Checkmarx One vs Sonatype Repository Firewall comparison

Checkmarx and Sonatype are both solutions in the Application Security Tools category. Checkmarx is ranked #2 with an average rating of 8.1, while Sonatype is ranked #25 with an average rating of 8.5. Checkmarx holds a 8.3% mindshare in AS, compared to Sonatype’s 1.1% mindshare. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 100% of Sonatype users who would recommend it.

Checkmarx One

Read 81 Checkmarx One reviews

24,219 Views
14,774 Comparison Views

88% willing to recommend

Sonatype Repository Firewall

Read 5 Sonatype Repository Firewall reviews

3,165 Views
1,614 Comparison Views

100% willing to recommend

Checkmarx One

Sonatype Repository Firewall

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Checkmarx One and Sonatype Repository Firewall are leading solutions in the security software market. Sonatype Repository Firewall seems to have the upper hand due to user-reported satisfaction with its feature set and overall value.

Features: Checkmarx One offers comprehensive scanning capabilities, seamless integration within various development environments, and effective vulnerability identification across platforms. Sonatype Repository Firewall provides precise malware blocking, advanced dependency management, and deep focus on security integrity, which enhances its feature evaluations.

Room for Improvement: Checkmarx One could improve its learning curve, enhance scalability, and offer more granular configuration options. Sonatype Repository Firewall users suggest expanding integration options with third-party tools, improving user interface intuitiveness, and addressing certain performance issues in large environments.

Ease of Deployment and Customer Service: Checkmarx One is recognized for a straightforward deployment process and efficient response from customer service. Sonatype Repository Firewall also offers a seamless deployment experience and reliable customer support, though Checkmarx's personalized service offers a slight advantage.

Pricing and ROI: Checkmarx One is seen as more budget-friendly with commendable ROI and a smooth initial setup. Sonatype Repository Firewall's higher cost is justified by its advanced feature set, providing significant ROI over time. While Checkmarx offers attractive pricing, Sonatype's capabilities offer superior value.

To learn more, read our detailed Checkmarx One vs. Sonatype Repository Firewall Report (Updated: June 2026).

Buyer's Guide

Checkmarx One vs. Sonatype Repository Firewall

June 2026

Download the complete report

Helped 900,644 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Ranking in Application Security Tools

2nd

Average Rating

7.8

Reviews Sentiment

6.6

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (2nd), Vulnerability Management (15th), Container Security (14th), Static Code Analysis (2nd), API Security (4th), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (2nd), Risk-Based Vulnerability Management (10th), Application Security Posture Management (ASPM) (3rd), AI Security (2nd)

Sonatype Repository Firewall

Ranking in Application Security Tools

25th

Average Rating

8.4

Reviews Sentiment

4.9

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (13th), AI Software Development (25th)

Mindshare comparison

As of June 2026, in the Application Security Tools category, the mindshare of Checkmarx One is 8.3%, down from 10.0% compared to the previous year. The mindshare of Sonatype Repository Firewall is 1.1%, up from 0.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools Mindshare Distribution
Product	Mindshare (%)
Checkmarx One	8.3%
Sonatype Repository Firewall	1.1%
Other	90.6%

Application Security Tools

Featured Reviews

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

GauravS08

Cloud Architect at a tech vendor with 10,001+ employees

Automated policy checks have protected builds and now prevent vulnerable dependencies in real time

Sonatype Repository Firewall immediately identifies vulnerable content and helps block it promptly. It stops bad components before they ever enter my environment and helps developers choose correct and safer versions. It detects problems early rather than after accidents happen, and applies automatic enforcement of policies. This protects against threats and helps reduce human errors. The automatic enforcement happens at different stages. For instance, if an application team requests any dependency to the Nexus Sonatype repository proxy, it first goes to the firewall, which intercepts it before downloading and checks for vulnerabilities, malware signals, and policy rules. If safe, it allows the dependency to be downloaded. If anything risky is found, it blocks it instantly without human intervention. Once a component is downloaded, it gets stored in the cache, allowing faster downloads in the future since the component is already available in the local repository. Since I started using Sonatype Repository Firewall more than five years ago, it has had a positive impact on security and development speed. It helps prevent security incidents, fixes vulnerabilities early, and enables stable releases for applications. It speeds up development with safer dependencies by eliminating manual security checks and helps reduce human error and knowledge gaps, standardizing my DevOps pipeline and framework according to security guidelines.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"From my point of view, it is the best product on the market."

