Checkmarx One vs OpenText Core Application Security vs Qualys Web Application Scanning comparison

Checkmarx and OpenText are both solutions in the Application Security Tools category. Checkmarx is ranked #3 with an average rating of 8.3, while OpenText is ranked #14 with an average rating of 8.0. Checkmarx holds a 9.9% mindshare in AS, compared to OpenText’s 4.3% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 89% of OpenText users who would recommend it.

Checkmarx One

Read 71 Checkmarx One reviews

21,636 Views
17,525 Comparison Views

87% willing to recommend

OpenText Core Application S...

Read 60 OpenText Core Application Security reviews

7,934 Views
5,792 Comparison Views

89% willing to recommend

Qualys Web Application Scan...

Read 39 Qualys Web Application Scanning reviews

4,371 Views
2,710 Comparison Views

87% willing to recommend

Checkmarx One

OpenText Core Application S...

Qualys Web Application Scan...

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, OpenText Core Application Security, and Qualys Web Application Scanning based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: July 2025).

Buyer's Guide

Application Security Tools

July 2025

Download the complete report

Helped 862,624 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of July 2025, in the Application Security Tools category, the mindshare of Checkmarx One is 9.9%, down from 14.3% compared to the previous year. The mindshare of OpenText Core Application Security is 4.3%, down from 5.1% compared to the previous year. The mindshare of Qualys Web Application Scanning is 2.1%, up from 2.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Syed Hasan

Specialist Leader at Deloitte

Partner experiences excellent technical support and seamless initial setup

In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

Read full review

Jonathan Steyn

Principal Technical Consultant at EOH

Source code analyzer, FPR file generation, reduction of false positives and generates compliance reports, for in-depth analysis

Not challenges with the product itself. The product is very reliable. It does have a steep learning curve. But, again, one thing that Fortify or OpenText does very well is training. There are a lot of free resources and training in the community forums, free training as well as commercial training where users can train on how to use the back-end systems and the scanning engines and how to use command-line arguments because some of the procedures or some of the tools do require a bit of a learning curve. That's the only challenge I've really seen for customers because you have to learn how to use the tool effectively. But Fortify has, in fact, improved its user interface and the way users engage the dashboards and the interfaces. It is intuitive. It's easy to understand. But in some regards, the cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions. But from the point of the reliability index and how powerful the tool is, there's no challenge there. But it's just from a learning perspective; users might need a bit more skill to use the tool. The user interface isn't that tedious. It's not that difficult to understand. When I initially learned how to use the interfaces, I was able to master it within a week and was able to use it quite effectively. So training is required. All skills are needed to learn how to use the tool. I would like to see more enhancements in the dashboards. Dashboards are available. They do need some configuration and settings. But I would like to see more business intelligence capabilities within the tool. It's not particularly a cybersecurity function, but, for instance, business impact analysis or other features where you can actually use business intelligence capabilities within your security tool. That would be remarkable because not only do you have a cybersecurity tool, but you also have a tool that can give you business impact analysis and some other measurements. A bit more intelligence in terms of that from a cybersecurity perspective would be remarkable.

Read full review

Kelvin Oladipo

Team Lead, Cyber Security at Uridium Technologies

User-friendly scanning provides valuable vulnerability insights, but pricing improvements are needed

Qualys Web Application Scanning ( /products/qualys-web-application-scanning-reviews ) is user-friendly, easy to understand, easy to use, and easy to deploy. Credential scanning is very effective because it goes in-depth into the system, crawling the pages, and reporting on vulnerabilities. The product helps by providing options for remediating vulnerabilities it finds, making it really useful.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results."

"The most valuable feature is the simple user interface."

"It has all the features we need."

"The most valuable feature is the application tracking reporting."

"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."

"Scan reviews can occur during the development lifecycle."

"Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%."

"The solution allows us to create custom rules for code checks."

More Checkmarx One pros

"We have the option to test applications with or without credentials."

"Provides good depth of scanning and we get good results."

"It's a stable and scalable solution."

"While using Micro Focus Fortify on Demand we have been very happy with the results and findings."

"Being able to reduce risk overall is a very valuable feature for us."

"The quality of application security testing reduces risk and gives very few false positives."

"The static code analyzers are the most valuable features of this solution."

"Fortify helps us to stay updated with the newest languages and versions coming out."

More OpenText Core Application Security pros

"It is a very stable solution."

"QualysGuard web-based scanner is very useful for performing external penetration and PCI scans from remote locations."

