Checkmarx One vs Fortify Software Security Center comparison

Checkmarx and OpenText are both solutions in the Static Application Security Testing (SAST) category. Checkmarx is ranked #3 with an average rating of 7.9, while OpenText is ranked #27 with an average rating of 8.5. Checkmarx holds a 12.4% mindshare in SAST, compared to OpenText’s 0.3% mindshare. Additionally, 86% of Checkmarx users are willing to recommend the solution, compared to 100% of OpenText users who would recommend it.

Checkmarx One

Read 70 Checkmarx One reviews

25,142 Views
16,311 Comparison Views

86% willing to recommend

Fortify Software Security C...

Read 4 Fortify Software Security Center reviews

430 Views
339 Comparison Views

100% willing to recommend

Checkmarx One

Fortify Software Security C...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 8, 2024

Fortify Software Security Center and Checkmarx One are two prominent solutions competing in application security. Checkmarx One appears to have the upper hand due to its comprehensive features and ease of use.

Features: Fortify offers comprehensive vulnerability coverage, numerous integration options, and strong support. Checkmarx One is known for its intuitive functionality, robust scanning capabilities, and support for multiple programming languages.

Room for Improvement: Fortify users point out the need for improved reporting, faster scanning speeds, and enhanced analytics. Checkmarx One could benefit from better scan accuracy, a more user-friendly installation, and further optimization of its accuracy.

Ease of Deployment and Customer Service: Fortify's deployment is stable but has a steep learning curve. Customer service is proactive yet needs faster response times. Checkmarx One offers a smoother deployment and consistent customer support.

Pricing and ROI: Fortify has a manageable initial setup cost, though its ROI is questioned due to optimization time. Checkmarx One is more expensive but justifies its ROI with streamlined processes and faster integration.

To learn more, read our detailed Checkmarx One vs. Fortify Software Security Center Report (Updated: December 2024).

Buyer's Guide

Checkmarx One vs. Fortify Software Security Center

December 2024

Download the complete report

Helped 824,053 peers since 2012

Categories and Ranking

Checkmarx One

Ranking in Static Application Security Testing (SAST)

3rd

Average Rating

7.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Application Security Tools (3rd), Vulnerability Management (20th), Static Code Analysis (2nd), API Security (2nd), DevSecOps (2nd), Risk-Based Vulnerability Management (6th)

Fortify Software Security C...

Ranking in Static Application Security Testing (SAST)

27th

Average Rating

7.8

Reviews Sentiment

7.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of December 2024, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx One is 12.4%, down from 13.9% compared to the previous year. The mindshare of Fortify Software Security Center is 0.3%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

Rohit Kesharwani

Manager, Engineering at 7-Eleven.

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

Kibeom Kim

General Manager at Inexion Co.

Has a good collaboration function and is a centralized software solution

We use the product to scan results, store and display data from Azure, identify scan results, analyze, report, and access company data The platform's most effective for identifying vulnerabilities features are the Fortify audit workbench and the collaboration module, which allow developers and…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Less false positive errors as compared to any other solution."

"The solution is always updating to continuously add items that create a level of safety from vulnerabilities. It's one of the key features they provide that's an excellent selling point. They're always ahead of the game when it comes to finding any vulnerabilities within the database."

"The process of remediating software security vulnerabilities can now be performed (ongoing) as portions of the application are being built in advance of being compiled."

"Apart from software scanning, software composition scanning is valuable."

"The solution has good performance, it is able to compute in 10 to 15 minutes."

"The most valuable features of Checkmarx are the automation and information that it provides in the reports."

"It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx."

"The setup is very easy. There is a lot of information in the documents which makes the install not difficult at all."

More Checkmarx One pros

"This is a stable solution at the end of the day."

"You can easily download the tool's rule packs and update them."

"Fortify Analytics' AI function helps scan and provides more detailed explanations and recommendations about vulnerabilities."

"The reporting is very useful because you can always view an entire list of the issues that you have."

Cons

"The pricing can get a bit expensive, depending on the company's size."

"They can support the remaining languages that are currently not supported. They can also create a different model that can identify zero-day attacks. They can work on different patterns to identify and detect zero-day vulnerability attacks."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."

"We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level."

"Some of the descriptions were found to be missing or were not as elaborate as compared to other descriptions. Although, they could be found across various standard sources but it would save a lot of time for developers, if this was fixed."

"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."

"The integration could improve by including, for example, DevSecOps."

More Checkmarx One cons

"This solution is difficult to implement, and it should be made more comfortable for the end-users."

"The product's overlap feature is restrictive and requires more customization efforts, which can be expensive."

"Fortify Software Security Center's setup is really painful."

"We are having issues with false positives that need to be resolved."

Pricing and Cost Advice

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."

"The tool's pricing is fine."

"The number of users and coverage for languages will have an impact on the cost of the license."

"The pricing was not very good. This is just a framework which shouldn’t cost so much."

"The solution is costly."

More Checkmarx One pricing and cost advice

"The solution is priced fair."

"As a Fortify partner company providing technical support, I find the product expensive in our country, where local, inexpensive products are available."

"This is a costly solution that could be cheaper."

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

824,053 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

22%

Computer Software Company

15%

Manufacturing Company

10%

Government

Manufacturing Company

18%

Financial Services Firm

14%

Computer Software Company

11%

Educational Organization

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

See all answers

What do you like most about Micro Focus Software Security Center?

You can easily download the tool's rule packs and update them.

See all answers

What is your experience regarding pricing and costs for Micro Focus Software Security Center?

As a Fortify partner company providing technical support, I find the product expensive in our country, where local, inexpensive products are available. I would rate the pricing a seven.

See all answers

What needs improvement with Micro Focus Software Security Center?

The product's overlap feature is restrictive and requires more customization efforts, which can be expensive.

See all answers

Comparisons

SonarQube Server (formerly SonarQube) vs Checkmarx One

Compared 48% of the time

Veracode vs Checkmarx One

Compared 13% of the time

Fortify on Demand vs Checkmarx One

Compared 5% of the time

Coverity vs Checkmarx One

Compared 4% of the time

Snyk vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

Fortify on Demand vs Fortify Software Security Center

Compared 60% of the time

Acunetix vs Fortify Software Security Center

Compared 24% of the time

More Fortify Software Security Center Competitors

Product Reports

Buyer's Guide

Checkmarx One

December 2024

Download Checkmarx One product report

Buyer's Guide

Static Application Security Testing (SAST)

November 2024

Download Fortify Software Security Center product report

Also Known As

No data available

Micro Focus Software Security Center, Application Security Center, HPE Application Security Center, WebInspect

Learn More

Checkmarx

OpenText

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Software Security Center enables management, development, and security teams to work together to triage, track, validate, automate, and manage software security activities.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Neosecure, Acxiom, Skandinavisk Data Center A/S, Parkeon

Buyer's Guide

Checkmarx One vs. Fortify Software Security Center

December 2024

Free Report: Checkmarx One vs. Fortify Software Security Center

Find out what your peers are saying about Checkmarx One vs. Fortify Software Security Center and other solutions. Updated: December 2024.

DOWNLOAD NOW

824,053 professionals have used our research since 2012.

See our Checkmarx One vs. Fortify Software Security Center report.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.