Try our new research platform with insights from 80,000+ expert users

Checkmarx One pros and cons

Vendor: Checkmarx

3.8 out of 5

70 reviews
86% willing to recommend

4,277 followers

Pros & Cons summary

Checkmarx One enables static application security testing of uncompiled code, integrating natively with major repository formats like Git and SVN. It offers pre-compile scanning and advanced vulnerability tracking capabilities, though some users report many false positives. The platform supports custom rules for code scanning and reviews during development, yet lacks compiled source code review and support for languages like C, C++, and VB. Pricing and Swift language support need improvements.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

Checkmarx One supports ongoing remediation by allowing SAST scanning of uncompiled code, seamlessly integrating with all key repository formats.

It enhances efficiency in handling software security vulnerabilities, identifying and offering fixes for these issues before the development cycle is complete, a capability that outperforms previous systems used.

Checkmarx One is recognized for its robustness in reducing false positives and providing deep insights into the security vulnerabilities with comprehensive reporting on code flaws and suggestions for remediation.

The tool can perform scans within 10 to 15 minutes, illustrating strong performance and supports scalability in managing security evaluations and integrations with various development tools.

With the Jenkins Plugin and capabilities for integration with both SCM solutions and CI/CD tools, Checkmarx One facilitates extensive automation in security testing across different development environments.

CONS

Checkmarx One requires improvement in expanding application languages and frameworks for vulnerability scanning, including mobile applications and open-source tools.

There are concerns about false positives, requiring manual segregation and marking as "Not exploitable," which could be reduced.

Support for additional languages like C, C++, and Swift, along with pricing improvements, is needed.

The ability to review compiled source code and enhance Dynamic Application Security Testing (DAST) and API security features could be improved.

Creating and editing custom rules is challenging due to limited accessibility and an additional cost for the license, combined with a steep learning curve.

Checkmarx One Pros review quotes

DR

Software Configuration Manager at a tech vendor with 501-1,000 employees

Jun 19, 2019

Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before.

Read full review

reviewer1523667

Penetration Tester & Information Security Expert at a comms service provider with 11-50 employees

Feb 7, 2024

The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes.

Read full review

Senior regional manager at AppDome

Jul 27, 2022

The SAST component was absolutely 100% stable.

Read full review

Free Report: Checkmarx One Reviews and More

Learn what your peers think about Checkmarx One. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.

815,854 professionals have used our research since 2012.

MD

Milind Dharmadhikari

Practice Head - IT Risk & Security Management Services at Suma Soft Private Limited

May 16, 2019

The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete.

Read full review

CEO at a tech services company with 11-50 employees

Jun 18, 2020

The most valuable features are the easy to understand interface, and it 's very user-friendly.

Read full review

DK

Vice President at Arisglobal Software Pvt Ltd

Jun 15, 2020

The solution is always updating to continuously add items that create a level of safety from vulnerabilities. It's one of the key features they provide that's an excellent selling point. They're always ahead of the game when it comes to finding any vulnerabilities within the database.

Read full review

reviewer1711191

Cybersecurity at a transportation company with 1,001-5,000 employees

May 3, 2022

I like that you don't have to compile the code in order to execute static code analysis. So, it's very handy.

Read full review

Cuneyt KALPAKOGLU Phd.

Founder & Chairman at Endpoint-labs Cyber Security R&D

Sep 6, 2020

From my point of view, it is the best product on the market.

Read full review

NH

Naveen Hariharan Vijaya

Security Consultant at IBM Thailand

Feb 9, 2024

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

Read full review

EB

Director and Co-Founder at Ushiro-tec

Apr 17, 2019

The most valuable features of Checkmarx are the Best Fix Location and the Payments option because you can save a lot of time trying to mitigate the configuration. Using these tools can save you a lot of time.

Read full review

Show 10 more reviews (out of 66)

Checkmarx One Cons review quotes

DR

Software Configuration Manager at a tech vendor with 501-1,000 employees

Jun 19, 2019

Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?

Read full review

reviewer1523667

Penetration Tester & Information Security Expert at a comms service provider with 11-50 employees

Feb 7, 2024

When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped.

Read full review

Senior regional manager at AppDome

Jul 27, 2022

The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement.

Read full review

Free Report: Checkmarx One Reviews and More

Learn what your peers think about Checkmarx One. Get advice and tips from experienced pros sharing their opinions. Updated: November 2024.

815,854 professionals have used our research since 2012.

MD

Milind Dharmadhikari

Practice Head - IT Risk & Security Management Services at Suma Soft Private Limited

May 16, 2019

The reports are good, but they still need to be improved considering what the UI offers.

Read full review

CEO at a tech services company with 11-50 employees

Jun 18, 2020

We have received some feedback from our customers who are receiving a large number of false positives.

Read full review

DK

Vice President at Arisglobal Software Pvt Ltd

Jun 15, 2020

In terms of dashboarding, the solution could provide a little more flexibility in terms of creating more dashboards. It has some of its own dashboards that come out of the box. However, if I have to implement my own dashboards that are aligned to my organization's requirements, that dashboarding feature has limited capability right now.

Read full review

reviewer1711191

Cybersecurity at a transportation company with 1,001-5,000 employees

May 3, 2022

They should make it more container-friendly and optimized for the CI pipeline. They should make it a little less heavy. Right now, it requires a SQL database, and the way the tool works is that it has an engine and then it has an analysis database in which it stores the information. So, it is pretty heavy from that perspective because you have to have a full SQL Server. They're working on something called Checkmarx Light, which is a slim-down version. They haven't released it yet, but that's what we need. There should be something a little more slimmed down that can just run the analysis and output the results in a format that's readable as opposed to having a full, really big, and thick deployment with a full database server.

Read full review

Cuneyt KALPAKOGLU Phd.

Founder & Chairman at Endpoint-labs Cyber Security R&D

Sep 6, 2020

Micro-services need to be included in the next release.

Read full review

NH

Naveen Hariharan Vijaya

Security Consultant at IBM Thailand

Feb 9, 2024

We can run only one project at a time.

Read full review

EB

Director and Co-Founder at Ushiro-tec

Apr 17, 2019

With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too.

Read full review

Show 10 more reviews (out of 66)

Related questions

286

What is the biggest difference between Veracode and Checkmarx?

53

Checkmarx or Veracode. Which should we choose?

1,440

What is the Biggest Difference Between Checkmarx and Fortify?

136

What is the biggest difference between Checkmarx and SonarQube?

190

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

1,004

If you had to both encrypt and compress data during transmission, which would you do first and why?

109

When evaluating Application Security, what aspect do you think is the most important to look for?

216

What are the Top 5 cybersecurity trends in 2022?

178

What are the threats associated with using ‘bogus’ cybersecurity tools?

29

Which application security solutions include both vulnerability scans and quality checks?