Checkmarx SAST vs Veracode comparison

Read 204 Veracode reviews

19,095 Views
12,985 Comparison Views

90% willing to recommend

Checkmarx SAST

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx SAST and Veracode based on real PeerSpot user reviews.

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Checkmarx SAST vs. Veracode Report (Updated: September 2025).

Checkmarx SAST vs. Veracode

Download the complete report

Helped 869,089 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx SAST

Ranking in Static Application Security Testing (SAST)

22nd

Average Rating

9.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

No ranking in other categories

Veracode

Ranking in Static Application Security Testing (SAST)

2nd

Average Rating

8.2

Reviews Sentiment

6.9

Number of Reviews

204

Ranking in other categories

Application Security Tools (2nd), Container Security (8th), Software Composition Analysis (SCA) (3rd), Static Code Analysis (1st), Application Security Posture Management (ASPM) (1st)

Mindshare comparison

As of October 2025, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx SAST is 1.4%, up from 0.1% compared to the previous year. The mindshare of Veracode is 6.9%, down from 10.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST) Market Share Distribution
Product	Market Share (%)
Veracode	6.9%
Checkmarx SAST	1.4%
Other	91.7%

Static Application Security Testing (SAST)

Featured Reviews

Cuneyt KALPAKOGLU Phd.

Founder & Chairman at Endpoint-labs Cyber Security R&D

Identifying code vulnerabilities swiftly with no need to complete the coding and offers good security

The primary use case of Checkmarx SAST is application security, specifically static application security testing. It is essential and the root of this concept I did not find measurable information about the financial benefits or return on investment. The most important competitive advantage and…

Read full review

Kv Rao

Site Leader (India) at Industrial Scientific

Integrates pipelines smoothly and fortifies code against vulnerabilities

I use Veracode in multiple places including static code analysis, penetration testing, and dynamic code analysis. It is part of our pipeline and integrates well with Bitbucket and Git pipelines The ease of integration with Bitbucket pipelines and Git pipelines is vital for us. Veracode allows us…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most important feature is that Checkmarx protects our company against attacks."

"The CX1 is a unified platform that covers all components such as SAST, SCA, DAST, container scanning, and infrastructure code, which is quite beneficial because some clients need one-stop solutions for all their needs."

"The most important feature is that Checkmarx protects our company against attacks."

"The most important competitive advantage and benefit is the ability to identify vulnerabilities in the source code immediately without needing to complete the coding."

"It helps me to detect vulnerabilities."

"Veracode offers various security features."

"The source composition analysis component is great because it gives our developers some comfort in using new libraries."

"The most valuable feature is the seamless automation of Veracode via the pipeline, in comparison to other solutions like Fortify SSC, which are complex to integrate through the pipeline."

"The static analysis gives you deep insights into problems."

"The installation was straightforward."

"The best feature is definitely the detailed reports. It provides code-related queries in the order of high, medium, and low depending on what we need to do. Veracode is user-friendly as well."

"The integration with DevOps pipelines is seamless."

More Veracode pros

Cons

"The on-premises version is more expensive compared to the cloud version."

"We had some issues where Checkmarx did not recognize a vulnerability."

"The main challenge with Checkmarx SAST is the price. The price is a challenge because Checkmarx SAST is a very big brand, and many mid-sized companies cannot afford it as they are very price-conscious."

"We had some issues where Checkmarx did not recognize a vulnerability. We had to talk with the vendor, and they had to include an improvement in the tool to resolve this issue."

"The runtime code analysis could be improved so that we can see every element in one place."

"Straightforward to set up, but the configuration of the rules engine is difficult and complicated."

"One of the most important areas that need improvement for Veracode is its DaaS. Veracode's DAST engines are primitive."

"The UI is not user-friendly and can be improved."

"The user interface could be more sleek. Some scanning requirements aren't flexible. Some features take some time for new users to understand (like what exactly "modules" are)."

"There were some additional manual steps or work involved that we should not have needed to do."

"I would like to see them provide more content in the developer training section. This field is really changing each day and there are flaws that are detected each day. Some sort of regular updates to the learning would help."

"Veracode does not support scans for .NET Blazor server applications."

More Veracode cons

Pricing and Cost Advice

Information not available

"I think it's a great value. It's at a price point that a small company like mine can afford to use versus, if it was too exorbitant, I wouldn't be able to use this product. The cost of the license is small in comparison to the value it brings"

"Without getting too specific, I'd say the average yearly cost is around $50,000. The costs include licensing and maintenance support."

"For our company, the price is reasonable for the benefits that we get."

"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."

