Checkmarx One vs Veracode comparison

Checkmarx and Veracode are both solutions in the Application Security Tools category. Checkmarx is ranked #2 with an average rating of 8.2, while Veracode is ranked #3 with an average rating of 8.0. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Feb 8, 2026

Veracode and Checkmarx One are two prominent tools competing in the secure software development category. Checkmarx One seems to have the upper hand thanks to its efficient handling of false positives and its dynamic developer training platform, Codebashing.

Features: Veracode provides robust static analysis for multiple languages, scalable APIs, and IDE integrations, also featuring Greenlight for early code assessments and superior third-party library support. Checkmarx One offers its Codebashing platform for developer training, broad language support including newer languages, and excels in real-time scanning for fast-moving development environments.

Room for Improvement: Veracode experiences longer report processing times and higher false positive counts, with concerns about its outdated user interface and limited language support for newer integrations. Checkmarx One lacks strong mobile application support and a fully matured DAST, alongside user interface complexity issues and cumbersome CI/CD integration setup. Reducing false positives and enhancing API integration are also noted areas for improvement.

Ease of Deployment and Customer Service: Veracode is predominantly used in public cloud settings with easy scalability and tool integration, yet limited private cloud options. Checkmarx One provides flexible on-premises and cloud deployments, suitable for enterprises needing rigorous security measures. Both products have strong customer support, with Veracode facing occasional slow resolution times while Checkmarx One users value the hands-on support despite needing more real-time developer help.

Pricing and ROI: Veracode is priced higher, often seen as costly for smaller enterprises but justified by its extensive features and security benefits, with a flexible licensing model. Checkmarx One, though still expensive, offers good value for enterprises with consumption-based licensing options. Both tools contribute to ROI through reducing vulnerabilities and speeding up security compliance, although Veracode is slightly better in long-term operational savings.

To learn more, read our detailed Checkmarx One vs. Veracode Report (Updated: February 2026).

Buyer's Guide

Checkmarx One vs. Veracode

February 2026

Download the complete report

Helped 882,886 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex Cloud by Palo Alto N...

Q&A Highlights

it_user1354977

Works at Securities America

Jul 08, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

My opinions are my own and do not represent any other entities that I may be or have been affiliated with. On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon. As for Checkmarx vs SonarQube... Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse. SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it. I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission. In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode. Hope that helps

See all answers

Featured Reviews

reviewer1980216

Business Development Manager For Palo Alto Networks at a tech services company with 1,001-5,000 employees

Unified security platform has simplified multi-cloud protection and improved threat response

From the commercial perspective, we have some limitations because Palo Alto has a minimum number of users of endpoints set at 200, which is quite high for the Italian market. Additionally, there is not a clear MSP model compared to other vendors such as CrowdStrike. These are significant limitations, especially today when managed services are becoming increasingly important for end users. Palo Alto decided to limit some functionalities because they want to stress more on Cortex XSIAM. I do not agree with this strategy because Cortex XSIAM is a completely different market compared to Cortex XDR. This is the main issue of Cortex—the commercial model Palo Alto is implementing. The product is very good; the problem is the commercial model. There are probably some areas for improvement because Palo Alto is growing too much. Today the challenge is to have skilled people, which I believe is the same issue everywhere. I do not agree with this decision.

Read full review

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable features I have found in Cortex Cloud by Palo Alto Networks are those that we provided to customers in a stock environment, as we have done some POCs and tried to check how it can help different organizations, and this same solution has been positioned for multiple customers."

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."

"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."

"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."

"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."

"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."

"From a technical standpoint or pricing, Cortex Cloud by Palo Alto Networks is a stronger solution in the market at the moment compared to other products from ConnectWise or Symantec."

"The most beneficial aspect of Cortex Cloud by Palo Alto Networks and Palo Alto in general is that there is a single platform for all cloud providers for securitization."

"It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc)."

"The feature that I have found most valuable is that its number of false positives is less than the other security application platforms. Its ease of use is another good feature. It also supports most of the languages."

"Checkmarx One has positively impacted my organization, especially in our CI/CD integration, where when we try to build any feature, they are always scanned by Checkmarx before they get released."

"The most valuable feature is the simple user interface."

"The best thing about Checkmarx is the amount of vulnerabilities that it can find compared to other free tools."

"The SAST component was absolutely 100% stable."

"The tool's valuable features include integrating GPT and Copilot. Additionally, the UI web representation is very user-friendly, making navigation easy. GPT has made several improvements to my security code."

