Checkmarx One vs Veracode comparison

Checkmarx and Veracode are both solutions in the Application Security Tools category. Checkmarx is ranked #3 with an average rating of 8.2, while Veracode is ranked #2 with an average rating of 8.1. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 2, 2025

Veracode and Checkmarx One compete in the application security testing category. Veracode seems to have an edge due to its comprehensive AppSec training and integration capabilities.

Features: Veracode offers robust scanning capabilities and an API for seamless integration, making it ideal for automated DevOps environments like Jenkins. Its comprehensive vulnerability management includes static, dynamic, and software composition analysis, all within a SaaS model, reducing infrastructure overhead. Checkmarx One stands out with its extensive language support and strong SAST capabilities that do not require code compilation, offering deep insights into code analysis with customizable rules and results with fewer false positives.

Room for Improvement: Veracode could improve the accuracy of its reporting and work on reducing false positives and enhancing its interface and API integration based on user feedback. Checkmarx One could benefit from improving false-positive rates and enhancing integration, especially with dynamic and API security. Users are also looking for better support for emerging technologies and more flexible pricing for smaller teams.

Ease of Deployment and Customer Service: Veracode is praised for its cloud-based deployment flexibility across private, public, and hybrid configurations, and its responsive customer service. However, users note delays in resolution times. Checkmarx One offers primarily on-premises deployment with cloud options, which can suit complex security requirements. Its customer support excels in initial integration assistance.

Pricing and ROI: Veracode's higher cost is attributed to its rich features and services like eLearning, which provides value for larger enterprises but might be costly for smaller organizations. Feedback suggests a positive ROI through reduced testing and quality assurance time. Checkmarx One is similarly priced but justified by its comprehensive scanning and reduced false positives, offering scalability for a lower total cost of ownership.

To learn more, read our detailed Checkmarx One vs. Veracode Report (Updated: January 2026).

Buyer's Guide

Checkmarx One vs. Veracode

January 2026

Download the complete report

Helped 881,346 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex Cloud by Palo Alto N...

Q&A Highlights

it_user1354977

Works at Securities America

Jul 08, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

My opinions are my own and do not represent any other entities that I may be or have been affiliated with. On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon. As for Checkmarx vs SonarQube... Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse. SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it. I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission. In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode. Hope that helps

See all answers

Featured Reviews

Nuno-Santos

Cybersecurity Analyst at a tech services company with 11-50 employees

Has improved real-time threat detection and unified cloud protection through AI and automation

Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent. They changed the names of the products and are now clarifying their offer. The family of the products is not easy to follow because it's very recent. Regarding the generative AI security tool, I know for sure it's Agentic. Based on my experience with Palo Alto, I can suggest what Cortex Cloud by Palo Alto Networks could make better or what additional functions could be added. This is the best tool in the market. It's not the time to tell what they could do better because it's a recent tool. The market is now adopting it. Our experience doesn't show that they need to do more.

Read full review

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."

"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."

"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."

"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."

"It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc)."

"Our static operation security has been able to identify more security issues since implementing this solution."

"Checkmarx One has positively impacted my organization because in the past, when Checkmarx One scan was not implemented, we faced a lot of issues finding vulnerabilities inside the repository, but now, since we have integrated Checkmarx One into our repository, we can smoothly and very easily find vulnerabilities and manage those effectively."

"The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes."

"The UI is very intuitive and simple to use."

"I have seen a return on investment from Checkmarx One."

"The most valuable feature is that it actually identifies the different criteria you can set to meet whatever standards you're trying to get your system accredited for."

"From my point of view, it is the best product on the market."

More Checkmarx One pros

"Using an automated tool brings cost reduction and more security."

"The static scan is the most valuable feature."

"Stable and scalable, with good reporting features. Helps in detecting and managing vulnerabilities and risks."

"The security team can track the remediation and risk acceptance statistics."