"Its most valuable features are patch management, vulnerability management, and PCI compliance."

"This product is designed for easy scalability and can easily scale up without major challenges."

"You can integrate your Burp Suite results and create an integrated report. Also, the way it shows the results - threats and exploit details - makes remediation very easy."

"Licensing is the most valuable. Qualys provides the best licensing for companies. It is the best product for the development purposes of web applications. The product has a lot of integrations."

"Qualys WAS' most valuable features are the navigation flow of the UI and the option for a different layer of security (identification and operation through email and mobile)."

"Qualys Web Application Scanning is user-friendly, easy to understand, easy to use, and easy to deploy."

More Qualys Web Application Scanning pros

Cons

"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."

"The resolutions should also be provided. For example, if the user faces any problem regarding an installation due to the internal security policies of their company, there should be a resolution offered."

"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."

"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."

"They can support the remaining languages that are currently not supported. They can also create a different model that can identify zero-day attacks. They can work on different patterns to identify and detect zero-day vulnerability attacks."

"Meta data is always needed."

"They could work to improve the user interface. Right now, it really is lacking."

"Creating and editing custom rules in Checkmarx is difficult because the license for the editor comes at an additional cost, and there is a steep learning curve."

More Checkmarx One cons

"If you have a continuous integration in place, for example, and you want it to run along with your build and you want it to be fast, you're not going to get it. It adds to your development time."

"Micro Focus Fortify on Demand cannot be run from a Linux Agent. When we are coding the endpoint it will not work, we have to use Windows Agent. This is something they could improve."

"It does scanning for all virtual machines and other things, but it doesn't do the scanning for containers. It currently lacks the ability to do the scanning on containers. We're asking their product management team to expand this capability to containers."

"We have some stability issues, but they are minimal."

"Temenos's (T-24) info basic is a separate programming interface, and such proprietary platforms and programming interfaces were not easily supported by the out-of-the-box versions of Fortify."

"We would like a reduction in the time frame of scans. It takes us three to five days to run a scan now. We would like that reduced to under three days."

"Primarily for a complex, advanced website, they don't really understand some of the functionalities. So for instance, they could tell us that there is a vulnerability because somebody could possibly do something, but they don't really understand the code to realize that we actually negate that vulnerability through some other mechanism in the program. In addition, the technical support is just not there. We have open tickets. They don't respond. Even if they respond, we're not seeing eye to eye. As the company got sold and bought, the support got worse."

"The cybersecurity specialist or AppSec would need a bit of training to engage the user interface and to understand how it functions."

More OpenText Core Application Security cons

"The software’s pricing could be improved."

"Sometimes the response time is low because the handshake fails, and then you have to re-login and start again."

"It should have better automatic reporting."

"In certain cases, this product does have false positives, which the company should work on."

"The product should allow users to upload their payloads."

"We procured around 110 licenses for Web Application Scanning, but we have issues running concurrent scans. I don't currently have the option to trigger scans for all 100-plus websites. The default limit is around 10 conference scans. It's not very scalable, to be honest, because of the limitation that they put on concurrent scans."

"When comparing this solution to Veracode, Veracode has good interactive features and gives a clear understanding of what the vulnerabilities are, which error line of the vulnerability is on and what can be done. It gives interactive features, whereas this solution does not give a clear understanding of where or how to fix the problem."

"The area of false positives could be improved. There are quite a number of false positives as compared to other solutions. They could probably fine tune the algorithm to be able to reduce the number of false positives being detected."

More Qualys Web Application Scanning cons

Pricing and Cost Advice

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"I believe pricing is better compared to other commercial tools."

"The number of users and coverage for languages will have an impact on the cost of the license."

"The solution is costly."

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."

"It's relatively expensive."

"It is the right price for quality delivery."

"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."

More Checkmarx One pricing and cost advice

"Micro Focus Fortify on Demand licenses are managed by our IT team and the license model is user-based."

"It is quite expensive. Pricing and the licensing model could be improved."

"I believe the rental license is not too expensive, but it provides a lot of information about the vulnerabilities."

"Fortify on Demand is more expensive than Burpsuite. I rate its pricing a nine out of ten."

"The pricing model it's based on how many applications you wish to scan."

"The price is fair compared to that of other solutions."

"It is not more expensive than other solutions, but the pricing is competitive."

"There are different costs for Micro Focus Fortify on Demand depending on the assessments you want to use. There is only a standard license needed to use the solution."

