I currently work for a global product engineering and lifecycle services partner.
We are currently evaluating Checkmarx and SonarQube for our PoC. What are the biggest differences between the two? Which would you recommend?
Thanks! I appreciate the help.
SonarQube historically was focused on Code Quality and Best Practices. Recently the enterprise and data center versions provide some security vulnerabilities detection with OWASP compliance. This is not enough. If you are focused on Secure Coding, Checkmarx is much better. Most of the enterprise customers use to work with CheckMarx and SonarQube (free version) together in order to detect Security and Quality/Best Practices Issues.
I’ve always viewed sonarqube as a code quality tool that compliments many code security tools like a checkmarx.
The major difference I have seen between Checkmarx and SonarQube is :
CheckMarx support: Supports a large number of languages and finds a large variety of potential risks.
Apart from this, I don't see any big differences.