"Informs me of code security vulnerabilities. Bamboo build automation with Veracode API calls are used."

"The centralized view of different testing types helps reduce our risk exposure. The development teams have the freedom to choose their own libraries and languages. What happens is sometimes developers feel like a particular library is okay to use, then they will start using it, developing some functionality around it. However, as per our mandate, for every new repository that gets added and scanned, a report gets published. Based on that report, we decide if we can continue. In the past, we have found, by mistake, some developers have used copyleft licenses, which are a bit risky to use. We immediately replace these with more permissive, open-source licenses, so we are safe in the end."

"The solution is a specialist in SAST that you can rely on. Code scanning is fast with current, updated algorithms."

"Veracode's integration with our continuous integration solution is what I've found to be the most valuable feature. It is easy to connect the two and to run scans in an automated way without needing as much manual intervention."

More Veracode pros

Cons

"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."

"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."

"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."

"I really would like to integrate it as a service along with the SAP HANA Cloud Platform. It will then be easy to use it directly as a service."

"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."

"I would like to see the tool’s pricing improved."

"Checkmarx is not good because it has too many false positive issues."

"If it is a very large code base then we have a problem where we cannot scan it."

"For Checkmarx One, I think that adding repositories and scanning impromptu code could improve it."

"Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?"

"I would like to see the rate of false positives reduced."

More Checkmarx One cons

"Sometimes, the scans halt or drop for some reason, and we need to get help from Veracode to fix it."

"The scanning could be a little faster. The process around three or four minutes, but it would help if it could be further reduced."

"Scanning large amounts of code can be a time-consuming process and there is scope for improvement."

"It would be ideal if it was able to demonstrate higher levels of cybersecurity certifications like becoming FedRAMP compliant or working in those areas."

"False positives are a problem. Sometimes the flow paths are not accurate and don't represent real attack vectors, but this happens with every application that performs static analysis of the code. But it's under control. The number of false positives is not so high that it is unmanageable on our side."

"The scanning process could be more streamlined as it has certain limitations when performing manual scans."

"The current version of the application does not support testing for API."

"Calypso (our application) is large and the results take up to two months. Further, we also have to package Calypso in a special manner to meet size guidelines."

More Veracode cons

Pricing and Cost Advice

Information not available

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

"It's relatively expensive."

"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."

"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."

"It is the right price for quality delivery."

"The interface used to create custom rules comes at an additional cost."

"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."

"We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."

More Checkmarx One pricing and cost advice

"When I looked at the pricing, it was definitely a value. In terms of the service and what it's checking, the cost was very reasonable, particularly because we could have multiple code bases as part of a project."

"The pricing is fair."

"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."

"I know that Veracode is a semi-pricey solution. If you are serious about security, I would recommend that you use an open-source option to learn how the scanning process works and then look into Veracode if you want to really step up your game and have an all-in-one solution."

"The licensing and prices were upfront and clear. They stand behind everything that is said during the commercial phase and during the onboarding phase. Even the most irrelevant "that can be done" was delivered, no matter how important the request was."

"The licensing cost for Veracode is fair."

"The pricing for Veracode is high, making it difficult for beginners to afford."

"For our company, the price is reasonable for the benefits that we get."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

881,346 professionals have used our research since 2012.

Answers from the Community

it_user1354977

Works at Securities America

Jul 8, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

2 out of 3 answers

Donovan Greeff

Head of Software Delivery at a tech services company with 51-200 employees

Jul 6, 2020

Read full answer

Durga Gudimetla

Factory Head, Web (Digital), Social, Mobile Enterprise COE at a pharma/biotech company with 10,001+ employees

Jul 7, 2020

SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.

Read full answer

See all 3 answers

Top Industries

By visitors reading reviews

Performing Arts

10%

Financial Services Firm

Manufacturing Company

Computer Software Company

Financial Services Firm

18%

Computer Software Company

10%

Manufacturing Company

10%

Government

Financial Services Firm

17%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	44
Large Enterprise	115

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?