"Initial setup couldn't be any easier; Checkmarx has good documentation on environment requirements, and as long as you meet those, the installation process takes maybe 30 minutes for an initial setup, perhaps a bit longer if you're adding multiple engines."

"We have used this product to verify the dev department's code in order to minimize security holes."

"In summary, this is a good application that you can use to scan every code language."

"The most valuable feature is the simple user interface."

"The features and technologies are very good. The flexibility and the roadmap have also been very good. They're at the forefront of delivering the additional capabilities that are required with cloud delivery, etc. Their ability to deliver what customers require and when they require is very important."

"We use the solution for dynamic application testing."

"As an InfoSec consulting company, we come across major challenging projects, and Checkmarx has made life easy by reducing manual efforts in using test cases against any vulnerability found during source code reviews while intelligently finding the latest vulnerabilities beyond the OWASP Top Ten."

More Checkmarx One pros

"Since I started using Sonatype Repository Firewall more than five years ago, it has had a positive impact on security and development speed."

"Another thing that I like about Sonatype is that if you download something today, and five days from today it becomes vulnerable, it will notify you."

"The customer service is fantastic."

"Nexus Firewall has also significantly improved the time it takes us to release secure apps to market."

"You will get clean code every time, and that's a great achievement."

"The firewall is the only solution that supports Nexus Repository."

"The product's network and intrusion protection features are valuable. It also has rules and compliance features for security."

Cons

"Implementing a blackout time for any user or teams: Needs improvement."

"Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?"

"Vulnerability details: Reduce false positive results and improve it by providing more details how I can resolve the vulnerability."

"The plugins for the development environment have room for improvements such as for Android Studio and X code."

"The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"Checkmarx could probably do something to improve their license model."

"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."

More Checkmarx One cons

"I have noticed some false positives where safe components get blocked, causing unnecessary delays for developers."

"The tool needs to improve its file systems. The product should also include zero test feature."

"There are several features lacking in the current offering, particularly concerning container support and AI packages, like humming phase support."

"I think we posted one or two queries on the development side, but the response was not that great."

"What I don't like is the lack of an option to pick up the phone and call someone for support. That is something they need to improve on. They need to have a professional services package, or they need to include that option with their services."

Pricing and Cost Advice

"The interface used to create custom rules comes at an additional cost."

"It is the right price for quality delivery."

"The solution is costly."

"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."

"The number of users and coverage for languages will have an impact on the cost of the license."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"The tool's pricing is fine."

"It's relatively expensive."

More Checkmarx One pricing and cost advice

"The pricing is reasonable if you're a large enterprise developing code. It's not super-expensive."

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

900,644 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

16%

Manufacturing Company

Computer Software Company

Government

Financial Services Firm

19%

Construction Company

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

No data available

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

See all answers

What is the biggest difference between Veracode and Checkmarx?

According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...

See all answers

What is your experience regarding pricing and costs for Sonatype Nexus Firewall?

Also, I consider it average. Some people might consider it expensive, however, since it supports many beautiful features, I would say it is worth it.

See all answers

What is your primary use case for Sonatype Nexus Firewall?

My main use case for Sonatype Repository Firewall is to check dependencies for vulnerabilities, block any download content that poses a risk, and enforce and adhere to security policies in real-tim...

See all answers

What advice do you have for others considering Sonatype Nexus Firewall?

I advise others considering Sonatype Repository Firewall to ensure they have strong organization-wide policies that comply with security regulations. This product can handle large volumes of data a...

