Checkmarx One vs Tenable Nessus comparison

Checkmarx and Tenable are both solutions in the Vulnerability Management category. Checkmarx is ranked #24 with an average rating of 7.7, while Tenable is ranked #3 with an average rating of 8.2. Checkmarx holds a 0.7% mindshare in VM, compared to Tenable’s 9.8% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 98% of Tenable users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 9, 2024

Checkmarx One and Tenable Nessus compete in the cybersecurity domain, focusing on vulnerability detection and code security. Checkmarx One appears to have the upper hand with comprehensive code scanning capabilities and robust security investments.

Features: Checkmarx One provides comprehensive code scanning without the need for compiling, reducing false positives and supporting numerous languages and integrations. It offers robust code analysis and source code tracking, alongside incremental scanning. Tenable Nessus is noted for its extensive database and predictive features, offering broad vulnerability detection with strong network coverage.

Room for Improvement: Checkmarx One faces challenges with its high pricing and complex licensing. It requires improvements in language support and reporting capabilities, as well as reduced hardware dependencies. Tenable Nessus needs enhanced cloud integration and more intuitive reporting. The interface customization and pricing flexibility are also areas needing attention.

Ease of Deployment and Customer Service: Checkmarx One supports various deployment options, including private, public, and hybrid clouds, although some delays in technical support are reported. Tenable Nessus offers diversified deployment settings with well-regarded, swift, and knowledgeable technical support.

Pricing and ROI: Checkmarx One is often considered expensive but justified for security investments, offering flexibility across environments with a complex license model. Users note a positive ROI in terms of secure delivery speeds. Tenable Nessus is praised for competitive pricing, offering different licensing options based on IP addresses, and is perceived as cost-effective, especially for comprehensive support services.

To learn more, read our detailed Checkmarx One vs. Tenable Nessus Report (Updated: April 2025).

Buyer's Guide

Checkmarx One vs. Tenable Nessus

April 2025

Download the complete report

Helped 852,649 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Zafran Security

Mindshare comparison

As of May 2025, in the Vulnerability Management category, the mindshare of Zafran Security is 0.6%, up from 0.0% compared to the previous year. The mindshare of Checkmarx One is 0.7%, up from 0.3% compared to the previous year. The mindshare of Tenable Nessus is 9.8%, down from 13.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Vulnerability Management

Featured Reviews

Israel Cavazos Landini

Associate Director IT Security Operations at a pharma/biotech company with 10,001+ employees

Weekly insights and risk analysis facilitate informed security decisions

I appreciate the weekly insights Zafran provides, which include critical topics for networks and IT security, allowing us to evaluate which insights apply to our environment. The organization score feature is valuable to keep the leadership team updated on how our infrastructure fares security-wise. The applicable risk level versus base risk level feature is beneficial because prior to Zafran, we only used the base risk level, but now understand that risk depends on the asset itself. Zafran is an excellent tool.

Read full review

Rohit Kesharwani

Manager, Engineering at 7-Eleven

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

HarshBhardiya

SOC Engineer at Just Dial Limited

Provided increased visibility across the organization's servers

The user interface of Tenable Nessus feels outdated and could be more user-friendly. Additionally, the documentation is not well-organized, which can be confusing when searching for solutions or specific information related to Tenable Nessus Professional. The reporting feature could be improved by allowing users to create their own templates instead of relying on predefined ones.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"We are able to see the real risk of a vulnerability on our environment with our security tools."

"Overall, we have seen about eighty-seven percent reduction of the number of vulnerabilities that require urgency to remediate, specifically the number of criticals."

"Zafran is an excellent tool."

"Zafran has become an indispensable tool in our cybersecurity arsenal."

"Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before."

"It can integrate very well with DAST solutions. So both of them are combined into an integrated solution for customers running application security."

"The most valuable features of Checkmarx are the Best Fix Location and the Payments option because you can save a lot of time trying to mitigate the configuration. Using these tools can save you a lot of time."

"The most valuable feature is the simple user interface."

