 Veracode reviews

19,227 Views
11,921 Comparison Views

89% willing to recommend

Checkmarx One

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, Fortify Software Security Center, and Veracode based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Veracode, Checkmarx and others in Static Application Security Testing (SAST).

To learn more, read our detailed Static Application Security Testing (SAST) Report (Updated: March 2026).

Static Application Security Testing (SAST)

Download the complete report

Helped 885,728 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2026, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx One is 10.4%, down from 11.2% compared to the previous year. The mindshare of Fortify Software Security Center is 1.3%, up from 0.4% compared to the previous year. The mindshare of Veracode is 4.8%, down from 10.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Mindshare Distribution
Product	Mindshare (%)
Veracode	4.8%
Checkmarx One	10.4%
Fortify Software Security Center	1.3%
Other	83.5%

Static Application Security Testing (SAST)

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

Diego Caicedo Lescano

Chief Innovation Officer at SAGGA

Enables centralized analysis and improves governance through seamless tool integration

The main use case for Fortify Software Security Center is exceptional because we have governance and control through that console. You can centralize both static analysis and dynamic analysis, and correlate both analyses in one tool to get better results by combining those independent results from each solution. That is outstanding, and there is no tool I have seen on the market that offers these capabilities. I appreciate the interoperability with other solutions from Fortify Software Security Center. Because we are using Kiuwan, you can run Kiuwan analyses and integrate them with Fortify Software Security Center to get those results in a single console. That is a good console for centralizing things in one point. That is one of the best features of the on-premises Fortify.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable features of Checkmarx are the automation and information that it provides in the reports."

"As an InfoSec consulting company, we come across major challenging projects, and Checkmarx has made life easy by reducing manual efforts in using test cases against any vulnerability found during source code reviews while intelligently finding the latest vulnerabilities beyond the OWASP Top Ten."

"It is a stable product."

"Vulnerability details is valuable."

"Overall, I use Checkmarx One as a strategic control point to improve developer velocity while strengthening application security across the full software lifecycle."

"We use the solution to validate the source code and do SAST and security analysis."

"The ability to track the vulnerabilities inside the code (origin and destination of weak variables or functions)."

"In my opinion, Checkmarx gives better results, and its protection is better than SonarQube."

More Checkmarx One pros

"It's very important because they want to scan their source code every day, so we provide CICD integration to our customers so they can auto build and auto test every day, get reports, and fix issues."

"I like the explanation of issues provided by Fortify Software Security Center."

"This is a stable solution at the end of the day."

"You can easily download the tool's rule packs and update them."

"This is a stable solution at the end of the day."

"The main use case for Fortify Software Security Center is exceptional because we have governance and control through that console."

"Software Security Center is highly customizable and helps me test all vulnerability data against the latest conventions like OWASP Top Ten, CVE Top twenty-five, and several other legal compliances."

More Fortify Software Security Center pros

"That it is a cloud-based solution is very valuable to us. We don't need that hardware running our scans and hosting the environment to be scanned. Also, the technology, the static scanning versus dynamic scanning produces a much better result, a more accurate result."

"We have had customers - and it has been our own experience as well - tell us that the support is second to none, as they are very quick to respond and very quick to answer questions in a really knowledgeable way."

"In my experience, Veracode is one of the most powerful tools available in the market from a security perspective. It is a market leader in source code analysis."

"It has given our management a view into issues with all of our product lines. We have three products and all of them were scanned. As a result, the project lead for each product has taken measures to improve things."

"It is great to have such insight into code without having to upload the source code at all. It saves a lot of NDA paperwork. The Visual Studio plugin allows the developer to seamlessly upload the code and get results as he works, with no manual upload. The code review function is great. It allows you to find flaws in source code."

"I like the sandbox, the ability to upload compiled code, and how easy it is."

"Veracode has good support for microservices, and I also like the sandbox environment. For example, when introducing a new component, we can scan it in a sandbox environment. It will not impact the main environment. When our team fixes it, they. can push it to the production environment when the results are acceptable."

"The pricing is worth it."

More Veracode pros

Cons

"I would like to see the rate of false positives reduced."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"The integration could improve by including, for example, DevSecOps."

"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."

"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."

"The interactive application security testing, or IAST, where code scans are being ran on an application that lives in a runtime environment on a server or virtual machine, needs improvement."

"We felt like we were the extended quality organization for Checkmarx as they frequently released poor quality patches that broke the existing functionality."

"Dynamic testing. If it had that feature I would have liked to see more consideration of framework validations that we don't have to duplicate. These flags are false positives."

More Checkmarx One cons

"The support for Fortify on-premises is the same as for the other products. I would say the support is not good and I would rate it a three out of ten."

"Improvements needed for Software Security Center include better aggregation views of datasets."

"We are having issues with false positives that need to be resolved."

"Improvements needed for Software Security Center include better aggregation views of datasets."

"The product's overlap feature is restrictive and requires more customization efforts, which can be expensive."

"I am not satisfied with the percentage of false positives, which is around eighteen percent."

"The initial setup of this solution is very complex. Specifically, the integration between other parts of the solution is difficult."

"We are having issues with false positives that need to be resolved."