More OpenText Core Application Security pricing and cost advice

"Qualys has an IT-based licensing based on a yearly license, which is a good way of handling it. However, in some cases, when we do the PCI scanning, the host will not like the scanning and we lose the IT license. So, this could be improved."

"Pricing was reasonable and competitive. It was not too far above the other products."

"Qualys Web Application Scanning's pricing is a bit expensive compared to other solutions available in the market."

"Try the free trial of the product to understand the basic working mechanisms."

"The product pricing is fair and reasonably priced."

"Qualys WAS' pricing is competitive."

"Licensing was based on the number of assets that you want to scan on your network. You can also do licensing on subscription. On subscription, it is easier and more flexible. You tell Qualys that you want to move from the 1000 to 2000 band or the 3000 or 5000 band, then they will give you the quotation for it. Once you pay for it, applying the licensing is quite easy and effective."

"The cost is $30,000 USD for one year to cover WAS (Web Application Security) and the VM (Virtual Machine) security in a company with 200 employees."

More Qualys Web Application Scanning pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

862,624 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

20%

Computer Software Company

14%

Manufacturing Company

10%

Government

Financial Services Firm

19%

Manufacturing Company

15%

Computer Software Company

11%

Government

Computer Software Company

15%

Financial Services Firm

13%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

See all answers

What do you like most about Micro Focus Fortify on Demand?

It helps deploy and track changes easily as per time-to-time market upgrades.

See all answers

What is your experience regarding pricing and costs for Micro Focus Fortify on Demand?

In comparison with other tools, they're competitive. It is not more expensive than other solutions, but their pricing...

See all answers

What needs improvement with Micro Focus Fortify on Demand?

There are frequent complaints about false positives from Fortify. One day it may pass a scan with no issues, and the ...

See all answers

What do you like most about Qualys Web Application Scanning?

The vulnerability management feature is a strong one. And also the patch management feature.

See all answers

What is your experience regarding pricing and costs for Qualys Web Application Scanning?

I find it a bit expensive compared to other competitors.

See all answers

What needs improvement with Qualys Web Application Scanning?

I would like it to be cheaper because it is a bit expensive compared to competitors like Tenable Nessus ( /products/t...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs Checkmarx One

Compared 38% of the time

Veracode vs Checkmarx One

Compared 11% of the time

Checkmarx SAST vs Checkmarx One

Compared 7% of the time

OWASP Zap vs Checkmarx One

Compared 5% of the time

GitHub Advanced Security vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

SonarQube Server (formerly SonarQube) vs OpenText Core Application Security

Compared 17% of the time

Coverity vs OpenText Core Application Security

Compared 11% of the time

Veracode vs OpenText Core Application Security

Compared 11% of the time

GitHub Advanced Security vs OpenText Core Application Security

Compared 8% of the time

OWASP Zap vs OpenText Core Application Security

Compared 4% of the time

More OpenText Core Application Security Competitors

OWASP Zap vs Qualys Web Application Scanning

Compared 17% of the time

SonarQube Server (formerly SonarQube) vs Qualys Web Application Scanning

Compared 9% of the time

Veracode vs Qualys Web Application Scanning

Compared 9% of the time

Acunetix vs Qualys Web Application Scanning

Compared 7% of the time

More Qualys Web Application Scanning Competitors

Product Reports

Buyer's Guide

Checkmarx One

July 2025

Download Checkmarx One product report

Buyer's Guide

OpenText Core Application Security

July 2025

OpenText Core Application Security report

Download OpenText Core Application Security product report

Buyer's Guide

Qualys Web Application Scanning

March 2025

Download Qualys Web Application Scanning product report

Also Known As

No data available

Micro Focus Fortify on Demand

Qualys WAS

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

OpenText Core Application Security offers robust features like static and dynamic scanning, real-time vulnerability tracking, and seamless integration with development platforms, designed to enhance code security and reduce operational costs.

OpenText Core Application Security is a cloud-based, on-demand service providing accurate and deep scanning capabilities with detailed reporting. Its integrations with development platforms ensure an enhanced security layer in the development lifecycle, benefiting users by lowering operational costs and facilitating efficient remediation. The platform addresses needs for intuitive interfaces, API support, and comprehensive vulnerability assessments, helping improve code security and accelerate time-to-market. Despite its strengths, challenges exist around false positives, report clarity, and language support, alongside confusing pricing and package options. Enhancements are sought in areas like CI/CD pipeline configuration, report visualization, scan times, and integration with third-party tools such as GitLab, container scanning, and software composition analysis.

