Checkmarx Software Composition Analysis vs Fortify Static Code Analyzer comparison

The compared Checkmarx and OpenText solutions aren't in the same category. Checkmarx is ranked #8 in SCA , with an average rating of 9.0, and holds a 2.5% mindshare in the category. OpenText is ranked #3 in SCAS , with an average rating of 8.2, and holds a 11.9% mindshare. Additionally, 100% of Checkmarx users are willing to recommend the solution, compared to 88% of OpenText users who would recommend it.

Checkmarx Software Composit...

Read 13 Checkmarx Software Composition Analysis reviews

1,349 Views
988 Comparison Views

100% willing to recommend

Fortify Static Code Analyzer

Read 17 Fortify Static Code Analyzer reviews

1,719 Views
1,159 Comparison Views

88% willing to recommend

Checkmarx Software Composit...

Fortify Static Code Analyzer

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Fortify Static Code Analyzer based on real PeerSpot user reviews.

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA).

To learn more, read our detailed Software Composition Analysis (SCA) Report (Updated: March 2025).

Buyer's Guide

Software Composition Analysis (SCA)

March 2025

Download the complete report

Helped 849,686 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (8th)

Fortify Static Code Analyzer

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Static Code Analysis (3rd)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Checkmarx Software Composition Analysis is designed for Software Composition Analysis (SCA) and holds a mindshare of 2.5%, down 3.1% compared to last year.
Fortify Static Code Analyzer, on the other hand, focuses on Static Code Analysis, holds 11.9% mindshare, up 9.5% since last year.

Software Composition Analysis (SCA)

Static Code Analysis

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at Wiley

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Aphiwat Leetavorn.

CTO at Marco Technology

Provides extensive language support and enhances secure coding practices

The deployment of Fortify Static Code Analyzer needs to be simplified. It should be easier to install, perhaps through a container-based approach where everything is combined into one image or pack of containers. This change would facilitate easier installations and ensure all necessary components are connected and ready to use.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The product is stable and scalable."

"It has improved identification capabilities, scalability, and integration with AI, such as the AI-powered suggestions."

"It is a stable solution...It is a scalable solution."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

"The most valuable feature of Checkmarx Software Composition Analysis is the comprehensive security scan."

"The integration part is easy...It's a stable solution right now."

"The customer service and support were good."

"Checkmarx unifies all the features in its service."

More Checkmarx Software Composition Analysis pros

"I like Fortify Software Security Center or Fortify SSC. This tool is installed on each developer's machine, but Fortify Software Security Center combines everything. We can meet there as security professionals and developers. The developers scan their code and publish the results there. We can then look at them from a security perspective and see whether they fixed the issues. We can agree on whether something is a false positive and make decisions."

"We've found the documentation to be very good."

"Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between."

"We write software, and therefore, the most valuable aspect for us is basically the code analysis part."

"Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it is finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it."

"It's helped us free up staff time."

"Fortify Static Code Analyzer's most valuable features are its ability to provide best practices for fixing code and its examples and capabilities to address security problems in the code. It effectively identifies security vulnerabilities by analyzing the code and offering insights on improving it."

"The most valuable features include its ability to detect vulnerabilities accurately and its integration with our CI/CD pipeline."

More Fortify Static Code Analyzer pros

Cons

"In terms of areas for improvement, what could be improved in Checkmarx Software Composition Analysis is pricing because customers always compare the pricing among secure DevOps solutions in the market. Checkmarx Software Composition Analysis has a lot of competitors yet its features aren't much different. Pricing is the first thing customers consider, and from a partner perspective, if you can offer affordable pricing to your customers, it's more likely you'll have a winning deal. The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

"I would rate the scalability a seven out of ten."

"The quality of technical support has decreased over time, and it is not as good as it used to be."

"Instant updates for end users to identify vulnerabilities as soon as possible will make Checkmarx Software Composition Analysis better. The UI of the solution could also be improved."

"API security is an area with shortcomings that needs improvement."

"Parts of the implementation process could improve by making it more user-friendly."

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"Personally, I currently use it as a standalone tool without integrating it with other systems, and it meets my needs adequately. As a suggestion, I request on considering to add a "what if" feature to the application. Currently, when the tool identifies issues and suggests updates, if I want to explore different scenarios, I need to prepare another file, turn it into a ZIP, and run the analysis again. It would be more convenient if there was a "what if" option in the GUI. This feature could simulate a run, allowing me to quickly check the impact of changing one or more files or versions without the need for a full rerun."

More Checkmarx Software Composition Analysis cons

"The generation of false positives should be reduced."

"It comes with a hefty licensing fee."

"The troubleshooting capabilities of this solution could be improved. This would reduce the number of cases that users have to submit."

"Their licensing is expensive."

"I know the areas that they are trying to improve on. They've been getting feedback for several years. There are two main points. The first thing is keeping current with static code languages. I know it is difficult because code languages pop up all the time or there are new variants, but it is something that Fortify needs to put a better focus on. They need to keep current with their language support. The second thing is a philosophical issue, and I don't know if they'll ever change it. They've done a decent job of putting tools in place to mitigate things, but static code analysis is inherently noisy. If you just take a tool out of the box and run a scan, you're going to get a lot of results back, and not all of those results are interesting or important, which is different for every organization. Currently, we get four to five errors on the side of tagging, and it notifies you of every tiny inconsistency. If the tool sees something that it doesn't know, it flags, which becomes work that has to be done afterward. Clients don't typically like it. There has got to be a way of prioritizing. There are a ton of filter options within Fortify, but the problem is that you've got to go through the crazy noisy scan once before you know which filters you need to put in place to get to the interesting stuff. I keep hearing from their product team that they're working on a way to do container or docker scanning. That's a huge market mover. A lot of people are interested in that right now, and it is relevant. That is definitely something that I'd love to see in the next version or two."

