Checkmarx One vs Fortinet FortiDDoS comparison

Why PeerSpot?

The compared Checkmarx and Fortinet solutions aren't in the same category. Checkmarx is ranked #2 in AS , with an average rating of 8.3, and holds a 7.3% mindshare in the category. Fortinet is ranked #15 in DDOS , with an average rating of 8.0, and holds a 1.8% mindshare. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 90% of Fortinet users who would recommend it.

Checkmarx One

Read 81 Checkmarx One reviews

29,420 Views
16,181 Comparison Views

88% willing to recommend

Fortinet FortiDDoS

Read 15 Fortinet FortiDDoS reviews

2,705 Views
1,975 Comparison Views

90% willing to recommend

Checkmarx One

Fortinet FortiDDoS

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One and Fortinet FortiDDoS based on real PeerSpot user reviews.

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: September 2026).

Buyer's Guide

Application Security Tools

September 2026

Download the complete report

Helped 913,806 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Average Rating

7.8

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Vulnerability Management (12th), Container Security (15th), Static Code Analysis (2nd), API Security (5th), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (3rd), Risk-Based Vulnerability Management (10th), Application Security Posture Management (ASPM) (3rd), AI Security (3rd)

Fortinet FortiDDoS

Average Rating

8.2

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Distributed Denial-of-Service (DDoS) Protection (15th)

Mindshare comparison

Checkmarx One and Fortinet FortiDDoS aren’t in the same category and serve different purposes. Checkmarx One is designed for Application Security Tools and holds a mindshare of 7.3%, down 10.2% compared to last year.
Fortinet FortiDDoS, on the other hand, focuses on Distributed Denial-of-Service (DDoS) Protection, holds 1.8% mindshare, down 2.6% since last year.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Checkmarx One	7.3%
SonarQube	10.8%
Snyk	5.0%
Other	76.9%

Application Security Tools

Distributed Denial-of-Service (DDoS) Protection Mindshare Distribution
Product	Mindshare (%)
Fortinet FortiDDoS	1.8%
Cloudflare	11.9%
Imperva Application Security Platform	7.7%
Other	78.6%

Distributed Denial-of-Service (DDoS) Protection

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

Marcos AntonioOliveira

IT Analyst at Evapco, Inc.

Reliable protection and smooth setup enhance company security

Currently, I have two firewalls, with one located in Sorocaba, model 90D, and the other in São Paulo, model 30D. They are connected by VPN. I use the firewalls for VPN and final protection for my company, and my equipment is maintained by an internet company called Multiprox The equipment works…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"If you really are worried about your business, i.e. about your development sites or development environments, Checkmarx is a great solution."

"The most valuable feature is that it actually identifies the different criteria you can set to meet whatever standards you're trying to get your system accredited for."

"Apart from software scanning, software composition scanning is valuable."

"The most valuable feature for me is the Jenkins Plugin."

"The consistency of code showed our team where they are inconsistent or where they have made simple omissions."

"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."

"The only thing I like is that Checkmarx does not need to compile."

"The best features Checkmarx One offers, in my opinion, are that it is easy to use, and there is not much deep diving into this."

More Checkmarx One pros

"We use it to protect our users and their data."

"The pricing of this solution is better than that of Cisco and other software on the market, which are very expensive."

"The protection resources and the support are valuable features of the solution."

"It allows me to see all the traffic on my network."

"We have researched them all, and it's a good solution all around."

"The product's initial setup phase was really easy."

"We've been completely satisfied with the product."

"This solution can protect Layer 3, Layer 4 and Layer 7 attacks of applications for us, and this is important."

More Fortinet FortiDDoS pros

Cons

"We felt like we were the extended quality organization for Checkmarx as they frequently released poor quality patches that broke the existing functionality."

"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

"The lack of ability to review compiled source code. It would then be able to compete with other scanning tools, such as Veracode."

"From an administrative standpoint, I would rate Checkmarx with a five out of ten."

"Some were valid and some were not applicable for us based on the scenario."

"Creating and editing custom rules in Checkmarx is difficult because the license for the editor comes at an additional cost, and there is a steep learning curve."

"We have received some feedback from our customers who are receiving a large number of false positives."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

More Checkmarx One cons

"There aren't really any aspects of the solution we are unhappy with. It's been a positive experience overall."

"I would like to see analytics, big data."

"The only thing they need to do is to automate it. Today, you must create tools that do not require the use of an expert or anyone with special skills."

"Earlier versions of firmware had bugs that limit my options."

"I find that there have been issues in the past year with the solution hanging. It freezes often."

"The tool needs to focus more on the area of application traffic management, where it currently has some shortcomings."

"The web interface could be much better."

"Technical support isn't too good with Fortinet. They could be more responsive and helpful overall."

More Fortinet FortiDDoS cons

Pricing and Cost Advice

"We have purchased an annual license to use this solution. The price is reasonable."

"It's relatively expensive."

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

"This solution is expensive. The customized package allows you to buy additional users at any time."

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

"The tool's pricing is fine."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"It is the right price for quality delivery."

More Checkmarx One pricing and cost advice

"The product’s pricing needs improvement."

"The solution is reasonably priced."

"It's quite pricey."

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

913,806 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

15%

Manufacturing Company

Outsourcing Company

Computer Software Company

Comms Service Provider

14%

Financial Services Firm

10%

Government

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	10
Large Enterprise	6

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...

See all answers

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?

Arbor would be the best bid, apart from Arbor, Palo Alto and Fortinet have good solutions. As this is an ISP, I would prefer Arbor.