"Checkmarx pinpoints the vulnerability in the code and also presents the flow of malicious input across the application."

"It is very useful because it fits our requirements. It is also easy to use. It is not complex, and we are satisfied with the results."

"We were using HPE Security Fortify to scan code for security vulnerabilities, but it can scan only after a successful compile. If the code has dependencies or build errors, the scan fails. With Checkmarx, pre-compile scanning is seamless. This allows us to scan more code."

"Less false positive errors as compared to any other solution."

More Checkmarx One pros

"Its initial setup was simple and straightforward."

"You can then direct your team to create a report on the discovered vulnerabilities."

"I like this solution because it is complete. It can scan and check many types of vulnerabilities. It can also check for compliance."

"The trial version is very good for testing whether it will suit your needs."

"It also has an executive report where you don't have to provide the client all the detail for them to sift though. But if they wish to dig through the detail they can."

"The solution is easy to understand for users because instructions are included on the platform."

"It allows me to prioritize efforts and utilize effective technical resources."

"The vulnerability scanner is the most valuable feature."

More Tenable Nessus pros

Cons

"Initially, we were somewhat concerned about the scalability of Zafran due to our large asset count and the substantial amount of information we needed to process."

"The dashboarding and reporting functionality of Zafran Security is an area that definitely could use some improvements."

"There is nothing particular that I don't like in this solution. It can have more integrations, but the integrations that we would like are in the roadmap anyway, and they just need to deliver the roadmap. What I like about the roadmap is that it is going where it needs to go. If I were to look at the roadmap, there is nothing that is jumping out there that says to me, "Yeah. I'd like something else on the roadmap." What they're looking to deliver is what I would expect and forecast them to deliver."

"Checkmarx could improve the REST APIs by including automation."

"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."

"The solution sometimes reports a false auditable code or false positive."

"The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools."

"The cost per user is high and should be reduced."

"Checkmarx could improve by reducing the price."

"Checkmarx could improve the solution reports and false positives. The false positives could be reduced. For example, we have alerts that are tagged as vulnerabilities but when you drill down they are not."

More Checkmarx One cons

"It would be a good idea if they have a simulation of attacks or a use case for finding a new vulnerability or dealing with a zero-day attack."

"One area that has room for improvement is the reporting. I'm preparing reports for Windows and Linux machines, etc. Currently, I'm collecting three or four reports and turning them into one report. I don't know if it is possible to combine all of them in one report, but that would be helpful."

"The pricing point has increased significantly in recent years. The product's pricing has roughly tripled within the last couple of years, making us reconsider renewing the license for the scanner."

"Online learning could be a bit better."

"Remediation needs improvement."

"The reporting feature needs to be improved."

"The tool needs to upgrade asset tracking."

"Scans aren't done properly and some devices aren't pinged."

More Tenable Nessus cons

Pricing and Cost Advice

Information not available

"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."

"Be cautious of the one-year subscription date. Once it expires, your price will go up."

"Checkmarx is not a cheap scanning tool, but none of the security tools are cheap. Checkmarx is a powerful scanning tool, and it’s essential to have one of these products."

"The tool's pricing is fine."

"I believe pricing is better compared to other commercial tools."

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."

More Checkmarx One pricing and cost advice

"The product is free."

"Its pricing is great and can't be improved. It is very cheap. It is less than 2,000 pounds a license, and you can't really ask for more. It has unlimited IPs and unlimited scans. There are no particular pricing constraints. The only additional cost is the inherent cost of the people to actually review the actual scans."

"The solution has free options."

"When comparing the price of Tenable Nessus to other similar solutions, such as Acunetix, Tenable Nessus is not as expensive. It is averagely priced in the market. We pay for the solution annually."

"The price is high for the solution. There are free tools with similar functionality available. The solution cost approximately $3,500."

"Its price is high for Libya. The companies here in Libya don't have the awareness of and a good budget for cybersecurity services. If you want them to go for a product, you need to provide something different. This differentiation is related to the price. They should give about 40% to 45% discount per person on the current cost."

