Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs Veracode comparison

Sponsored
 

Comparison Buyer's Guide

Executive SummaryUpdated on Jul 27, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Cortex Cloud by Palo Alto N...
Sponsored
Ranking in Application Security Posture Management (ASPM)
9th
Average Rating
10.0
Reviews Sentiment
8.7
Number of Reviews
1
Ranking in other categories
Vulnerability Management (35th), Cloud Workload Protection Platforms (CWPP) (19th), Cloud Security Posture Management (CSPM) (22nd), Cloud-Native Application Protection Platforms (CNAPP) (16th), Data Security Posture Management (DSPM) (13th), Software Supply Chain Security (14th), Cloud Infrastructure Entitlement Management (CIEM) (7th), Cloud Detection and Response (CDR) (8th)
Checkmarx One
Ranking in Application Security Posture Management (ASPM)
3rd
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
71
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (22nd), Container Security (23rd), Static Code Analysis (3rd), API Security (6th), Dynamic Application Security Testing (DAST) (4th), DevSecOps (5th), Risk-Based Vulnerability Management (10th)
Veracode
Ranking in Application Security Posture Management (ASPM)
1st
Average Rating
8.2
Reviews Sentiment
6.9
Number of Reviews
204
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st)
 

Q&A Highlights

it_user1354977 - PeerSpot reviewer
Jul 08, 2020
 

Featured Reviews

PG
Identifies vulnerabilities and enables proactive remediation through AI/ML capabilities
The solution helps me to understand misconfigurations in AWS or Azure cloud environments. It detects misconfigurations, suggests remedial actions, and helps identify vulnerabilities across cloud platforms. It provides action recommendations for CVEs against particular vulnerabilities The tool…
Syed Hasan - PeerSpot reviewer
Partner experiences excellent technical support and seamless initial setup
In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.
Kv Rao - PeerSpot reviewer
Integrates pipelines smoothly and fortifies code against vulnerabilities
I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."
"The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete."
"The administration in Checkmarx is very good."
"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."
"Our static operation security has been able to identify more security issues since implementing this solution."
"The solution allows us to create custom rules for code checks."
"The most valuable feature is the simple user interface."
"The report function is the solution's greatest asset."
"The most valuable features of Checkmarx are the SCA module and the code-checking module. Additionally, the solutions are explanatory and helpful."
"We have such a wide variety of users for Veracode, including security champions, development leads, developers themselves, that the ease of use is really quite important, because we don't assume anything about what those people might already know, or need to know. It just makes it very useful for anyone who has to engage with it."
"Veracode has impacted our overall security posture because we are from a security background. Every week, we review the dashboards of open findings."
"Provides the ability to understand the black zones in our system."
"The SAST and DAST modules are great."
"We have to look at it from the perspectives of how important it is to fix something and when it should be prioritized for fixing. The JSON output from the agent-based scans gives us the CVS core, and that makes things much easier."
"One thing that I like about Veracode is that it is quite a good tool for dynamic application testing."
"In terms of application security best practices and guidance to our teams, their engineering staff is really excellent. They provide our developers with suggestions and they take those to heart. They've learned from the recommended remediation strategies provided by the Veracode security engineers. That makes all of their future code better."
"For our rapid, secure DevOps cycle, we have integration of the Vericode API into our build tool, and Greenlight into our IDE."
 

Cons

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."
"Its pricing model can be improved. Sometimes, it is a little complex to understand its pricing model."
"Micro-services need to be included in the next release."
"There is nothing particular that I don't like in this solution. It can have more integrations, but the integrations that we would like are in the roadmap anyway, and they just need to deliver the roadmap. What I like about the roadmap is that it is going where it needs to go. If I were to look at the roadmap, there is nothing that is jumping out there that says to me, "Yeah. I'd like something else on the roadmap." What they're looking to deliver is what I would expect and forecast them to deliver."
"This product requires you to create your own rulesets. You have to do a lot of customization."
"Integration into the SDLC (i.e. support for last version of SonarQube) could be added."
"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."
"The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform."
"Maybe the pipeline scanning doesn't support enough languages. It might only support Java and Python only, so that could be improved."
"It would be ideal if it was able to demonstrate higher levels of cybersecurity certifications like becoming FedRAMP compliant or working in those areas."
"The sandbox could use some improvement; when creating a sandbox, it requires us to put the application name in twice, which seems unnecessary."
"All areas of the solution could use some improvement."
"We have some constraints interacting with Veracode self-support. I'm not talking about their technical support. I'm talking about self-support. We sometimes have a hard time communicating with them."
"I am expecting some AI-related features in it. Also, if someone is using AI-generated code, Veracode should be able to detect that."
"The scanning on the UI portion of our applications is straightforward, but folks were having challenges with scans that involved microservices. They had to rope in an expert to have it sorted."
"The ideal situation in terms of putting the results in front of the developers would be with Veracode integration into the developer environment (IDE). They do have a plugin, which we've used in the past, but we were not as positive about it."
 

Pricing and Cost Advice

Information not available
"I believe pricing is better compared to other commercial tools."
"We have purchased an annual license to use this solution. The price is reasonable."
"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."
"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."
"It's relatively expensive."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"The cost of Veracode is high."
"The solution is expensive."
"Veracode's price is reasonable."
"The pricing is reasonable compared to other tools."
"Veracode is affordable for large organizations, but its pricing may be out of reach for small and medium companies."
"Get a license at the beginning of a project. Don't wait until the end, because you want to use the product throughout the entire software development lifecycle, not just at the end. You could be surprised, and not in a positive way, with all the vulnerabilities there are in your code."
"Pricing seems fair for what is offered, and licensing has been no problem. All developers are able to get the access they need."
"The pricing is a little on the high side but since we combine our product into one suite, it is easy to do and works well for us."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
870,701 professionals have used our research since 2012.
 

Answers from the Community

it_user1354977 - PeerSpot reviewer
Jul 8, 2020
Jul 8, 2020
My opinions are my own and do not represent any other entities that I may be or have been affiliated with. On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon. As for Checkmarx vs SonarQube... Checkmarx may cover more rules over a wider land...
2 out of 3 answers
DG
Jul 6, 2020
My opinions are my own and do not represent any other entities that I may be or have been affiliated with.  On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon.  As for Checkmarx vs SonarQube...  Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse.  SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it.  I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission.  In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode.  Hope that helps
DG
Jul 7, 2020
SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.
 

Top Industries

By visitors reading reviews
Performing Arts
15%
Computer Software Company
10%
Manufacturing Company
8%
Financial Services Firm
7%
Financial Services Firm
19%
Computer Software Company
13%
Manufacturing Company
10%
Government
6%
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
9%
Insurance Company
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business30
Midsize Enterprise9
Large Enterprise38
By reviewers
Company SizeCount
Small Business69
Midsize Enterprise43
Large Enterprise112
 

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?
The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...
What needs improvement with Cortex Cloud by Palo Alto Networks?
Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed.
What is your primary use case for Cortex Cloud by Palo Alto Networks?
The solution helps me to understand misconfigurations in AWS or Azure cloud environments. It detects misconfiguration...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...
What do you like most about Veracode Static Analysis?
I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...
What is your experience regarding pricing and costs for Veracode Static Analysis?
When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers ...
 

Also Known As

No data available
No data available
Crashtest Security , Veracode Detect
 

Overview

 

Sample Customers

Information Not Available
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.
Find out what your peers are saying about Checkmarx One vs. Veracode and other solutions. Updated: September 2025.
870,701 professionals have used our research since 2012.