Checkmarx One vs Imperva Web Application Firewall comparison

The compared Checkmarx and Imperva solutions aren't in the same category. Checkmarx is ranked #3 in AS , with an average rating of 8.3, and holds a 9.9% mindshare in the category. Imperva is ranked #7 in WAF , with an average rating of 8.8, and holds a 5.6% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 97% of Imperva users who would recommend it.

Checkmarx One

Read 71 Checkmarx One reviews

21,636 Views
17,525 Comparison Views

87% willing to recommend

Imperva Web Application Fir...

Read 52 Imperva Web Application Firewall reviews

4,782 Views
4,495 Comparison Views

97% willing to recommend

Checkmarx One

Imperva Web Application Fir...

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One and Imperva Web Application Firewall based on real PeerSpot user reviews.

Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.

To learn more, read our detailed Checkmarx One vs. Imperva Web Application Firewall Report (Updated: March 2019).

Buyer's Guide

Checkmarx One vs. Imperva Web Application Firewall

March 2019

Download the complete report

Helped 862,543 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Average Rating

7.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (24th), Static Code Analysis (3rd), API Security (5th), DevSecOps (5th), Risk-Based Vulnerability Management (9th)

Imperva Web Application Fir...

Average Rating

8.6

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Web Application Firewall (WAF) (7th)

Mindshare comparison

Checkmarx One and Imperva Web Application Firewall aren’t in the same category and serve different purposes. Checkmarx One is designed for Application Security Tools and holds a mindshare of 9.9%, down 14.3% compared to last year.
Imperva Web Application Firewall, on the other hand, focuses on Web Application Firewall (WAF), holds 5.6% mindshare, down 6.6% since last year.

Application Security Tools

Web Application Firewall (WAF)

Featured Reviews

Syed Hasan

Specialist Leader at Deloitte

Partner experiences excellent technical support and seamless initial setup

In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

Read full review

Mitesh D Patel

Senior Technical Consultant- Cyber Security at Ivalue Infosolution

Effectively defends against threats like cross-site scripting (XSS), SQL injection, and others

It does bring value. For example, consider a BFSI customer. Their application is critical and represents their brand. Without a WAF, an attack could take their application down, harming their reputation. It leads to hampering the customer's workflow. With an Imperva WAF, they protect against attacks like DDoS or SQL injection, ensuring their application remains available and customers are happy. That's the main benefit for both the customer and the organization. The impact depends on the customer's use case. If their business primarily operates online, a CDN is beneficial for traffic optimization. Moreover, the integration options depend on the specific use case of our customers. Generally, integration capabilities are good with SIEM (Security Information and Event Management) parts.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The only thing I like is that Checkmarx does not need to compile."

"The most valuable features of Checkmarx are the automation and information that it provides in the reports."

"I like that you don't have to compile the code in order to execute static code analysis. So, it's very handy."

"The solution is scalable, but other solutions are better."

"From my point of view, it is the best product on the market."

"The feature that I have found most valuable is that its number of false positives is less than the other security application platforms. Its ease of use is another good feature. It also supports most of the languages."

"The most valuable features of Checkmarx are the SCA module and the code-checking module. Additionally, the solutions are explanatory and helpful."

"Less false positive errors as compared to any other solution."

More Checkmarx One pros

"The WAF itself has been very valuable to me because it has such a complete range of features. Another reason why I like it is because it also takes care of the total overview of the traffic over the network."

"Learning mode and custom policies are helpful features."

"Data masking is the most valuable feature of this solution."

"There are many features. There is ease of deployment. You can deploy the Imperva Web Application Firewall in two to three minutes. After that, you have to set the policies. For setting policies, you have toggle buttons. You can turn something on or off."

"There are a number of features that are valuable such as the account takeover and various antivirus features."

"There are some features that are configured by default, so even without doing much, it can still provide a level of protection."

"Imperva is easy to use and deploy. The UI is excellent."

"Compared to other web application firewalls in the market, Imperva does things in the most accurate way."

More Imperva Web Application Firewall pros

Cons

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."

"Checkmarx could improve the solution reports and false positives. The false positives could be reduced. For example, we have alerts that are tagged as vulnerabilities but when you drill down they are not."

"We would like to be able to run scans from our local system, rather than having to always connect to the product server, which is a longer process."

"Its user interface could be improved and made more friendly."

"Checkmarx reports many false positives that we need to manually segregate and mark “Not exploitable”."

"They can support the remaining languages that are currently not supported. They can also create a different model that can identify zero-day attacks. They can work on different patterns to identify and detect zero-day vulnerability attacks."