"Checkmarx One has positively impacted the organization, and since replacing the previous tool, SAST and SCA scans are conducted in a couple of minutes instead of hours or days, saving time and increasing speed to market by reducing the timeline from three or four days to one day only."

More Checkmarx One pros

"We used it for performing security checks. We have many Java applications and Android applications. Essentially it was used for checking the security validations for compliance purposes."

"It's comprehensive from a feature standpoint."

"This is a great tool for learning about potential vulnerabilities in code."

"From a developer's perspective, Veracode's greenlight feature on the IDE is helpful. It helps the developer to be more proactive in secure coding standards. Apart from that, static analysis scanning is definitely one of the top features of Veracode."

"There have been a lot of benefits gained from Veracode. Compared to other tools, Veracode has good flexibility with an easy way to run a scan. We get in-depth details on how to fix things and go through the process. They provide good process documents, community, and consultation for any issues that occur during the use of Veracode."

"It's hard to say that any single feature is the most essential. There are many errors and vulnerabilities in software today in the standard libraries for different vendors because. We don't need to reinvent the wheel every time because we're using standard libraries, and it's important to know that your security isn't compromised because you are using libraries with vulnerabilities."

"You can easily integrate it with Azure DevOps. This is an added value because we work with Azure DevOps. Veracode is natively supported and we don't have to work with APIs."

"The main feature, and one of the most important, is the static code analysis. We are able to complete an analysis of the security flaws with this platform. It's very good at helping us find and fix flaws."

More Veracode pros

Cons

"From the commercial perspective, we have some limitations because Palo Alto has a minimum number of users of endpoints set at 200, which is quite high for the Italian market."

"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."

"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."

"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."

"The negative aspects or areas for improvement in the product include the fact that the cost might be a bit high, which challenges commercials, but not technically."

"In my opinion, Cortex Cloud by Palo Alto Networks can be improved by addressing forensic information collection and storage, although I cannot suggest specific things right now, based on what customers might need."

"The validation process needs to be sped up."

"They can support the remaining languages that are currently not supported. They can also create a different model that can identify zero-day attacks. They can work on different patterns to identify and detect zero-day vulnerability attacks."

"Checkmarx could improve the REST APIs by including automation."

"The solution sometimes reports a false auditable code or false positive."

"Meta data is always needed."

"Checkmarx could improve the speed of the scans."

"The plugins for the development environment have room for improvements such as for Android Studio and X code."

"It provides us with quite a handful of false positive issues. If Checkmarx could reduce this number, it would be a great tool to use."

More Checkmarx One cons

"Scanning large amounts of code can be a time-consuming process and there is scope for improvement."

"The scanning could be a little faster. The process around three or four minutes, but it would help if it could be further reduced."

"It needs better APIs, reporting that I can easily query through the APIs and, preferably, a license model that I can predict."

"The JIRA integration automation aspect of it could be improved significantly. We want to have a way to create tickets that are going to allow people to work through those flaws that we're finding. We don't want people to feel like they're missing out on something or that they're not following directions in the right way."

"They cover a lot of languages already and it doesn't make sense for them to cover legacy languages but I know there is a need for covering legacy languages."

"When we implement a policy, it can be very difficult to locate."

"I've seen slightly better static analysis tools from other companies when it comes to speed and ease of use."

"There are times when certain modules cannot be scanned automatically, requiring us to manually select these modules and initiate the scanning process on our side."

More Veracode cons

Pricing and Cost Advice

Information not available

"We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."

"We have purchased an annual license to use this solution. The price is reasonable."

"The tool's pricing is fine."

"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."

"The pricing was not very good. This is just a framework which shouldn’t cost so much."

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."

"The average deal size was usually anywhere between $120K to $175K on an annual basis, which could be divided across 12 months."

More Checkmarx One pricing and cost advice

"Pricing/licensing is complicated."

"To my knowledge, licensing for Veracode Static Analysis is paid yearly by my company."

"For our company, the price is reasonable for the benefits that we get."

"Pricing-wise, I find it a bit expensive because it's based on the number of users requesting access to Veracode."

"Its pricing is fair."

"I recommend going for a one-year licensing with CA, because currently they are the leaders in this field with more features and a much better turn around time with a cheaper position, but there are a lot of new companies coming up in the market and they are building up their platforms."

"The pricing is pretty high."

"Veracode's pricing is on the higher end, but it is acceptable."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

882,886 professionals have used our research since 2012.

