We performed a comparison between Checkmarx and Fortify Application Defender based on real PeerSpot user reviews.
Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The solution communicates where to fix the issue for the purpose of less iterations."
"The user interface is excellent. It's very user friendly."
"Apart from software scanning, software composition scanning is valuable."
"The UI is user-friendly."
"The solution allows us to create custom rules for code checks."
"It gives the proper code flow of vulnerabilities and the number of occurrences."
"The report function is the solution's greatest asset."
"Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before."
"The solution helped us to improve the code quality of our organization."
"The most valuable features of Fortify Application Defender are the code packages that are default."
"The most valuable feature is the ability to automatically feed it rules what it's coupled with the WebInspect dynamic application scanning technology."
"Its ability to find security defects is valuable."
"The most valuable feature is that it analyzes data in real-time."
"The product saves us cost and time."
"We are able to provide out customers with a secure application after development. They are no longer left wondering if they are vulnerable to different threats within the market following deployment."
"Fortify Application Defender's most valuable features are machine learning algorithms, real-time remediation, and automatic vulnerability notifications."
"They can support the remaining languages that are currently not supported. They can also create a different model that can identify zero-day attacks. They can work on different patterns to identify and detect zero-day vulnerability attacks."
"I expect application security vendors to cover all aspects of application security, including SAST, DAST, and even mobile application security testing. And it would be much better if they provided an on-premises and cloud option for all these main application security features."
"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."
"The reports are good, but they still need to be improved considering what the UI offers."
"It would be really helpful if the level of confidence was included, with respect to identified issues."
"Its pricing model can be improved. Sometimes, it is a little complex to understand its pricing model."
"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."
"The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools."
"Fortify Application Defender gives a lot of false positives."
"The solution could improve the time it takes to scan. When comparing it to SonarQube it does it in minutes while in Fortify Application Defender it can take hours."
"Support for older compilers/IDEs is lacking."
"The false positive rate should be lower."
"The workbench is a little bit complex when you first start using it."
"The licensing can be a little complex."
"The solution is quite expensive."
"Fortify Application Defender could improve by supporting more code languages, such as GRAAS and Groovy."
Checkmarx is ranked 3rd in Application Security Tools with 67 reviews while Fortify Application Defender is ranked 34th in Application Security Tools with 9 reviews. Checkmarx is rated 7.6, while Fortify Application Defender is rated 7.8. The top reviewer of Checkmarx writes "The report function is a great, configurable asset but sometimes yields false positives". On the other hand, the top reviewer of Fortify Application Defender writes "Reliable solution with excellent machine learning algorithms but expensive and lacking support". Checkmarx is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and Sonatype Lifecycle, whereas Fortify Application Defender is most compared with Coverity, SonarQube, CAST Application Intelligence Platform, Fortify on Demand and Qualys Web Application Scanning. See our Checkmarx vs. Fortify Application Defender report.
See our list of best Application Security Tools vendors.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
Fewer false positives with CX than Fortify. More integrated.
Looking at the Gartner report I would say that Checkmarx is way easier to set up (initial setup) compared to Micro Focus Fortify.
Also, the financial strength of the Micro Focus Fortify spin/merger is a concern so investments could be at risk.
The major difference is that Checkmarx scans the code without compiling the code. This has a great advantage as code building issues are eliminated,
scan time is very less and false positive is less to some extent. One more major this is Checkmarx learns as you eliminate false positives and does not show the same issue again. We can perform incremental scans on the codebase where the old issue is nicely marked as "Recurring" and new ones in Red as NEW. Checkmarx has a highly customizable filter creation where you can create a filter that can eliminate the common recurring issues in
scans. This feature is very flexible and you can write your own filters and also, write specific patterns that are found in manual review which is a
great help as coding styles differ form teams to teams.
Thanks a lot. Thank you for the information.