"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

More Checkmarx One cons

"The product's customization capabilities are a bit problematic, requiring support cases for backend modifications."

"I am looking for more data enrichment. We should have the ability to add our own custom data to the system, to the live traffic."

"There's always room for improvement. Occasionally, there might be false-positive alerts."

"The tool needs to improve CPU and storage memory."

"An improvement for Imperva WAF would be to reduce the number of false positives and create more strong use cases based on AI/ML or behavioral analytics."

"Their portal is very limited and needs improvement."

"Sometimes our web application firewall will slow down."

"One potential improvement for Imperva is enhancing its alert system."

More Imperva Web Application Firewall cons

Pricing and Cost Advice

"I believe pricing is better compared to other commercial tools."

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"It's relatively expensive."

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."

"The tool's pricing is fine."

"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."

"The interface used to create custom rules comes at an additional cost."

"The solution is costly."

More Checkmarx One pricing and cost advice

"Make sure you understand the way that Imperva charges. It's very affordable. However, I would like to see a package with the Virtual Patching included. You get to do patching separately."

"The solution's pricing is an issue."

"The pricing is somewhat expensive. It is actually a huge investment when compared to other countries."

"The price of Imperva Web Application Firewalls is expensive compared to others."

"There are a couple of different licensing models."

"Licensing can range from one to twenty thousand dollars annually. Additionally, some features, including software support, require an annual subscription as well."

"Imperva Web Application Firewall's pricing is expensive."

"There is a license for this solution and we purchase the license annually with no additional fees."

More Imperva Web Application Firewall pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

862,543 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

20%

Computer Software Company

14%

Manufacturing Company

10%

Government

Financial Services Firm

16%

Computer Software Company

12%

Insurance Company

Manufacturing Company

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

See all answers

Which is the best DDoS protection solution for a big ISP for monitoring and mitigating?

My recommendation is Imperva.

See all answers

Is Citrix ADC (formerly Netscaler) the best ADC to use and if not why?

For ADC, any ADC can do a good job. But in case if you want to add WAF functionality to the same ADC hardware you have to look for other ADC's like F5, Imperva, Radware, Fortinet, etc.

See all answers

DDoS solutions: Any other solutions to consider aside from Radware DDoS Protection Service and F5 Silverline DDoS Protection?

You can have a look to Imperva Cloud WAF, the anti-DDoS mitigation is under 1s and works very well. I observed a lot of DDoS attacks that were well managed (even not seen by the customer) by Imperv...

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs Checkmarx One

Compared 38% of the time

Veracode vs Checkmarx One

Compared 11% of the time

Checkmarx SAST vs Checkmarx One

Compared 7% of the time

OpenText Core Application Security vs Checkmarx One

Compared 5% of the time

OWASP Zap vs Checkmarx One

Compared 5% of the time

More Checkmarx One Competitors

Microsoft Azure Application Gateway vs Imperva Web Application Firewall

Compared 15% of the time

F5 Advanced WAF vs Imperva Web Application Firewall

Compared 12% of the time

Azure Front Door vs Imperva Web Application Firewall

Compared 9% of the time

AWS WAF vs Imperva Web Application Firewall

Compared 8% of the time

Fortinet FortiWeb vs Imperva Web Application Firewall

Compared 6% of the time

More Imperva Web Application Firewall Competitors

Product Reports

Buyer's Guide

Checkmarx One

July 2025

Download Checkmarx One product report

Buyer's Guide

Imperva Web Application Firewall

July 2025

Download Imperva Web Application Firewall product report

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Imperva Web Application Firewall is a versatile solution that protects web applications and databases from various attacks, including DDoS, cross-site scripting, and SQL injection attacks. It offers data security, availability, and access control and can be deployed on-premises or on the cloud.

The solution has good security against web attacks and offers advanced bot protection, API security, and mitigation features. Imperva WAF is easy to configure and deploy; it has good customer service and an excellent user interface.

Imperva

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

BlueCross BlueShield, eHarmony, EMF Broadcasting, GE Healthcare, Metro Bank, The Motley Fool, Siemens

Buyer's Guide

Checkmarx One vs. Imperva Web Application Firewall

March 2019

Free Report: Checkmarx One vs. Imperva Web Application Firewall

Find out what your peers are saying about Checkmarx One vs. Imperva Web Application Firewall and other solutions. Updated: March 2019.

DOWNLOAD NOW

862,543 professionals have used our research since 2012.

See our Checkmarx One vs. Imperva Web Application Firewall report.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.