No more typing reviews! Try our Samantha, our new voice AI agent.

Apiiro vs Checkmarx One comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Apiiro
Ranking in Static Application Security Testing (SAST)
27th
Ranking in API Security
16th
Ranking in Risk-Based Vulnerability Management
20th
Ranking in Application Security Posture Management (ASPM)
10th
Average Rating
8.0
Reviews Sentiment
5.9
Number of Reviews
3
Ranking in other categories
Software Composition Analysis (SCA) (18th), Software Supply Chain Security (11th)
Checkmarx One
Ranking in Static Application Security Testing (SAST)
2nd
Ranking in API Security
5th
Ranking in Risk-Based Vulnerability Management
9th
Ranking in Application Security Posture Management (ASPM)
4th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
81
Ranking in other categories
Application Security Tools (2nd), Vulnerability Management (12th), Container Security (15th), Static Code Analysis (2nd), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (3rd), AI Security (3rd)
 

Mindshare comparison

As of October 2026, in the Application Security Posture Management (ASPM) category, the mindshare of Apiiro is 5.5%, up from 4.0% compared to the previous year. The mindshare of Checkmarx One is 8.6%, down from 11.3% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Posture Management (ASPM) Mindshare Distribution
ProductMindshare (%)
Checkmarx One8.6%
Apiiro5.5%
Other85.9%
Application Security Posture Management (ASPM)
 

Featured Reviews

Kunal M - PeerSpot reviewer
Capability Center Leader, ETRM Platforms at Shell
Comprehensive risk analysis helps identify key performance trends but report access needs improvement
My first feedback for Apiiro is that it is very slow, extremely slow. The moment I select from the entire list of repositories in my vertical, which is almost more than 400 repositories, it takes a lot of time for me to load the report. Sometimes it fails. I do not have Role-Based Access Control (RBAC). It's only given to the application security team, and Apiiro as a vendor does not have the rollback access control enabled for the clients, so that would have given me access to the reports tab, which would have made my life easier. Currently, I have to go to the risks tab to pull out all this information. I started exploring dashboards with Copilot. I need to reach out to the Apiiro teams to see if I can get an access token so that I can pull out a Power BI dashboard. I think Apiiro definitely has its own capabilities, but if there are access tokens that teams can use to build a custom dashboard, that would be great. This might already exist, but that is something which will ease the vulnerability management day-to-day activities.
Shahzad Shahzad - PeerSpot reviewer
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution
Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance
Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The positive impact I have seen from working with Apiiro for my company includes the metrics that we get from Apiiro, which have been extremely helpful."
"Apiiro's secrets detection feature has saved us several times, which we appreciate greatly."
"The workflow automation is likely the best aspect of the solution."
"It moved our organization towards being agile vs. waterfall."
"We have been using this product extensively for a lot of applications to identify as well as employ proper remediation which makes the application secure including information issues which might get neglected with a manual code review process."
"The reports are very good because they include details on the code level, and make suggestions about how to fix the problems."
"It is a stable product."
"The most valuable feature is the simple user interface."
"Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before."
"Checkmarx is probably one of the best static code analyzers available in the market at this point."
"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."
 

Cons

"My first feedback for Apiiro is that it is very slow, extremely slow."
"User management is a little bit clunky."
"I would like support for our self-hosted Git server, other than GitHub, just regular Git."
"Checkmarx could improve the solution reports and false positives. The false positives could be reduced. For example, we have alerts that are tagged as vulnerabilities but when you drill down they are not."
"Checkmarx reports many false positives that we need to manually segregate and mark “Not exploitable”."
"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."
"They should make it more container-friendly and optimized for the CI pipeline. They should make it a little less heavy. Right now, it requires a SQL database, and the way the tool works is that it has an engine and then it has an analysis database in which it stores the information. So, it is pretty heavy from that perspective because you have to have a full SQL Server. They're working on something called Checkmarx Light, which is a slim-down version. They haven't released it yet, but that's what we need. There should be something a little more slimmed down that can just run the analysis and output the results in a format that's readable as opposed to having a full, really big, and thick deployment with a full database server."
"The stability of Checkmarx could improve. We're having issues with it, and the scan reliability is sometimes impacted so we sometimes have to restart the services to allow scans out of the queue."
"It needs better role management."
"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
 

Pricing and Cost Advice

Information not available
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"For around 250 users or committers, the cost is approximately $500,000."
"We're using a commercial version of Checkmarx, and we paid for the solution for one year. The price is high and could be reduced."
"The solution is costly."
"The price of Checkmarx could be reduced to match their competitors, it is expensive."
"It is an expensive solution."
"The tool's pricing is fine."
"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."
report
Use our free recommendation engine to learn which Application Security Posture Management (ASPM) solutions are best for your needs.
916,240 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
14%
Manufacturing Company
11%
Construction Company
8%
Comms Service Provider
8%
Financial Services Firm
14%
Manufacturing Company
9%
Outsourcing Company
7%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise9
Large Enterprise46
 

Questions from the Community

What needs improvement with Apiiro?
One area Apiiro could improve is reporting customization and dashboard flexibility with more advanced filtering and easier communication.
What is your primary use case for Apiiro?
Apiiro is primarily used for code scanning and integration with source code control. The main use cases include code scanning and code snippet analysis. Apiiro provides security and visibility by h...
What advice do you have for others considering Apiiro?
I would highly recommend Apiiro and a clear understanding of the API landscape and integration requirements before implementing it. Apiiro provides the most value to organizations that have multipl...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Checkmarx?
Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...
 

Comparisons

 

Also Known As

Apiiro Control Plane (ASOC), Apiiro API Security (SAST), Apiiro Open Source (SCA)
No data available
 

Overview

 

Sample Customers

Morgan Stanley, Rakuten, Jack Henry, SoFi, Colgate, Navan
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about Apiiro vs. Checkmarx One and other solutions. Updated: September 2026.
916,240 professionals have used our research since 2012.