Checkmarx One vs GitHub comparison

Read 93 GitHub reviews

2,518 Views
1,112 Comparison Views

100% willing to recommend

Checkmarx One

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 5, 2025

Checkmarx One and GitHub compete in the software development and security space. Checkmarx holds an advantage in code vulnerability scanning and remediation guidance, while GitHub excels in collaboration and code management.

Features: Checkmarx One excels in comprehensive code analysis, integration with development tools, and detailed reporting, enabling developers to enhance secure coding skills. It supports many programming languages and performs security checks across various environments. GitHub is known for its version control and collaboration features, supporting project management through pull requests, code reviews, and actions. It integrates extensively with development lifecycle tools and maintains robust code versioning.

Room for Improvement: Checkmarx One could reduce false positives, expand programming language support, and improve licensing flexibility. Its setup may require complex customization, and users seek clearer documentation and broader tool integrations. GitHub users request better security features, integration with project management tools, and user-friendliness for non-technical members. Handling large files and enhancing automation in workflows are also noted areas for improvement.

Ease of Deployment and Customer Service: Checkmarx One supports on-premises, hybrid, and public cloud setups but faces challenges in complex deployments. Its technical support is responsive but could improve on extended ticket handling. GitHub, primarily cloud-based, is easier to deploy with reliable support and straightforward technical assistance, emphasizing cloud simplicity and user-friendly deployment.

Pricing and ROI: Checkmarx One is viewed as expensive, influenced by user numbers and language support, offering significant ROI through security enhancements. Its pricing model is considered rigid, seen as a premium option. GitHub is cost-effective, especially with its free tier for public repositories, offering competitive rates for private ones. Users find its pricing reasonable, highlighting flexibility and accessibility.

To learn more, read our detailed Checkmarx One vs. GitHub Report (Updated: March 2025).

Checkmarx One vs. GitHub

Download the complete report

Helped 845,406 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Ranking in Application Security Tools

3rd

Average Rating

7.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (3rd), Vulnerability Management (21st), Static Code Analysis (2nd), API Security (3rd), DevSecOps (2nd), Risk-Based Vulnerability Management (8th)

GitHub

Ranking in Application Security Tools

6th

Average Rating

8.8

Reviews Sentiment

7.5

Number of Reviews

Ranking in other categories

Version Control (3rd)

Mindshare comparison

As of April 2025, in the Application Security Tools category, the mindshare of Checkmarx One is 10.7%, down from 15.1% compared to the previous year. The mindshare of GitHub is 0.8%, down from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Rohit Kesharwani

Manager, Engineering at 7-Eleven.

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

Pervez Roy

Solutions Architect at Small Systems LTD

Very good for collaboration on software projects

We use GitHub for code repository alongside Bitbucket GitHub is very good for collaboration on software projects. We prefer Bitbucket for commercial use, while GitHub is used for open source. You can get the differences, history of changes, and version control for various pull requests. You can…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It gives the proper code flow of vulnerabilities and the number of occurrences."

"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."

"Less false positive errors as compared to any other solution."

"The main thing we find valuable about Checkmarx is the ease of use. It's easy to initiate scans and triage defects."

"Vulnerability details is valuable."

"The user interface is excellent. It's very user friendly."

"The tool's valuable features include integrating GPT and Copilot. Additionally, the UI web representation is very user-friendly, making navigation easy. GPT has made several improvements to my security code."

"Checkmarx has helped us deliver more secure products. We are able to do static code analysis with the tool before shipping our code to production. When the integration is in the pipeline, this tool gives us early notifications on code fixes."

More Checkmarx One pros

"The most valuable features are the speed, low latency, and the clear, concise set of commands."

"If you want to share documents, you can create articles and diagrams with GitHub and share."

"The solution has been stable for us."

"The initial setup was straightforward."

"GitHub provides enough storage for uploading the source code."

"It provides Draft Pull Requests for review purposes without needing immediate merging and GitHub Actions for CI/CD implementation."

"The support team is good."

"GitHub is the best tool for source repositories."

