Try our new research platform with insights from 80,000+ expert users

Checkmarx SAST vs Kiuwan comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx SAST
Ranking in Static Application Security Testing (SAST)
23rd
Average Rating
8.2
Reviews Sentiment
6.0
Number of Reviews
5
Ranking in other categories
No ranking in other categories
Kiuwan
Ranking in Static Application Security Testing (SAST)
25th
Average Rating
8.6
Reviews Sentiment
7.0
Number of Reviews
23
Ranking in other categories
Application Security Tools (29th)
 

Mindshare comparison

As of January 2026, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx SAST is 1.6%, up from 0.3% compared to the previous year. The mindshare of Kiuwan is 1.1%, up from 1.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST) Market Share Distribution
ProductMarket Share (%)
Checkmarx SAST1.6%
Kiuwan1.1%
Other97.3%
Static Application Security Testing (SAST)
 

Featured Reviews

Tharindu Malwenna - PeerSpot reviewer
Senior Application Security Engineer at a newspaper with 5,001-10,000 employees
Has supported early vulnerability detection but requires tuning to reduce false positives and scanning delays
When assessing the accuracy and efficiency of Checkmarx SAST scanning capabilities, they are currently recommending that doing the full scan is the main, correct way of scanning the repositories. However, based on the repository size we have, it sometimes takes more than 10 minutes for larger repositories, which is a downside. The accuracy of the results depends on various factors, as some of the test folders tend to give us false positives, which makes a huge impact on the vulnerabilities. Those are the major things that we have to fine-tune from our end. I would rate Checkmarx SAST around a seven, as it does have some false positives we have to work with, which are the major concerning things. The number of false positives is significant because we cannot implement policies because of this.
Anshul Anshul - PeerSpot reviewer
Sr. Manager at a tech services company with 10,001+ employees
Efficient and accurate scanning, and detailed analysis
In Kiuwan there are sometimes duplicates found in the dependency scan under the "insights" tab. It's unclear to me why these duplicates are appearing, and it would be helpful if the application teams could investigate further. Another issue I've encountered is that Kiuwan only looks at the version of components and doesn't take into account any workaround fixes that have been implemented at the code level. This can result in false positives being reported. Additionally, these issues are in the "insights" tab and not in the code base security aspect. Lastly, when muting findings that are false positives, there should be an option to see the only available at the code level rather than at the organization level because it can lead to missing vulnerabilities if they are muted at the org level. An additional feature that would be helpful is the ability to easily download reports from Kiuwan. Specifically, in the "insights" tab, we have been encountering an error when trying to download the PDF report. We are able to download the code-based security report, but not the insights report. This has been an ongoing issue for the past couple of months and would be beneficial if it could be resolved. My main recommendation would be to address the issues with downloading reports that we have been experiencing. Additionally, it would be helpful if Kiuwan could support a wider range of programming languages, as there are currently some that are not compatible with the tool. If the code of a particular application falls under the category which is not compatible with Kiuwan, then it will not be able to scan it.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The CX1 is a unified platform that covers all components such as SAST, SCA, DAST, container scanning, and infrastructure code, which is quite beneficial because some clients need one-stop solutions for all their needs."
"The most important competitive advantage and benefit is the ability to identify vulnerabilities in the source code immediately without needing to complete the coding."
"The detailed reports from Checkmarx SAST help with our security process by showing details about which line is actually vulnerable, which is beneficial for the developers, and I do not have any suggestions or inputs on that area."
"The most important feature is that Checkmarx protects our company against attacks."
"The most important feature is that Checkmarx protects our company against attacks."
"This helps us a lot in identifying vulnerabilities in early stages, and the integration within the IDEs helps developers get the results into their IDE itself, making it easier for them to fix vulnerabilities."
"I've tried many open source applications and the remediation or correction actions that were provided by Kiuwan were very good in comparison."
"I've found the reporting features the most helpful."
"We are using this solution to increase the quality of our software and to test the vulnerabilities in our tools before the customers find them."
"Lifecycle features, because they permit us to show non-technical people the risk and costs hidden into the code due to bad programming practices."
"​We use Kiuwan to locate the source of application vulnerabilities."
"I like that it provides a detailed report that lets you know the risk index and the vulnerability."
"The most valuable feature is the time to resolution, where it tells you how long it is going to take to get to a zero-base or a five-star security rating."
"The solution has a continuous integration process."
 

Cons

"The main challenge with Checkmarx SAST is the price. The price is a challenge because Checkmarx SAST is a very big brand, and many mid-sized companies cannot afford it as they are very price-conscious."
"We had some issues where Checkmarx did not recognize a vulnerability. We had to talk with the vendor, and they had to include an improvement in the tool to resolve this issue."
"The on-premises version is more expensive compared to the cloud version."
"I believe that nothing in particular could be improved about Checkmarx SAST, only the turnaround time and the fact that technical account managers keep moving around, which leads to some lag in communication."
"We had some issues where Checkmarx did not recognize a vulnerability."
"The accuracy of the results depends on various factors, as some of the test folders tend to give us false positives, which makes a huge impact on the vulnerabilities."
"It would be beneficial to streamline calls and transitions seamlessly for improved functionality."
"It could improve its scalability abilities."
"I would like to see additional languages supported."
"The development-to-delivery phase."
"The QA developer and security could be improved."
"I would like to see better integration with Azure DevOps in the next release of this solution."
"The solution seems to give us a lot of false positives. This could be improved quite a bit."
"In Kiuwan there are sometimes duplicates found in the dependency scan under the "insights" tab. It's unclear to me why these duplicates are appearing, and it would be helpful if the application teams could investigate further."
 

Pricing and Cost Advice

Information not available
"Kiuwan is an open-source solution and free to use."
"Nothing special. It's a very fair model."
"It follows a subscription model. I think the price is somewhere in the middle."
"This solution is cheaper than other tools."
"The price of Kiuwan is lower than that of other tools on the market."
"I recommend contacting a sales person who will create the best plan payment plan for you, as we did."
"Check with your account manager."
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
881,114 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
12%
Manufacturing Company
8%
Insurance Company
6%
Computer Software Company
12%
University
11%
Financial Services Firm
8%
Consumer Goods Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business16
Midsize Enterprise4
Large Enterprise6
 

Questions from the Community

What is your experience regarding pricing and costs for Checkmarx SAST?
We were users in a small country, and we paid one consolidated bill for all the tools, so I don't know the specific amount for Checkmarx.
What needs improvement with Checkmarx SAST?
When assessing the accuracy and efficiency of Checkmarx SAST scanning capabilities, they are currently recommending that doing the full scan is the main, correct way of scanning the repositories. H...
What is your primary use case for Checkmarx SAST?
Our main use cases with Checkmarx SAST are currently in the implementation stage where we have utilized integrations with IDEs and have already integrated within the entire organization, which will...
Ask a question
Earn 20 points
 

Comparisons

 

Also Known As

SAST
No data available
 

Overview

 

Sample Customers

Information Not Available
DHL, BNP Paribas, Zurich, AXA, Ernst & Young, KFC, Santander, Latam, Ferrovial
Find out what your peers are saying about Checkmarx SAST vs. Kiuwan and other solutions. Updated: December 2025.
881,114 professionals have used our research since 2012.