"While Tenable Nessus is a good enterprise solution, the high price would likely make it prohibitive to smaller organizations."

"Nowadays, your vulnerability applications are going to be kind of pricey because lots of them, including Rapid7, are based upon a base price, but then they add in the nodes. That's where they get you. If you're a big network, obviously, you need to scan everything. Therefore, it's going to be costly. The risk and insurance money associated with having ransomware on my networks is going to cost me more money, time, and marketing than the price of the tool. That's why I'm speaking only as an information security officer to security operations. This is the tool that is there in my toolbox to say whether we vulnerable or not. At this point, I don't care about how much it costs my company to have it because if I wasn't able to report it and we got ransomware, then who cares? I'm probably going to be out of business because it happened. That's why I don't care about the price. I have it, and I could use it effectively and do my report. At the end of the day, even if we get ransomware, as long as I reported it, followed my protocol, and put in the change, irrespective of whether it was ignored or denied, I did my job."

More Tenable Nessus pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Vulnerability Management solutions are best for your needs.

See recommendations

852,649 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Computer Software Company

13%

Financial Services Firm

12%

Manufacturing Company

Government

Financial Services Firm

21%

Computer Software Company

14%

Manufacturing Company

10%

Government

Educational Organization

34%

Computer Software Company

Financial Services Firm

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

What is your experience regarding pricing and costs for Zafran Security?

I find that the pricing for Zafran aligns well with the comprehensive features it offers. The asset and user-based li...

See all answers

What needs improvement with Zafran Security?

Zafran is a new startup. Features are continuously being added or improved. 1) Continued integrations with existing (...

See all answers

What is your primary use case for Zafran Security?

We connect this to our vulnerability scanner as input, our security tools to better determine risk, and our change ma...

See all answers

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

See all answers

How would you choose between Rapid7 InsightVM and Tenable Nessus?

You have full visibility across cloud, network, virtual, and containerized infrastructures with Rapid7 Insight VM. Yo...

See all answers

What's the difference between Tenable Nessus and Tenable.io Vulnerability Management?

Tenable Nessus is a vulnerability assessment solution that is both easy to deploy and easy to manage. The design of ...

See all answers

What do you like most about Tenable Nessus?

We have around 500 virtual machines. Therefore, we conduct monthly scans and open tickets for our developers to addre...

See all answers

Comparisons

Wiz Code vs Zafran Security

Compared 51% of the time

Vulcan Cyber vs Zafran Security

Compared 21% of the time

ServiceNow Security Operations vs Zafran Security

Compared 12% of the time

Tenable Vulnerability Management vs Zafran Security

Compared 9% of the time

Armis vs Zafran Security

Compared 7% of the time

More Zafran Security Competitors

SonarQube Server (formerly SonarQube) vs Checkmarx One

Compared 39% of the time

Veracode vs Checkmarx One

Compared 12% of the time

Fortify on Demand vs Checkmarx One

Compared 6% of the time

Checkmarx SAST vs Checkmarx One

Compared 5% of the time

OWASP Zap vs Checkmarx One

Compared 5% of the time

More Checkmarx One Competitors

Qualys VMDR vs Tenable Nessus

Compared 14% of the time

Tenable Vulnerability Management vs Tenable Nessus

Compared 12% of the time

Rapid7 InsightVM vs Tenable Nessus

Compared 11% of the time

Microsoft Defender Vulnerability Management vs Tenable Nessus

Compared 9% of the time

Pentera vs Tenable Nessus

Compared 7% of the time

More Tenable Nessus Competitors

Product Reports

Buyer's Guide

Continuous Threat Exposure Management (CTEM)

May 2025

Download Zafran Security product report

Buyer's Guide

Checkmarx One

May 2025

Download Checkmarx One product report

Buyer's Guide

Tenable Nessus

April 2025

Download Tenable Nessus product report

Overview

Zafran Security integrates with existing security tools to identify and mitigate vulnerabilities effectively, proving that most critical vulnerabilities are not exploitable, optimizing threat management.