See all answers

What is your experience regarding pricing and costs for Fortinet FortiDDoS?

Fortinet FortiDDoS offers lower costs compared to other solutions. The licensing costs are annually renewed.

See all answers

What needs improvement with Fortinet FortiDDoS?

There is a need for more features that protect personal information, especially given the PDP issue in Indonesia.

See all answers

Comparisons

SonarQube vs Checkmarx One

Compared 24% of the time

Veracode vs Checkmarx One

Compared 3% of the time

Checkmarx SAST vs Checkmarx One

Compared 2% of the time

Snyk vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

Radware DDoS vs Fortinet FortiDDoS

Compared 12% of the time

Arbor DDoS vs Fortinet FortiDDoS

Compared 12% of the time

Imperva Application Security Platform vs Fortinet FortiDDoS

Compared 6% of the time

VMware NSX vs Fortinet FortiDDoS

Compared 6% of the time

Azure DDoS Protection vs Fortinet FortiDDoS

Compared 2% of the time

More Fortinet FortiDDoS Competitors

Product Reports

Buyer's Guide

Checkmarx One

September 2026

Download Checkmarx One product report

Buyer's Guide

Distributed Denial-of-Service (DDoS) Protection

September 2026

Download Fortinet FortiDDoS product report

Also Known As

No data available

Fortinet DDoS, FortiDDos

Overview

Checkmarx One delivers robust security through seamless integration with SCM and CI/CD tools, ensuring reliable SAST and SCA. Primarily used by organizations for vulnerability detection, it supports cloud and on-premises deployment to enhance secure coding practices.

Checkmarx One provides organizations with comprehensive tools for secure software development, integrating effectively with CI/CD pipelines to scan thousands of applications. Its capabilities extend to identifying vulnerabilities in both code bases and third-party software. Enhancing workflow by supporting SCM solutions, it assists in maintaining secure coding standards and compliance. While excelling in various areas, it requires improvements in scan speed, reduction of false positives, and broader platform integration, particularly for COBOL and Swift. Its pricing model is noted as high, and demand exists for better tutorials and documentation.

What are the key features of Checkmarx One?

Comprehensive Integration: Seamlessly connects with SCM, CI/CD tools to streamline security workflows.
Accurate SAST and SCA: Precisely identifies vulnerabilities down to the exact line of code.
Custom Rules Configuration: Allows tailored security measures to match specific needs.
Quick Scanning: Provides fast analysis to speed up the development process.
Automated Code Remediation: Helps in efficiently fixing code vulnerabilities.

What benefits should users expect in reviews?

Improved Security: Enhances code safety, reducing vulnerabilities efficiently.
Effective False Positivity Management: Optimizes time spent on genuine issues.
Enhanced Development Processes: Integrates smoothly to boost secure coding initiatives.
Comprehensive Language Support: Facilitates scanning in multiple programming languages, accommodating diverse needs.

Industries implement Checkmarx One for secure coding compliance and vulnerability management across varying environments, choosing between cloud and on-premises deployment based on requirements. Its extensive language support and integration with DevSecOps practices make it a popular choice for organizations aiming to enhance software security.

Checkmarx

Fortinet FortiDDoS provides comprehensive protection against DDoS attacks across layers 3 to 7. It efficiently minimizes false positives and is valued for real-time attack monitoring, cloud DDoS scrubbing, and multi-layer security, leveraging purpose-built ASICs for high performance.

Fortinet FortiDDoS is favored for its robust defense capabilities in DDoS detection and mitigation, supporting sophisticated security infrastructures. Its purpose-built ASICs ensure effective performance without reliance on signature-based detection. While it offers strong features like attack monitoring and cloud scrubbing, users identify challenges with its complex setup and web interface. Additionally, the need for simplified features, enhanced application traffic management, and better alerts is crucial especially when handling sensitive data. Priced competitively, it presents scalability concerns particularly in on-premises environments.

What are Fortinet FortiDDoS's key features?

DDoS Detection: Protects infrastructure from layers 3 to 7 with minimal false positives.
Real-Time Monitoring: Enables instant attack detection and response.
Cloud Scrubbing: Offers cloud-based DDoS mitigation to cleanse traffic.
Purpose-Built ASICs: Ensures performance without reliance on signatures.
Multi-Layer Protection: Comprehensive security across different network layers.

What benefits should users expect from Fortinet FortiDDoS?

Enhanced Security: Protects against a wide range of DDoS threats.
Performance Optimization: Improves network traffic management.
Cost Efficiency: Competitive pricing with powerful capabilities.
Effective Mitigation: Reduces risks with real-time threats monitoring.
User Data Protection: Safeguards personal and sensitive information.

Fortinet FortiDDoS is widely used in internet datacenters with multiple upstreams to protect infrastructure and customers from potential threats. Companies deploy Fortinet appliances for managing network traffic and ensuring optimal performance. They rely on it for safeguarding web pages, web services, and networks while benefiting from ease of troubleshooting and effective VPN connections, critical for application-based attack defense.

Fortinet

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Black Gold Regional Schools, Amadeus Hospitality, Jefferson County, Chunghwa Telecom, City of Boroondara, Dimension Data

Buyer's Guide

Application Security Tools

September 2026

Download Free Report

Find out what your peers are saying about SonarSource Sàrl, Checkmarx, Veracode and others in Application Security Tools. Updated: September 2026.

DOWNLOAD NOW

913,806 professionals have used our research since 2012.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.