More GitHub pros

Cons

"Checkmarx could improve by reducing the price."

"Meta data is always needed."

"Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?"

"Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features."

"The tool is currently quite static in terms of finding security vulnerabilities. It would be great if it was more dynamic and we had even more tools at our disposal to keep us safe. It would help if there was more scanning or if the process was more automated."

"I would like to see the rate of false positives reduced."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"Integration into the SDLC (i.e. support for last version of SonarQube) could be added."

More Checkmarx One cons

"There could be more integration into Azure."

"The merging features can be improved."

"I decided not to use GitHub but developed my tool because I found it more efficient. I'm familiar with my tools, making them easier to use. I like being able to customize them to fit my workflow and the way I think.. Software development is like a personal workshop, and I tailor my version control to match my approach."

"If you are uploading or cloning a large file, with more than 25 megs, it's pretty slow."

"There is a bit of a learning curve."

"The solution can improve by adding video guides, official guides, or short courses that cater to beginners who are new to the system. These resources could offer step-by-step guidance on how to use GitHub, including common procedures such as pulling and committing. Currently, many of us have to resort to searching for information on how to do these tasks via Google. An official guide provided by GitHub itself would be a valuable asset to newcomers and would save them time and effort."

"The sign in process is a bit difficult. Signing up was challenging at that time."

"GitHub should provide more integration in their next release, including integrating with Jenkins, CI/CD and Jira."

More GitHub cons

Pricing and Cost Advice

"For around 250 users or committers, the cost is approximately $500,000."

"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."

"It is a good product but a little overpriced."

"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."

"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."

"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."

"It is an expensive solution."

"The interface used to create custom rules comes at an additional cost."

More Checkmarx One pricing and cost advice

"I use the free version of the tool."

"I haven't had to pay anything for GitHub, I use the free version."

"It's cheaper than Bitbucket."

"The licensing model from GitHub is very clear."

"GitHub is an open-source product, but when using the free-to-use version, anyone can see the code we're working on."

"GitHub is a cost-effective solution."

"The tool offers a free program. As you go, you can upgrade from the community version to the professional one. I believe it costs about ten dollars per person, per month."

"It is open-source. There is no license for GitHub."

More GitHub pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

845,406 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Computer Software Company

15%

Manufacturing Company

10%

Government

Financial Services Firm

13%

Manufacturing Company

12%

Computer Software Company

11%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

What do you like most about GitHub?

The control is the most valuable feature as developers can work on a single code.

What is your experience regarding pricing and costs for GitHub?

The pricing of GitHub depends on the choice of solutions, such as building one's own GitHub Runners to save money or using GitHub's Runners with extra costs. The pricing is considered reasonable an...

What needs improvement with GitHub?

There are still areas for improvement with GitHub Actions and their deployment workflows, as they have made significant progress but are not yet polished. Occasionally, stability can be an issue, t...

SonarQube Server (formerly SonarQube) vs Checkmarx One

Comparisons

Compared 43% of the time

Veracode vs Checkmarx One

Compared 12% of the time

Fortify on Demand vs Checkmarx One

Compared 6% of the time

Checkmarx SAST vs Checkmarx One

Compared 5% of the time

OWASP Zap vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

Bitbucket vs GitHub

Compared 17% of the time

Fortify on Demand vs GitHub

Compared 15% of the time

Snyk vs GitHub

Compared 12% of the time

AWS CodeCommit vs GitHub

Compared 11% of the time

Atlassian SourceTree vs GitHub

Compared 7% of the time

More GitHub Competitors

Product Reports

Checkmarx One

Download Checkmarx One product report

Download GitHub product report

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

GitHub is a web-based Git repository hosting service. It offers all of the distributed revision control and source code management (SCM) functionality of Git as well as adding its own features. Unlike Git, which is strictly a command-line tool, GitHub provides a Web-based graphical interface and desktop as well as mobile integration. It also provides access control and several collaboration features such as bug tracking, feature requests, task management, and wikis for every project.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Dominion Enterprises, NASA, Braintree, SAP, CyberAgent

Checkmarx One vs. GitHub