Zafran Security introduces an innovative operating model for managing security threats and vulnerabilities. By leveraging the threat exposure management platform, it pinpoints and prioritizes exploitable vulnerabilities, reducing risk through immediate remediation. This platform enhances your hybrid cloud security by normalizing vulnerability signals and integrating specific IT context data, such as CVE runtime presence and internet asset reachability, into its analysis. No longer reliant on patch windows, Zafran Security allows you to manage risks actively.

What are the key features of Zafran Security?

Threat Exposure Management: Utilizes existing tools to prioritize vulnerabilities and manage threats.
Integrative Analysis: Combines security data with IT context for precise vulnerability management.
Real-time Risk Reduction: Enables immediate risk management without waiting for patches.
Hybrid Cloud Compatibility: Functions across diverse cloud environments for comprehensive security.

What benefits can users expect from Zafran Security?

Improved Security: Enhances protection by efficiently identifying and mitigating risks.
Cost Efficiency: Reduces unnecessary patching expenses by confirming non-exploitable vulnerabilities.
Time Savings: Frees developers to focus on root causes by handling immediate threats.
Comprehensive Insight: Offers a holistic view of security threats and vulnerabilities.

In industries where security is paramount, such as finance and healthcare, Zafran Security provides invaluable protection by ensuring that only exploitable vulnerabilities are addressed. It allows entities to maintain robust security measures while allocating resources efficiently, fitting seamlessly into existing security strategies.

Zafran Security

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Tenable Nessus provides an efficient vulnerability management system with swift deployment and comprehensive scanning capabilities, making it an ideal choice for organizations seeking to enhance their security posture through effective threat detection and mitigation strategies.

Renowned for its top-tier vulnerability detection, Tenable Nessus offers a robust platform that integrates effortlessly across systems, enhancing threat management through automation, real-time monitoring, and customizable scanning options. Its broad asset coverage, including network devices and applications, coupled with ease of deployment, positions it as a go-to option for risk assessment and compliance. Organizations value its extensive reporting features and database, although they suggest enhancements in reporting formats and false positive detection. A more intuitive interface, improved cloud support, and competitive pricing models are sought after to cater to evolving enterprise needs.

What are the key features of Tenable Nessus?

Comprehensive Vulnerability Detection: Identifies security gaps across systems and platforms.
Remedy Recommendations: Provides actionable insights for vulnerability fixes.
Predictive Prioritization: Helps in focusing on critical vulnerabilities first.
Seamless Integration: Compatible with diverse platforms for cohesive threat management.
Automation Capabilities: Streamlines routine scans and reports.

What benefits and ROI should users look for?

Fast Setup: Quick deployment that saves time and resources.
Cost-Effective: Affordable pricing supports budget-conscious cyber strategies.
Real-Time Monitoring: Offers continuous oversight of system health.
Extensive Reports: Detailed insights enhance decision-making processes.

In industries such as finance, healthcare, and tech, Tenable Nessus is implemented for scanning internal and external networks, identifying risks, and ensuring data protection compliance. Organizations conduct regular scans to detect security vulnerabilities in servers and databases, leveraging its capabilities to strengthen their security frameworks while managing cloud infrastructures and enterprise networks efficiently.

Tenable

Sample Customers

Information Not Available

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Bitbrains, Tesla, Just Eat, Crosskey Banking Solutions, Covenant Health, Youngstown State University

Buyer's Guide

Checkmarx One vs. Tenable Nessus

April 2025

Free Report: Checkmarx One vs. Tenable Nessus

Find out what your peers are saying about Checkmarx One vs. Tenable Nessus and other solutions. Updated: April 2025.

DOWNLOAD NOW

852,649 professionals have used our research since 2012.

See our Checkmarx One vs. Tenable Nessus report.

See our list of best Vulnerability Management vendors.

We monitor all Vulnerability Management reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.