Checkmarx vs OWASP Zap comparison

You must select at least 2 products to compare!
Checkmarx Logo
35,146 views|24,005 comparisons
24,584 views|11,853 comparisons
Comparison Buyer's Guide
Executive Summary

We performed a comparison between Checkmarx and OWASP Zap based on real PeerSpot user reviews.

Find out in this report how the two Application Security Testing (AST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
To learn more, read our detailed Checkmarx vs. OWASP Zap Report (Updated: November 2023).
745,341 professionals have used our research since 2012.
Featured Review
Quotes From Members
We asked business professionals to review the solutions they use.
Here are some excerpts of what they said:
"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools.""The main thing we find valuable about Checkmarx is the ease of use. It's easy to initiate scans and triage defects.""The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results.""The SAST component was absolutely 100% stable.""The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera.""The solution is scalable, but other solutions are better.""The UI is user-friendly.""The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."

More Checkmarx Pros →

"The solution has tightened our security.""It's great that we can use it with Portswigger Burp.""The product discovers more vulnerabilities compared to other tools.""Two features are valuable. The first one is that the scan gets completed really quickly, and the second one is that even though it searches in a limited scope, what it does in that limited scope is very good. When you use Zap for testing, you're only using it for specific aspects or you're only looking for certain things. It works very well in that limited scope.""You can run it against multiple targets.""The most valuable feature is scanning the URL to drill down all the different sites.""The product helps users to scan and fix vulnerabilities in the pipeline.""The HUD is a good feature that provides on-site testing and saves a lot of time."

More OWASP Zap Pros →

"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to.""One area for improvement in Checkmarx is pricing, as it's more expensive than other products.""Checkmarx has a slightly difficult compilation with the CI/CD pipeline.""Checkmarx could improve the REST APIs by including automation.""Checkmarx is not good because it has too many false positive issues.""I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side.""Checkmarx could be improved with more integration with third-party software.""Its user interface could be improved and made more friendly."

More Checkmarx Cons →

"They stopped their support for a short period. They've recently started to come back again. In the early days, support was much better.""There isn't too much information about it online.""The work that it does in the limited scope is good, but the scope is very limited in terms of the scanning features. The number of things it tests or finds is limited. They need to make it a more of a mainstream tool that people can use, and they can even think about having it on a proprietary basis. They need to increase the coverage of the scan and the results that it finds. That has always been Zap's limitation. Zap is a very good tool for a beginner, but once you start moving up the ladder where you want further details and you want your scan to show more in-depth results, Zap falls short because its coverage falls short. It does not have the capacity to do more.""ZAP's integration with cloud-based CICD pipelines could be better. The scan should run through the entire pipeline.""The product should allow users to customize the report based on their needs.""Lacks resources where users can internally access a learning module from the tool.""The solution is unable to customize reports.""There are too many false positives."

More OWASP Zap Cons →

Pricing and Cost Advice
  • "We have purchased an annual license to use this solution. The price is reasonable."
  • "We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."
  • "The price of Checkmarx could be reduced to match their competitors, it is expensive."
  • "The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."
  • "If you want more, you have to pay more. You have to pay for additional modules or functionalities."
  • "Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
  • "I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."
  • "The solution is costly."
  • More Checkmarx Pricing and Cost Advice →

  • "We have used the freeware version. I believe Zap only has freeware."
  • "The solution’s pricing is high."
  • More OWASP Zap Pricing and Cost Advice →

    Use our free recommendation engine to learn which Application Security Testing (AST) solutions are best for your needs.
    745,341 professionals have used our research since 2012.
    Questions from the Community
    Top Answer:I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
    Top Answer:The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility.
    Top Answer:The solution's price is high and you pay based on the number of users.
    Top Answer:OWASP Zap and PortSwigger Burp Suite Pro have many similar features. OWASP Zap has web application scanning available with basic security vulnerabilities while Burp Suite Pro has it available with… more »
    Top Answer:The product helps users to scan and fix vulnerabilities in the pipeline.
    Average Words per Review
    Average Words per Review
    Learn More

    Checkmarx is a highly accurate and flexible static code analysis product that allows organizations to automatically scan uncompiled code and identify hundreds of security vulnerabilities in all major coding languages and software frameworks. Checkmarx is available as a standalone product and can be effectively integrated into the software development lifecycle (SDLC) to streamline vulnerability detection and remediation. Checkmarx is trusted by leading organizations such as SAP, Samsung, and

    Checkmarx is a global leader in software security solutions for modern software development. Checkmarx delivers a comprehensive software security platform that unites with DevOps by scanning uncompiled source code for security vulnerabilities early in the development life cycle to reduce and remediate risk from software vulnerabilities. Using Checkmarx, teams avoid software security vulnerabilities managed via a single and unified dashboard without slowing down their delivery schedule.