"Streamlining the upgrade process and enhancing compatibility would make it easier for us to keep our security tools up-to-date."

"The deployment of Fortify Static Code Analyzer needs to be simplified."

"Fortify Static Code Analyzer has a bit of a learning curve, and I don't find it particularly helpful in narrowing down the vulnerabilities we should prioritize."

More Fortify Static Code Analyzer cons

Pricing and Cost Advice

"It is a little bit high priced. It would be better if it was a little less expensive."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"The setup costs and pricing for Fortify may vary depending on the organization's needs and requirements."

"The price of Fortify Static Code Analyzer could be reduced."

"The licensing is expensive and is in the 50K range."

"There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost. I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use."

"I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive."

"It has a couple of license models. The one that we use most frequently is called their flexible deployment. We use this one because it is flexible and based on the number of code-contributing developers in the organization. It includes almost everything in the Fortify suite for one developer price. It gives access to not just the secure code analyzer (SCA) but also to FSC, the secure code. It gives us accessibility to scan central, which is the decentralized scanning farm. It also gives us access to the software security center, which is the vulnerability management platform."

"Although I am not responsible for the budget, Fortify SAST is expensive."

"From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

849,686 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

36%

Manufacturing Company

15%

Computer Software Company

Educational Organization

Financial Services Firm

29%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Checkmarx Software Composition Analysis?

The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all...

See all answers

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

See all answers

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

See all answers

What do you like most about Fortify Static Code Analyzer?

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...

See all answers

What is your experience regarding pricing and costs for Fortify Static Code Analyzer?

The pricing of Fortify Static Code Analyzer is good, with a flexible model that allows customers to choose a setup that suits their needs. There are some features that require additional purchases,...

See all answers

What needs improvement with Fortify Static Code Analyzer?

See all answers

Comparisons

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 37% of the time

Black Duck vs Checkmarx Software Composition Analysis

Compared 27% of the time

Semgrep vs Checkmarx Software Composition Analysis

Compared 8% of the time

Polaris Software Integrity Platform vs Checkmarx Software Composition Analysis

Compared 7% of the time

More Checkmarx Software Composition Analysis Competitors

Black Duck vs Fortify Static Code Analyzer

Compared 35% of the time

Snyk vs Fortify Static Code Analyzer

Compared 17% of the time

Veracode vs Fortify Static Code Analyzer

Compared 13% of the time

Sonatype Lifecycle vs Fortify Static Code Analyzer

Compared 8% of the time

Codacy vs Fortify Static Code Analyzer

Compared 1% of the time

More Fortify Static Code Analyzer Competitors

Product Reports

Buyer's Guide

Checkmarx Software Composition Analysis

April 2025

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Buyer's Guide

Fortify Static Code Analyzer

April 2025

Download Fortify Static Code Analyzer product report

Also Known As

CxSCA

Fortify Static Code Analysis SAST

Overview

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Checkmarx

Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.

Fortify Static Code Analyzer Benefits

CI/CD pipeline security: Fortify SCA integrates well with third-party tools such as ALM Octane, Atlassian Bamboo, Azure DevOps, Eclipse, Jenkins, and Jira. It offers real-time scan results, immediate recommendations, and collaborative auditing, and finds threats faster. It also discovers and prioritizes weaknesses to reduce risk.
Cost-effective: Improves coding actions by training users as they work to better understand the relationship of static application security testing (SAST). Fortify SCA is able to find more vulnerabilities than other solutions and delivers significantly fewer false positives.
Quick and reliable scanning: Fortify SCA will discover and eradicate weaknesses in byte, binary, or source code. SAST is able to stop the bulk of code issues at the start of development. The solution is able to discover 815 specific categories of risk, works through 27 programming languages and more than one million different APIs. Fortify SCA has a positive rate of 100% in the OWASP 1.2 benchmark.

Fortify Static Code Analyzer Features

Flexible deployment: Using Fortify On Demand, users can work in a complete SaaS environment. Fortify Hosted allows users to use on-premises and SaaS to work in a secure virtual space with complete control. Fortify-On-Prem gives users absolute control of the Fortify SCA solution.
Security assistant: Users have an interactive guide as they create code that provides risk analysis and anticipated outcomes. Security Assistant is an outstanding immediate feedback tool that gives instant results with significantly fewer false positives.
Audit assistant: This feature uses machine learning to reduce manual audit time while prioritizing the most important risks to users' networks. It provides automated audits in minutes. Any manual examinations are reduced, all issues are prioritized in accordance with organizational needs, and Fortify SCA consistently provides audit results to all projects.

Results from Real Users

“Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it.” - Arun D., Senior Architect at a healthcare company.

“Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between.” - Tom H., Director of Security at Merito

OpenText

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Information Not Available

Buyer's Guide

Software Composition Analysis (SCA)

March 2025

Download Free Report

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA). Updated: March 2025.

DOWNLOAD NOW

849,686 professionals have used our research since 2012.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.