No more typing reviews! Try our Samantha, our new voice AI agent.

Apiiro vs Checkmarx One comparison

Why PeerSpot?
 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 8, 2024

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Apiiro
Ranking in Static Application Security Testing (SAST)
23rd
Ranking in API Security
15th
Ranking in Risk-Based Vulnerability Management
18th
Ranking in Application Security Posture Management (ASPM)
10th
Average Rating
8.6
Reviews Sentiment
6.4
Number of Reviews
4
Ranking in other categories
Software Composition Analysis (SCA) (15th), Software Supply Chain Security (10th)
Checkmarx One
Ranking in Static Application Security Testing (SAST)
2nd
Ranking in API Security
7th
Ranking in Risk-Based Vulnerability Management
10th
Ranking in Application Security Posture Management (ASPM)
4th
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
81
Ranking in other categories
Application Security Tools (2nd), Vulnerability Management (13th), Container Security (15th), Static Code Analysis (2nd), Dynamic Application Security Testing (DAST) (2nd), DevSecOps (3rd), AI Security (4th)
 

Mindshare comparison

As of November 2026, in the Application Security Posture Management (ASPM) category, the mindshare of Apiiro is 5.5%, up from 4.2% compared to the previous year. The mindshare of Checkmarx One is 8.6%, down from 11.0% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Posture Management (ASPM) Mindshare Distribution
ProductMindshare (%)
Checkmarx One8.6%
Apiiro5.5%
Other85.9%
Application Security Posture Management (ASPM)
 

Featured Reviews

Abimael Ferreira - PeerSpot reviewer
Security at Blaze Information Security
Centralized code analysis has improved my workflow and prioritizes critical vulnerabilities
Apiiro offers several features that I consider the best, such as the ability to have multiple developers and AppSec professionals working on the same project, and through the platform, we can see the number of vulnerabilities, generate reports, and integrate Snyk within our workflow. Before the code goes to production, Apiiro can read all that code and determine if everything is okay or if improvements are needed. The reports generated by Apiiro and its integration with Snyk contribute to my development process by giving us visibility into what is actually vulnerable, as automation like Apiiro makes it much easier to track vulnerabilities without spending too much time manually checking for issues, thus generating meaningful reports afterward. Apiiro manages permissions very effectively, which is interesting from an organizational standpoint because it allows us to separate which people can access a given project and designate project administrators who can approve or reject changes once a fix is made. I found the accuracy and reliability of Apiiro's results to be very good, as it can predict issues based on its existing data.
Shahzad Shahzad - PeerSpot reviewer
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution
Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance
Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"Apiiro's secrets detection feature has saved us several times, which we appreciate greatly."
"The positive impact I have seen from working with Apiiro for my company includes the metrics that we get from Apiiro, which have been extremely helpful."
"The workflow automation is likely the best aspect of the solution."
"Apiiro manages permissions very effectively, which is interesting from an organizational standpoint because it allows us to separate which people can access a given project and designate project administrators who can approve or reject changes once a fix is made."
"Overall, I use Checkmarx One as a strategic control point to improve developer velocity while strengthening application security across the full software lifecycle."
"In summary, this is a good application that you can use to scan every code language."
"The most valuable feature is the application tracking reporting."
"The biggest advantage we have seen is that we're able to develop and deliver secure solutions in a faster time."
"From my point of view, it is the best product on the market."
"Checkmarx One has positively impacted my organization because in the past, when Checkmarx One scan was not implemented, we faced a lot of issues finding vulnerabilities inside the repository, but now, since we have integrated Checkmarx One into our repository, we can smoothly and very easily find vulnerabilities and manage those effectively."
"In my opinion, Checkmarx gives better results, and its protection is better than SonarQube."
"It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc)."
 

Cons

"User management is a little bit clunky."
"My first feedback for Apiiro is that it is very slow, extremely slow."
"The UI sometimes helps but can also be a bit confusing."
"I would like support for our self-hosted Git server, other than GitHub, just regular Git."
"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."
"They could work to improve the user interface. Right now, it really is lacking."
"Vulnerability details: Reduce false positive results and improve it by providing more details how I can resolve the vulnerability."
"It could be improved with more reporting of false positives and the understanding of file references."
"It would be really helpful if the level of confidence was included, with respect to identified issues."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"We have received some feedback from our customers who are receiving a large number of false positives."
 

Pricing and Cost Advice

Information not available
"Its price is fair. It is in or around the right spot. Ultimately, if the price is wrong, customers won't commit, but they do tend to commit. It is neither too cheap nor too expensive."
"The solution's price is high and you pay based on the number of users."
"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
"For around 250 users or committers, the cost is approximately $500,000."
"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."
"We have purchased an annual license to use this solution. The price is reasonable."
"I believe pricing is better compared to other commercial tools."
"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."
report
Use our free recommendation engine to learn which Application Security Posture Management (ASPM) solutions are best for your needs.
921,338 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
13%
Manufacturing Company
11%
Computer Software Company
9%
Construction Company
8%
Financial Services Firm
14%
Manufacturing Company
9%
Outsourcing Company
8%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise9
Large Enterprise46
 

Questions from the Community

What needs improvement with Apiiro?
One area Apiiro could improve is reporting customization and dashboard flexibility with more advanced filtering and easier communication.
What is your primary use case for Apiiro?
Apiiro is primarily used for code scanning and integration with source code control. The main use cases include code scanning and code snippet analysis. Apiiro provides security and visibility by h...
What advice do you have for others considering Apiiro?
Based on my experience with Apiiro, I would recommend it to organizations looking to strengthen their application security processes and integrate security into their development workflows. One of ...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What is the biggest difference between Veracode and Checkmarx?
According to my experience of using both the tools in different organizations Veracode is a Cloud-native, managed AppSec platform with strong focus on ease of use, it is SaaS delivery, and provide...
What is your experience regarding pricing and costs for Checkmarx?
Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...
 

Comparisons

 

Also Known As

Apiiro Control Plane (ASOC), Apiiro API Security (SAST), Apiiro Open Source (SCA)
No data available
 

Overview

 

Sample Customers

Morgan Stanley, Rakuten, Jack Henry, SoFi, Colgate, Navan
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about Apiiro vs. Checkmarx One and other solutions. Updated: October 2026.
921,338 professionals have used our research since 2012.