The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...

See all answers

What needs improvement with Cortex Cloud by Palo Alto Networks?

Regarding areas for improvement, the tool performs its functions well, but frequent name changes across Palo Alto Net...

See all answers

What is your primary use case for Cortex Cloud by Palo Alto Networks?

Cortex Cloud by Palo Alto Networks serves as our primary tool for understanding our assets and performing API integra...

See all answers

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Prisma Cloud by Palo Alto Networks vs Cortex Cloud by Palo Alto Networks

Compared 18% of the time

Wiz vs Cortex Cloud by Palo Alto Networks

Compared 17% of the time

Microsoft Defender for Cloud vs Cortex Cloud by Palo Alto Networks

Compared 8% of the time

SentinelOne Singularity Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 8% of the time

FortiCNAPP vs Cortex Cloud by Palo Alto Networks

Compared 3% of the time

More Cortex Cloud by Palo Alto Networks Competitors

SonarQube vs Checkmarx One

Compared 48% of the time

Checkmarx SAST vs Checkmarx One

Compared 4% of the time

OpenText Core Application Security vs Checkmarx One

Compared 3% of the time

OWASP Zap vs Checkmarx One

Compared 2% of the time

GitHub Advanced Security vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

SonarQube vs Veracode

Compared 11% of the time

GitHub Advanced Security vs Veracode

Compared 5% of the time

Coverity Static vs Veracode

Compared 3% of the time

OWASP Zap vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Cortex Cloud by Palo Alto Networks

January 2026

Cortex Cloud by Palo Alto Networks report

Download Cortex Cloud by Palo Alto Networks product report

Buyer's Guide

Checkmarx One

January 2026

Download Checkmarx One product report

Buyer's Guide

Veracode

January 2026

Download Veracode product report

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

Cortex Cloud by Palo Alto Networks provides comprehensive cybersecurity management, focusing on enhancing security operations with advanced automation and threat intelligence, addressing complex security challenges efficiently.

Cortex Cloud by Palo Alto Networks integrates cloud-scale data analytics and automation to streamline security operations, enabling faster threat detection and response. It leverages AI and machine learning to provide real-time threat intelligence and automate routine tasks, reducing the burden on security teams. Users benefit from improved visibility across networks and greater operational efficiency, making it crucial for enterprises aiming to secure their digital assets against evolving cyber threats.

What are the key features of Cortex Cloud by Palo Alto Networks?

Automated Threat Detection: Identifies and mitigates threats in real-time using AI algorithms.
Advanced Analytics: Provides in-depth data insights for proactive threat prevention.
Incident Management: Streamlines incident response with automated workflows.
Scalable Architecture: Offers flexibility to grow with organizational needs.

What benefits or ROI should you expect from Cortex Cloud by Palo Alto Networks reviews?

Increased Efficiency: Automation reduces manual efforts in threat management.
Enhanced Security Posture: Improved visibility leads to better threat preparedness.
Cost Savings: Minimizes expenses related to manual threat detection and response.
Scalability: Grows with the organization, reducing the need for constant upgrades.

Cortex Cloud by Palo Alto Networks is favored in sectors like finance, healthcare, and telecommunications, where data security is paramount. Its ability to integrate with existing infrastructure and provide real-time insights makes it a preferred choice for securing sensitive information and ensuring compliance within industry regulations.

Palo Alto Networks

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Checkmarx One vs. Veracode

January 2026

Free Report: Checkmarx One vs. Veracode

Find out what your peers are saying about Checkmarx One vs. Veracode and other solutions. Updated: January 2026.

DOWNLOAD NOW

881,346 professionals have used our research since 2012.

See our Checkmarx One vs. Veracode report.

See our list of best Application Security Tools vendors, best Static Application Security Testing (SAST) vendors, and best Container Security vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.