See all answers

Comparisons

SonarQube vs Checkmarx One

Compared 32% of the time

Veracode vs Checkmarx One

Compared 3% of the time

Checkmarx SAST vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

OpenText Core Application Security vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

JFrog Xray vs Sonatype Repository Firewall

Compared 15% of the time

Black Duck SCA vs Sonatype Repository Firewall

Compared 9% of the time

Veracode vs Sonatype Repository Firewall

Compared 8% of the time

Snyk vs Sonatype Repository Firewall

Compared 7% of the time

GitHub Advanced Security vs Sonatype Repository Firewall

Compared 3% of the time

More Sonatype Repository Firewall Competitors

Product Reports

Buyer's Guide

Checkmarx One

June 2026

Download Checkmarx One product report

Buyer's Guide

Sonatype Repository Firewall

May 2026

Download Sonatype Repository Firewall product report

Also Known As

No data available

Sonatype Nexus Firewall, Nexus Firewall

Overview

Checkmarx One delivers robust security through seamless integration with SCM and CI/CD tools, ensuring reliable SAST and SCA. Primarily used by organizations for vulnerability detection, it supports cloud and on-premises deployment to enhance secure coding practices.

Checkmarx One provides organizations with comprehensive tools for secure software development, integrating effectively with CI/CD pipelines to scan thousands of applications. Its capabilities extend to identifying vulnerabilities in both code bases and third-party software. Enhancing workflow by supporting SCM solutions, it assists in maintaining secure coding standards and compliance. While excelling in various areas, it requires improvements in scan speed, reduction of false positives, and broader platform integration, particularly for COBOL and Swift. Its pricing model is noted as high, and demand exists for better tutorials and documentation.

What are the key features of Checkmarx One?

Comprehensive Integration: Seamlessly connects with SCM, CI/CD tools to streamline security workflows.
Accurate SAST and SCA: Precisely identifies vulnerabilities down to the exact line of code.
Custom Rules Configuration: Allows tailored security measures to match specific needs.
Quick Scanning: Provides fast analysis to speed up the development process.
Automated Code Remediation: Helps in efficiently fixing code vulnerabilities.

What benefits should users expect in reviews?

Improved Security: Enhances code safety, reducing vulnerabilities efficiently.
Effective False Positivity Management: Optimizes time spent on genuine issues.
Enhanced Development Processes: Integrates smoothly to boost secure coding initiatives.
Comprehensive Language Support: Facilitates scanning in multiple programming languages, accommodating diverse needs.

Industries implement Checkmarx One for secure coding compliance and vulnerability management across varying environments, choosing between cloud and on-premises deployment based on requirements. Its extensive language support and integration with DevSecOps practices make it a popular choice for organizations aiming to enhance software security.

Checkmarx

Sonatype Repository Firewall ensures secure software supply chains by inspecting open-source components for vulnerabilities and other threats at the point of ingress.

Designed for real-time protection, Sonatype Repository Firewall not only identifies but also controls potentially malicious, vulnerable, or non-compliant components before they reach development teams and CI/CD pipelines. It offers automation for quarantine, blocking workflows, and integrates with repository managers like Sonatype Nexus Repository to enforce security and compliance policies. Audit trails and reporting features enable monitoring of repository health and trends while automated remediation workflows assist security and DevOps teams in reducing manual intervention.

What are the notable features of Sonatype Repository Firewall?

Real-time Artifact Analysis: Performs immediate inspection of components entering the repository.
Security and Compliance Policies: Enforces customizable policies to mitigate risk.
Automated Workflows: Quarantines and blocks suspicious components automatically.
Repository Integration: Works seamlessly with managers, including Sonatype Nexus Repository.
Audit Trails and Reporting: Provides insights into component activity and repository health.

What benefits or ROI can users expect?

Reduced Exposure to Threats: Minimizes the risk associated with supply-chain vulnerabilities.
Improved Developer Productivity: Streamlines security processes to maintain delivery speed.
Cost Efficiency: Lowers manual efforts with automated checks and balances.

Sonatype Repository Firewall is widely implemented across industries that rely on rapid and secure software development. It is particularly valuable in sectors like finance, healthcare, and technology, where managing software dependencies effectively is crucial for maintaining security and compliance standards.

Sonatype

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

EDF, Tomitribe, Crosskey, Blackboard, Travel audience

Buyer's Guide

Checkmarx One vs. Sonatype Repository Firewall

June 2026

Free Report: Checkmarx One vs. Sonatype Repository Firewall

Find out what your peers are saying about Checkmarx One vs. Sonatype Repository Firewall and other solutions. Updated: June 2026.

DOWNLOAD NOW

900,644 professionals have used our research since 2012.

See our Checkmarx One vs. Sonatype Repository Firewall report.

See our list of best Application Security Tools vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.