Checkmarx One vs Salt Security comparison

Checkmarx and Salt Security are both solutions in the API Security category. Checkmarx is ranked #4 with an average rating of 8.3, while Salt Security is ranked #5 with an average rating of 8.5. Checkmarx holds a 7.1% mindshare in APIS, compared to Salt Security’s 7.4% mindshare. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 100% of Salt Security users who would recommend it.

Checkmarx One

Read 81 Checkmarx One reviews

27,512 Views
1,376 Comparison Views

88% willing to recommend

Salt Security

Read 3 Salt Security reviews

2,305 Views
1,590 Comparison Views

100% willing to recommend

Checkmarx One

Salt Security

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One and Salt Security based on real PeerSpot user reviews.

Find out in this report how the two API Security solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Checkmarx One vs. Salt Security Report (Updated: June 2026).

Buyer's Guide

Checkmarx One vs. Salt Security

June 2026

Download the complete report

Helped 909,725 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Ranking in API Security

4th

Ranking in AI Security

3rd

Average Rating

7.8

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Vulnerability Management (12th), Container Security (14th), Static Code Analysis (2nd), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (3rd), Risk-Based Vulnerability Management (10th), Application Security Posture Management (ASPM) (3rd)

Salt Security

Ranking in API Security

5th

Ranking in AI Security

21st

Average Rating

8.6

Reviews Sentiment

8.5

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of August 2026, in the API Security category, the mindshare of Checkmarx One is 7.1%, up from 6.1% compared to the previous year. The mindshare of Salt Security is 7.4%, down from 11.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.

API Security Mindshare Distribution
Product	Mindshare (%)
Checkmarx One	7.1%
Salt Security	7.4%
Other	85.5%

API Security

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

Tbaker Baker

Risk Advisory Senior Manager at a marketing services firm with 1,001-5,000 employees

Behavioral AI has protected critical applications and now blocks complex external attacks

I think Salt Security could improve their implementations. The one that I saw was very complex and took quite a bit of time, and if the environment is unique at all, it takes quite a bit of time to figure out how to properly ensure that it will be implemented. A lot of times there is a steep learning curve for someone that hasn't been in it to figure out the APIs and really dig deep into it, but once you get used to it, it is easy. However, that ramp-up period could be tough. I think Salt Security could use a more enterprise focus. Some of the smaller companies that I have referred them to think it is a little bit too complex for them, so if they could come up with a different version or something a little bit easier to simplify their platform, they may be able to find more customers that way.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The main thing we find valuable about Checkmarx is the ease of use, as it's easy to initiate scans and triage defects."

"The ability to track the vulnerabilities inside the code (origin and destination of weak variables or functions)."

"The most valuable feature for me is the Jenkins Plugin."

"Both automatic and manual code review (CxQL) are valuable."

"The most valuable features of Checkmarx are the Best Fix Location and the Payments option because you can save a lot of time trying to mitigate the configuration. Using these tools can save you a lot of time."

"As an InfoSec consulting company, we come across major challenging projects, and Checkmarx has made life easy by reducing manual efforts in using test cases against any vulnerability found during source code reviews while intelligently finding the latest vulnerabilities beyond the OWASP Top Ten."

"Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before."

"It provides a graphical view of any vulnerabilities."

More Checkmarx One pros

"It's really great. I would rate the stability a nine out of ten. I haven't encountered any instability issues."

"Salt Security gave me much better visibility into API risk, helping me identify exposed endpoints, misconfigured APIs, and sensitive data flowing through APIs that required additional controls, and it has become an important part of my API security program."

"Salt Security gives you visibility of all your APIs, identifies API security issues, and immediately alerts you of attacks."

"Salt Security has positively impacted my organization and my client's organization by being able to stop cyberattacks and ensure that they have proper security over all their applications, giving them a sense of peace of mind that they have security over something that could ultimately take down the whole company if not mitigated properly."

Cons

"They should make it more container-friendly and optimized for the CI pipeline. They should make it a little less heavy. Right now, it requires a SQL database, and the way the tool works is that it has an engine and then it has an analysis database in which it stores the information. So, it is pretty heavy from that perspective because you have to have a full SQL Server. They're working on something called Checkmarx Light, which is a slim-down version. They haven't released it yet, but that's what we need. There should be something a little more slimmed down that can just run the analysis and output the results in a format that's readable as opposed to having a full, really big, and thick deployment with a full database server."

"Implementing a blackout time for any user or teams: Needs improvement."

"I can't create a business case with multiple-factor authentication."

"Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?"

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools."

"Checkmarx reports many false positives that we need to manually segregate and mark “Not exploitable”."

"Integration into the SDLC (i.e. support for last version of SonarQube) could be added."

More Checkmarx One cons

"Regarding scalability, for users in smaller environments, it is not exactly the best."

"The setup cost was acceptable, but adding additional APIs was actually quite expensive."

"The integration part could be a bit extended."

Pricing and Cost Advice

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"It is the right price for quality delivery."

"The tool's pricing is fine."

"The solution is costly."

"This solution is expensive. The customized package allows you to buy additional users at any time."

"It's relatively expensive."

"The solution's price is high and you pay based on the number of users."

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."

More Checkmarx One pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which API Security solutions are best for your needs.

