We performed a comparison between Checkmarx and OWASP Zap based on real PeerSpot user reviews.
Find out in this report how the two Application Security Testing (AST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."
"The main thing we find valuable about Checkmarx is the ease of use. It's easy to initiate scans and triage defects."
"The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results."
"The SAST component was absolutely 100% stable."
"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."
"The solution is scalable, but other solutions are better."
"The UI is user-friendly."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"The solution has tightened our security."
"It's great that we can use it with Portswigger Burp."
"The product discovers more vulnerabilities compared to other tools."
"Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope."
"You can run it against multiple targets."
"The most valuable feature is scanning the URL to drill down all the different sites."
"The product helps users to scan and fix vulnerabilities in the pipeline."
"The HUD is a good feature that provides on-site testing and saves a lot of time."
"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."
"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."
"Checkmarx has a slightly difficult compilation with the CI/CD pipeline."
"Checkmarx could improve the REST APIs by including automation."
"Checkmarx is not good because it has too many false positive issues."
"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."
"Checkmarx could be improved with more integration with third-party software."
"Its user interface could be improved and made more friendly."
"They stopped their support for a short period. They've recently started to come back again. In the early days, support was much better."
"There isn't too much information about it online."
"The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more."
"ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline."
"The product should allow users to customize the report based on their needs."
"Lacks resources where users can internally access a learning module from the tool."
"The solution is unable to customize reports."
"There are too many false positives."
Checkmarx is ranked 3rd in Application Security Testing (AST) with 23 reviews while OWASP Zap is ranked 8th in Application Security Testing (AST) with 11 reviews. Checkmarx is rated 7.6, while OWASP Zap is rated 7.2. The top reviewer of Checkmarx writes "Supports different languages, has excellent support, and easily expands". On the other hand, the top reviewer of OWASP Zap writes "Stable dynamic testing solution with unreliable manual processes". Checkmarx is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and SonarCloud, whereas OWASP Zap is most compared with PortSwigger Burp Suite Professional, SonarQube, Acunetix, Qualys Web Application Scanning and Fortify on Demand. See our Checkmarx vs. OWASP Zap report.
See our list of best Application Security Testing (AST) vendors.
We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