"The pricing is a little on the high side but since we combine our product into one suite, it is easy to do and works well for us."

"Regarding licensing, pay very close attention to what applications you're going to need to do dynamic scanning for, versus static. Right now, the way the licensing is set up, if you don't have any static elements for a website, you can certainly avoid some costs by doing more dynamic licenses. You need to pay very close attention to that, because if you find out later that you have static code elements - like Java scripts, etc. - that you want to have scanned statically, having the two licenses bundled together will actually save you money."

"It is very reasonably priced compared to what we were paying our previous vendor. For the same price, we are getting much more value and reducing our AppSec costs from 40 to 50 percent."

"For enterprises, Veracode has done a fairly good job, but its pricing is not suitable for startups. The microservice distributed architecture for a startup is very small. I had to do a lot of discussions on the pricing initially. I previously worked in an enterprise organization where I used Veracode, and that's how I got to know about Veracode, but that was a big organization with more than a thousand employees. So, the cost is very different for them because the size of the application is different. Its pricing makes sense there, but when we try to onboard this solution for the startup ecosystem, pricing is not friendly. Because I knew the product and I knew its value, I onboarded it, but I don't think any other startup at our scale will onboard it."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

869,089 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

24%

Computer Software Company

13%

Manufacturing Company

10%

Insurance Company

Financial Services Firm

16%

Computer Software Company

15%

Manufacturing Company

Insurance Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	43
Large Enterprise	112

Questions from the Community

What is your experience regarding pricing and costs for Checkmarx SAST?

We were users in a small country, and we paid one consolidated bill for all the tools, so I don't know the specific amount for Checkmarx.

What needs improvement with Checkmarx SAST?

The main challenge with Checkmarx SAST is the price. The price is a challenge because Checkmarx SAST is a very big brand, and many mid-sized companies cannot afford it as they are very price-consci...

What is your primary use case for Checkmarx SAST?

I am currently working with Checkmarx SAST as technical partners. Our customers are from insurance and depository backgrounds. Checkmarx SAST is one of the branded solutions, and according to the M...

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabilities.

What is your experience regarding pricing and costs for Veracode Static Analysis?

When considering pricing, Veracode stands out due to its lower cost per service and more scalable options. It offers nearly five security testing features within its own service, making it a compet...

Checkmarx One vs Checkmarx SAST

Comparisons

Compared 65% of the time

Qualys Web Application Scanning vs Checkmarx SAST

Compared 6% of the time

GitLab vs Checkmarx SAST

Compared 5% of the time

Semgrep vs Checkmarx SAST

Compared 5% of the time

More Checkmarx SAST Competitors

SonarQube Server (formerly SonarQube) vs Veracode

Compared 15% of the time

Checkmarx One vs Veracode

Compared 9% of the time

GitHub Advanced Security vs Veracode

Compared 7% of the time

OWASP Zap vs Veracode

Compared 4% of the time

OpenText Core Application Security vs Veracode

Compared 4% of the time

More Veracode Competitors

Product Reports

Static Application Security Testing (SAST)

Download Checkmarx SAST product report

Download Veracode product report

Also Known As

SAST

Crashtest Security , Veracode Detect

Overview

Checkmarx SAST provides advanced static application security testing by identifying vulnerabilities in source code. It's ideal for ISOs, security professionals, and developers striving to secure applications during development.

Checkmarx SAST is known for its powerful code scanning capabilities that integrate seamlessly into existing development environments. It supports a wide range of programming languages, which makes it applicable for diverse development projects. Some users suggest improvements in the scan performance speed and enhanced support in handling false positives to further optimize workflow efficiency.

What are the standout features of Checkmarx SAST?

Language Support: Offers broad language support catering to multiple coding frameworks.
Integration Flexibility: Seamlessly integrates with existing CI/CD pipelines and developer tools.
Comprehensive Scanning: Detects security vulnerabilities early in the development process.
Detailed Reporting: Provides comprehensive reports that help prioritize remediation efforts.

What benefits and ROI should users consider?

Improved Security Posture: Enhances application security by catching vulnerabilities early.
Cost Efficiency: Reduces costs associated with post-deployment issue resolution.
Developer Empowerment: Allows developers to identify and fix issues independently.
Regulatory Compliance: Assists in meeting compliance requirements efficiently.

Implemented across various industries, Checkmarx SAST supports sectors like finance, healthcare, and technology with their stringent security requirements. By integrating seamlessly into existing workflows, it ensures that applications remain secure while not disrupting industry-specific processes.

Checkmarx

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Sample Customers

Information Not Available

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Checkmarx SAST vs. Veracode