See recommendations

909,725 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Manufacturing Company

Computer Software Company

Outsourcing Company

Manufacturing Company

16%

Computer Software Company

16%

Construction Company

Comms Service Provider

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

No data available

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...

See all answers

What is your experience regarding pricing and costs for Salt Security?

My experience with pricing, setup cost, and licensing is that I think it was affordable. For smaller companies, it might be a barrier to entry, but for the large enterprise that I was working with,...

See all answers

What needs improvement with Salt Security?

See all answers

What is your primary use case for Salt Security?

My main use case for Salt Security is that one of my clients uses it as a security vendor for their security across all of their overlying applications. I can give you a specific example of how my ...

See all answers

Comparisons

SonarQube vs Checkmarx One

Compared 25% of the time

Veracode vs Checkmarx One

Compared 3% of the time

Checkmarx SAST vs Checkmarx One

Compared 2% of the time

Snyk vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

Akamai API Security vs Salt Security

Compared 11% of the time

Orca Security vs Salt Security

Compared 10% of the time

Upwind vs Salt Security

Compared 9% of the time

Wallarm NG WAF vs Salt Security

Compared 9% of the time

Traceable AI vs Salt Security

Compared 8% of the time

More Salt Security Competitors

Product Reports

Buyer's Guide

Checkmarx One

August 2026

Download Checkmarx One product report

Buyer's Guide

API Security

August 2026

Download Salt Security product report

Also Known As

No data available

Salt Security API Protection Platform

Overview

Checkmarx One delivers robust security through seamless integration with SCM and CI/CD tools, ensuring reliable SAST and SCA. Primarily used by organizations for vulnerability detection, it supports cloud and on-premises deployment to enhance secure coding practices.

Checkmarx One provides organizations with comprehensive tools for secure software development, integrating effectively with CI/CD pipelines to scan thousands of applications. Its capabilities extend to identifying vulnerabilities in both code bases and third-party software. Enhancing workflow by supporting SCM solutions, it assists in maintaining secure coding standards and compliance. While excelling in various areas, it requires improvements in scan speed, reduction of false positives, and broader platform integration, particularly for COBOL and Swift. Its pricing model is noted as high, and demand exists for better tutorials and documentation.

What are the key features of Checkmarx One?

Comprehensive Integration: Seamlessly connects with SCM, CI/CD tools to streamline security workflows.
Accurate SAST and SCA: Precisely identifies vulnerabilities down to the exact line of code.
Custom Rules Configuration: Allows tailored security measures to match specific needs.
Quick Scanning: Provides fast analysis to speed up the development process.
Automated Code Remediation: Helps in efficiently fixing code vulnerabilities.

What benefits should users expect in reviews?

Improved Security: Enhances code safety, reducing vulnerabilities efficiently.
Effective False Positivity Management: Optimizes time spent on genuine issues.
Enhanced Development Processes: Integrates smoothly to boost secure coding initiatives.
Comprehensive Language Support: Facilitates scanning in multiple programming languages, accommodating diverse needs.

Industries implement Checkmarx One for secure coding compliance and vulnerability management across varying environments, choosing between cloud and on-premises deployment based on requirements. Its extensive language support and integration with DevSecOps practices make it a popular choice for organizations aiming to enhance software security.

Checkmarx

Salt Security specializes in protecting APIs and detecting vulnerabilities that could lead to potential security breaches. It provides comprehensive visibility and threat protection to ensure safe and efficient API usage.

Salt Security offers robust API security solutions that help companies identify and mitigate potential threats. Its advanced analytics and machine learning capabilities empower businesses to monitor and predict vulnerabilities, proactively safeguarding their digital infrastructure. By leveraging cutting-edge technologies, Salt Security ensures superior protection for sensitive data accessed through APIs, facilitating seamless operations and enhanced security management.

What key features does Salt Security offer?

Real-Time Monitoring: Continuously tracks API activities to identify anomalies.
Automated Threat Detection: Uses AI to recognize and alert on suspicious behaviors.
Comprehensive Analytics: Provides deep insights into API usage and security posture.
Scalable Architecture: Adapts to growing needs without compromising performance.

What benefits should you look for in reviews?

Improved Security Posture: Enhances protection of business-critical data.
Cost Efficiency: Reduces expenses related to manual security checks.
Time Savings: Streamlines API security management, allowing faster response.
Increased Visibility: Offers clear insights into API interactions.

In industries such as finance and healthcare, where data security is paramount, Salt Security's solutions are implemented to secure API communications, maintain compliance, and prevent unauthorized access. These industries benefit from Salt Security's ability to provide robust defenses tailored to their unique operational requirements.

Salt Security

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Appsflyer, Armis, City National Bank, Coralogix, Finastra, Gett, Honeybook, Payoneer

Buyer's Guide

Checkmarx One vs. Salt Security

June 2026

Free Report: Checkmarx One vs. Salt Security

Find out what your peers are saying about Checkmarx One vs. Salt Security and other solutions. Updated: June 2026.

DOWNLOAD NOW

909,725 professionals have used our research since 2012.

See our Checkmarx One vs. Salt Security report.

See our list of best API Security vendors and best AI Security vendors.

We monitor all API Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.