More Fortify Software Security Center cons

"If Veracode was more diversified, as far as the number of platforms and the number of applications it could do in our favor, we would be using it even more. But there are a number of platforms it doesn't support. For example, I know they support C+, .NET, and Java, but there are certain platforms they don't support and that was disappointing."

"The Web portal, at times, is not necessarily intuitive. I can get around when I want to but there are times when I have to email my account manager on: "Hey, where do I find this report?" Or "How do I do this?" They always respond with, "Here's how you do it." But that points to a somewhat non-intuitive portal."

"The only issue that we have is uploading the code, the process of actually uploading and getting our results back; all of that is a little cumbersome."

"A high number of false positives are reported and this should be reduced."

"I noticed there is no integration with Bamboo."

"Veracode's ability to fix flaws is less sophisticated than that of its competitors."

"A high number of false positives are reported and this should be reduced."

"False positives are a problem. Sometimes the flow paths are not accurate and don't represent real attack vectors, but this happens with every application that performs static analysis of the code. But it's under control. The number of false positives is not so high that it is unmanageable on our side."

More Veracode cons

Pricing and Cost Advice

"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."

"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

"The tool's pricing is fine."

"It's relatively expensive."

"The solution's price is high and you pay based on the number of users."

More Checkmarx One pricing and cost advice

"As a Fortify partner company providing technical support, I find the product expensive in our country, where local, inexpensive products are available."

"The solution is priced fair."

"This is a costly solution that could be cheaper."

"I wouldn't really recommend Veracode for a small firm, because it might be a little pricey for them. But for a large organization, with more than 1,000 applications in the enterprise, there are tiered levels of pricing."

"It's too expensive for the European market. That is why, in a big bank with 400 applications, we are able to use it only for 10 of them. But the other solutions are also expensive, so it wasn't a differentiator."

"Its cost for what we needed it for was too high. It wasn't too high for other companies and it was competitively priced, but for us, it just didn't fit. We did plan to use it and increase the usage. In the end, it may have been abandoned because of the cost, but I'm not a hundred percent sure. So, even though we had planned on using it more and more, because of the cost and the business conditions of things, we didn't have the opportunity to really use it more."

"Veracode's pricing is on the higher end, but it is acceptable."

"I don't really get too involved in the cost sides of things that's in my job, I'm more of a technical focus, but I have heard from my manager and a couple other people that the solution is quite expensive."

"Negotiate some, but their prices are reasonable."

"I don't have firsthand knowledge of Veracode pricing, but based on client feedback, it seems to be expensive with additional fees for certain features."

"We're very comfortable with their model. We think they're a good value. We worked very closely with Veracode on understanding their license model, understanding what comprises the fee and what does not. With their assistance in design, we decomposed our application in a way where we are scanning a very significant amount of code without wasting their capacity and generating redundant reported issues. You scan in profiles, per se. And we work with them, in their offices, to design the most effective approach. So the advice I would have for customers is, you can get up and live fast, but work closely with Veracode to refine the method you use for scanning and the way you compile the applications. There's a concept called entry-point scanning, and that's probably not used well by the rest of their customers. We see our licensing as a good value because we leverage it heavily."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

885,728 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Manufacturing Company

10%

Computer Software Company

Government

Manufacturing Company

15%

Financial Services Firm

11%

Government

Construction Company

Financial Services Firm

15%

Computer Software Company

12%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	4
Midsize Enterprise	1
Large Enterprise	3

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	45
Large Enterprise	114

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

What needs improvement with Checkmarx?

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If i...

What is your experience regarding pricing and costs for Micro Focus Software Security Center?

The pricing for the on-premises Fortify is expensive.

What needs improvement with Micro Focus Software Security Center?

In my opinion, there are no areas that could be improved with Fortify Software Security Center. I would say it is a g...

What is your primary use case for Micro Focus Software Security Center?

We have installed Fortify Static Code Analysis, SAST, in Ecuador in two customers. The Fortify ScanCentral includes t...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

SonarQube vs Checkmarx One

Comparisons

Compared 42% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

OWASP Zap vs Checkmarx One

Compared 2% of the time

Snyk vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

Checkmarx IaC Security / KICS vs Fortify Software Security Center

Compared 13% of the time

SonarQube vs Fortify Software Security Center

Compared 8% of the time

Coverity Static vs Fortify Software Security Center

Compared 7% of the time

OpenText Core Application Security vs Fortify Software Security Center

Compared 7% of the time

Parasoft SOAtest vs Fortify Software Security Center

Compared 2% of the time

More Fortify Software Security Center Competitors

SonarQube vs Veracode

Compared 8% of the time

GitHub Advanced Security vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

OWASP Zap vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Checkmarx One

Download Checkmarx One product report

Static Application Security Testing (SAST)

Download Fortify Software Security Center product report

Download Veracode product report

Also Known As

No data available

Micro Focus Software Security Center, Application Security Center, HPE Application Security Center, WebInspect

Crashtest Security , Veracode Detect

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Software Security Center enables management, development, and security teams to work together to triage, track, validate, automate, and manage software security activities.

OpenText

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Neosecure, Acxiom, Skandinavisk Data Center A/S, Parkeon

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Static Application Security Testing (SAST)