Answers from the Community

it_user1354977

Works at Securities America

Jul 8, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

2 out of 3 answers

Donovan Greeff

Head of Software Delivery at a tech services company with 51-200 employees

Jul 6, 2020

Read full answer

Durga Gudimetla

Factory Head, Web (Digital), Social, Mobile Enterprise COE at a pharma/biotech company with 10,001+ employees

Jul 7, 2020

SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.

Read full answer

See all 3 answers

Top Industries

By visitors reading reviews

Financial Services Firm

Performing Arts

Manufacturing Company

Computer Software Company

Financial Services Firm

17%

Manufacturing Company

10%

Computer Software Company

10%

Government

Financial Services Firm

17%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	6
Midsize Enterprise	1
Large Enterprise	2

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	44
Large Enterprise	115

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?

The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...

See all answers

What needs improvement with Cortex Cloud by Palo Alto Networks?

From the commercial perspective, we have some limitations because Palo Alto has a minimum number of users of endpoint...

See all answers

What is your primary use case for Cortex Cloud by Palo Alto Networks?

I use Cortex Cloud by Palo Alto Networks to secure cloud infrastructure during cloud transformation. For example, whe...

See all answers

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Wiz vs Cortex Cloud by Palo Alto Networks

Compared 18% of the time

Prisma Cloud by Palo Alto Networks vs Cortex Cloud by Palo Alto Networks

Compared 16% of the time

SentinelOne Singularity Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 7% of the time

Microsoft Defender for Cloud vs Cortex Cloud by Palo Alto Networks

Compared 7% of the time

Qualys Enterprise TruRisk Platform vs Cortex Cloud by Palo Alto Networks

Compared 3% of the time

More Cortex Cloud by Palo Alto Networks Competitors

SonarQube vs Checkmarx One

Compared 47% of the time

Checkmarx SAST vs Checkmarx One

Compared 3% of the time

OpenText Core Application Security vs Checkmarx One

Compared 3% of the time

OWASP Zap vs Checkmarx One

Compared 2% of the time

Fortify Software Security Center vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

SonarQube vs Veracode

Compared 10% of the time

GitHub Advanced Security vs Veracode

Compared 5% of the time

OWASP Zap vs Veracode

Compared 3% of the time

Coverity Static vs Veracode

Compared 3% of the time

HCL AppScan vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Cortex Cloud by Palo Alto Networks

February 2026

Cortex Cloud by Palo Alto Networks report

Download Cortex Cloud by Palo Alto Networks product report

Buyer's Guide

Checkmarx One

February 2026

Download Checkmarx One product report

Buyer's Guide

Veracode

January 2026

Download Veracode product report

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

Cortex Cloud by Palo Alto Networks provides comprehensive cybersecurity management, focusing on enhancing security operations with advanced automation and threat intelligence, addressing complex security challenges efficiently.

Cortex Cloud by Palo Alto Networks integrates cloud-scale data analytics and automation to streamline security operations, enabling faster threat detection and response. It leverages AI and machine learning to provide real-time threat intelligence and automate routine tasks, reducing the burden on security teams. Users benefit from improved visibility across networks and greater operational efficiency, making it crucial for enterprises aiming to secure their digital assets against evolving cyber threats.

What are the key features of Cortex Cloud by Palo Alto Networks?

Automated Threat Detection: Identifies and mitigates threats in real-time using AI algorithms.
Advanced Analytics: Provides in-depth data insights for proactive threat prevention.
Incident Management: Streamlines incident response with automated workflows.
Scalable Architecture: Offers flexibility to grow with organizational needs.

What benefits or ROI should you expect from Cortex Cloud by Palo Alto Networks reviews?

Increased Efficiency: Automation reduces manual efforts in threat management.
Enhanced Security Posture: Improved visibility leads to better threat preparedness.
Cost Savings: Minimizes expenses related to manual threat detection and response.
Scalability: Grows with the organization, reducing the need for constant upgrades.

Cortex Cloud by Palo Alto Networks is favored in sectors like finance, healthcare, and telecommunications, where data security is paramount. Its ability to integrate with existing infrastructure and provide real-time insights makes it a preferred choice for securing sensitive information and ensuring compliance within industry regulations.

Palo Alto Networks

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Checkmarx One vs. Veracode

February 2026

Free Report: Checkmarx One vs. Veracode

Find out what your peers are saying about Checkmarx One vs. Veracode and other solutions. Updated: February 2026.

DOWNLOAD NOW

882,886 professionals have used our research since 2012.

See our Checkmarx One vs. Veracode report.

See our list of best Application Security Tools vendors, best Static Application Security Testing (SAST) vendors, and best Container Security vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.