What features define OpenText Core Application Security?

Static and Dynamic Scanning: Offers thorough analysis to identify vulnerabilities during development.
Real-time Vulnerability Tracking: Continuously updates and monitors potential security threats.
Seamless Development Platform Integration: Enhances security processes without disrupting workflows.
Cloud-Based Service: Provides flexible, on-demand security capabilities with accurate results.
API Support: Allows smooth integration and automation within existing systems.

What benefits should users look for in reviews?

Reduced Operational Costs: Optimizes resources by lowering costs associated with security management.
Efficient Remediation: Speeds up the process of identifying and resolving vulnerabilities.
Enhanced Code Security: Strengthens overall application security during the development lifecycle.
Accelerated Time-to-Market: Streamlines development stages by integrating essential security tools.

Industries like mobile applications, e-commerce, and banking leverage OpenText Core Application Security for its ability to identify vulnerabilities such as SQL injections. Integrating seamlessly with DevSecOps and security auditing processes, this tool supports developers in writing safer code, ensuring secure application deployment and enhancing software assurance.

OpenText

Qualys Web Application Scanning (WAS) is a fully cloud-based web application security scanner. The scanner will automatically crawl periodically and test web applications to discover potential vulnerabilities, including cross-site scripting (XSS) and SQL injection. The consistent testing equips the automated service to generate consistent results, lessen false positives, and offer the ability to scale to protect thousands of websites effortlessly.

Qualys Web Application Scanning is bundled with different scanning technology to carefully scan websites for malware infections and will send notifications to website owners to assist in preventing blacklisting and brand reputation damage. As digital transformation takes place in various organizations, Qualys WAS gives organizations the ability to track and document their web app security status through its interactive reporting capabilities.

Qualys WAS empowers organizations to remediate any web application vulnerabilities quickly. Some of the key tools offered are:

Deep Scanning: All apps and APIs on your internal network and public cloud are covered by Qualys WAS deep scanning to show you any visible vulnerabilities.
DevSec Ops Tool: Detect security issues in your code while still in app development stages and generate comprehensive reports.
Comprehensive Discovery: Discover and catalog new and unknown web apps in your network.
Malware Detection: Scan a website, identify vulnerabilities, and receive alerts to any infections.

Benefits of Qualys Web Application Scanning

Qualys Web Application Scanning offers many benefits, including:

Quick Deployment: Requires no infrastructure or software to upkeep.
Effortless Scalability: Effortlessly launch a deep scan and protect thousands of websites.
Centralized Management: Manage and mend all web app vulnerabilities through a single interface.
Excellent Integration Capabilities: Integrates with Qualys Web App Firewall (WAF) for a single-click virtual patching of found vulnerabilities.
Respond to Threats Immediately: Qualys Continuous Monitoring offers the user a hands-free service by automatically launching scanning and sending notifications of a potential threat.
Cost-effective Solution: Data is analyzed in real time as Qualys WAS is an end-to-end solution; this helps avoid costs associated with managing multiple security vendors.

Reviews from Real Users

Qualys Web Application Scanning stands out among its competitors for a variety of reasons. Two of those reasons are its progressive scan and quick detection of vulnerabilities.

P.K., a senior software developer at a tech vendor, writes, "The feature that I have found most valuable is the progressive scan. It is good. It's done in 24 hours."

Nagaraj S., lead cybersecurity engineer at a tech service company, notes, "I have found the detection of vulnerabilities tool thorough with good results and the graphical display output to be wonderful and full of colors. It allows many types of outputs, such as bar and chart previews."

Qualys

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

SAP, Aaron's, British Gas, FICO, Cox Automative, Callcredit Information Group, Vital and more.

BskyB, Cartagena, ClearPoint Learning Systems, Connect Group, du, Fortrex Technologies, HBOR, HDI, Highlights for Children, The Lithuanian State Enterprise Centre of Registers, City of Miami Beach, Microsoft, MidlandHR, MSCI Inc., Northern Arizona University, Ofgem, Olympus Europa, PhoneFactor, RTL Nederland, ThousandEyes, VGZ Organisatie B.V.

Buyer's Guide

Application Security Tools

July 2025

Download Free Report

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: July 2025.

DOWNLOAD NOW

862,624 professionals have used our research since 2012.