    Checkmarx balances the needs of the entire organization, delivering seamless security from the start and throughout the entire software development life cycle. Checkmarx can be deployed on-premises in a private data center or hosted via a public cloud.

    Checkmarx Features

    Some of Checkmarx’s features include:

    • Source code scanning: Detect and repair more vulnerabilities before you release your code.

    • Open-source scanning: Find and eliminate the risks in your open-source code.

    • Interactive code scanning: Scan for vulnerabilities and runtime threats.

    • Open-source security for infrastructure as code: Identify and fix insecure IaC configurations that put your application at risk.

    Reviews from Real Users

    Checkmarx stands out among its competitors for a number of reasons. Two major ones are its ability to enable developers to secure their code with a single management dashboard and its high-speed scanning abilities.

    PeerSpot users note the effectiveness of these features. A CEO at a tech services company writes, “The most valuable features are the easy-to-understand interface, and it’s very user-friendly. We spend some time tuning to start scanning a new project, which is only a few clicks. A few simple tunes for custom rules and we can start our scan. We can do the work quickly and we don't need to compile the source code because Checkmarx does the work without compiling the project. The scanning is very quick. It's about 20,000 lines per hour, which is a good speed for scanning.”

    A director at a tech services company notes, “The features and technologies are very good. The flexibility and the roadmap have also been very good. They're at the forefront of delivering the additional capabilities that are required with cloud delivery, etc. Their ability to deliver what customers require and when they require is very important.”

    A senior manager at a manufacturing company writes, “The identification of verification-related security vulnerabilities is really important and one of the key things. It also identifies vulnerabilities for any kind of third-party tool coming into the system or any third-party tools that you are using, which is very useful for avoiding random hacking."

    OWASP Zap is a free and open-source web application security scanner. 

    The solution helps developers identify vulnerabilities in their web applications by actively scanning for common security issues. 

    With its user-friendly interface and powerful features, Zap is a popular choice among developers for ensuring the security of their web applications.

    Learn more about Checkmarx
    Learn more about OWASP Zap
    Sample Customers
    YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
    1. Google 2. Microsoft 3. IBM 4. Amazon 5. Facebook 6. Twitter 7. LinkedIn 8. Netflix 9. Adobe 10. PayPal 11. Salesforce 12. Cisco 13. Oracle 14. Intel 15. HP 16. Dell 17. VMware 18. Symantec 19. McAfee 20. Citrix 21. Red Hat 22. Juniper Networks 23. SAP 24. Accenture 25. Deloitte 26. Ernst & Young 27. PwC 28. KPMG 29. Capgemini 30. Infosys 31. Wipro 32. TCS
    Top Industries
    Computer Software Company34%
    Financial Services Firm21%
    Manufacturing Company10%
    Comms Service Provider7%
    Financial Services Firm23%
    Computer Software Company15%
    Manufacturing Company8%
    Insurance Company6%
    Computer Software Company29%
    Financial Services Firm18%
    Energy/Utilities Company12%
    Computer Software Company19%
    Financial Services Firm10%
    Comms Service Provider8%
    Company Size
    Small Business38%
    Midsize Enterprise14%
    Large Enterprise48%
    Small Business16%
    Midsize Enterprise11%
    Large Enterprise73%
    Small Business15%
    Midsize Enterprise30%
    Large Enterprise55%
    Small Business21%
    Midsize Enterprise15%
    Large Enterprise64%
    Buyer's Guide
    Checkmarx vs. OWASP Zap
    November 2023
    Find out what your peers are saying about Checkmarx vs. OWASP Zap and other solutions. Updated: November 2023.
    745,341 professionals have used our research since 2012.

    Checkmarx is ranked 3rd in Application Security Testing (AST) with 23 reviews while OWASP Zap is ranked 8th in Application Security Testing (AST) with 11 reviews. Checkmarx is rated 7.6, while OWASP Zap is rated 7.2. The top reviewer of Checkmarx writes "Supports different languages, has excellent support, and easily expands". On the other hand, the top reviewer of OWASP Zap writes "Stable dynamic testing solution with unreliable manual processes". Checkmarx is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and SonarCloud, whereas OWASP Zap is most compared with PortSwigger Burp Suite Professional, SonarQube, Acunetix, Qualys Web Application Scanning and Fortify on Demand. See our Checkmarx vs. OWASP Zap report.

    See our list of best Application Security Testing (AST) vendors.

    We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.