Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs JFrog DevOps Cloud Platform comparison

Checkmarx and JFrog are both solutions in the DevSecOps category. Checkmarx is ranked #2 with an average rating of 7.8, while JFrog is ranked #11 with an average rating of 8.0. Checkmarx holds a 16.3% mindshare in DSO, compared to JFrog’s 0.2% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 100% of JFrog users who would recommend it.
Checkmarx One
Read 70 Checkmarx One reviews
  • 1,775 Views
  • 1,136 Comparison Views
87% willing to recommend
JFrog DevOps Cloud Platform
Read 3 JFrog DevOps Cloud Platform reviews
  • 7 Views
  • 4 Comparison Views
100% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Jan 7, 2025

Checkmarx One and JFrog DevOps Cloud Platform compete in the application security and DevOps fields. JFrog stands out with its comprehensive features, making it attractive for users seeking a feature-rich option in software management.

Features: Checkmarx One offers strong source code analysis and scanning capabilities supporting various programming languages. JFrog DevOps Cloud Platform integrates a wide range of DevOps tools, facilitates continuous integration and delivery, and includes artifact management and vulnerability analysis.

Ease of Deployment and Customer Service: Checkmarx One is known for straightforward deployment and dedicated technical support, resulting in a smooth integration process. JFrog provides broader deployment options such as cloud-native and hybrid environments but involves a more complex configuration. Both have quality customer service, with Checkmarx noted for quicker setup times.

Pricing and ROI: Checkmarx One offers competitive setup costs with clear ROI from improved code security and reduced vulnerabilities. JFrog may require higher upfront investment, but long-term ROI is achieved through streamlined DevOps workflows and increased productivity, presenting it as a potentially cost-effective solution for continuous integration and delivery.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed Checkmarx One vs. JFrog DevOps Cloud Platform Report (Updated: March 2025).
Buyer's Guide
Checkmarx One vs. JFrog DevOps Cloud Platform
March 2025
Download the complete report
Helped 845,406 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx One
Ranking in DevSecOps
2nd
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
70
Ranking in other categories
Application Security Tools (3rd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (21st), Static Code Analysis (2nd), API Security (3rd), Risk-Based Vulnerability Management (8th)
JFrog DevOps Cloud Platform
Ranking in DevSecOps
11th
Average Rating
8.0
Reviews Sentiment
7.2
Number of Reviews
3
Ranking in other categories
Software Supply Chain Security (16th), AWS Marketplace (32nd)
 

Mindshare comparison

As of April 2025, in the DevSecOps category, the mindshare of Checkmarx One is 16.3%, down from 22.3% compared to the previous year. The mindshare of JFrog DevOps Cloud Platform is 0.2%. It is calculated based on PeerSpot user engagement data.
DevSecOps
 

Featured Reviews

Rohit Kesharwani - PeerSpot reviewer
Provides good security analysis and security identification within the source code
We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.
Read full review
Fredierick Saladas - PeerSpot reviewer
Provides superior integration options and comprehensive reporting features
The product could benefit from enhanced integration capabilities with older software systems and more customizable reporting options. Improved support for mobile devices would also be advantageous, allowing team members to access the system more effectively while on the go. In the next release, we would like to see advanced analytics features, including predictive analytics to help forecast project outcomes. Additionally, a more robust mobile app with offline capabilities would be valuable for remote work scenarios.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable features of Checkmarx are difficult to pinpoint because of the way the functionalities and the features are intertwined, it's difficult to say which part of them I prefer most. You initiate the scan, you have a scan, you have the review set, and reporting, they all work together as one whole process. It's not like accounting software, where you have the different features, et cetera."
"Checkmarx pinpoints the vulnerability in the code and also presents the flow of malicious input across the application."
"We use the solution for dynamic application testing."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"Scan reviews can occur during the development lifecycle."
"The most valuable feature is the simple user interface."
"It gives the proper code flow of vulnerabilities and the number of occurrences."
"It has all the features we need."
More Checkmarx One pros
"They have a professional service team that works alongside their engineering and performance teams."
"The most valuable features include task tracking and reporting capabilities."
"I appreciate the features in JFrog DevOps Cloud Platform, especially the efficient file management where downloads and uploads are optimized, saving time. The storage efficiency is also great as it avoids redundancy, which is crucial for our team. It is also quite easy to use, especially for basic commands through the command line. It's straightforward for us internally, and our data is well-hosted on their servers, which makes data location and querying fast and efficient. Moving our storage to JFrog has streamlined our development cycle by eliminating duplicated data, which previously took up extra space locally. This efficiency is crucial for our workflow, although network speeds still play a significant role in performance."
 

Cons

"Checkmarx could improve the speed of the scans."
"If it is a very large code base then we have a problem where we cannot scan it."
"You can't use it in the continuous delivery pipeline because the scanning takes too much time."
"The cost per user is high and should be reduced."
"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."
"Checkmarx could improve the REST APIs by including automation."
"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."
"As the solution becomes more complex and feature rich, it takes more time to debug and resolve problems. Feature-wise, we have no complaints, but Checkmarx becomes harder to maintain as the product becomes more complex. When I talk to support, it takes them longer to fix the problem than it used to."
More Checkmarx One cons
"The product could benefit from enhanced integration capabilities with older software systems and more customizable reporting options."
"Our locations are in different environments, so the remote server takes time to catch up, causing replication delays. The engineering team suggested that this issue would be resolved, but I'm not sure if it has been addressed yet. This is more of a feature enhancement that we suggested."
"We have encountered stability issues lately, particularly with frequent 500 internal server errors. Despite efforts from our DevOps team to adjust settings, these issues persist, affecting our workflow, especially with machine learning data uploads. Overall, while it's beneficial for storage and accessibility, stability issues need improvement for seamless operations. The occasional occurrence of internal server errors takes several minutes to resolve on their own and can disrupt workflows. Another concern is that sometimes files appear to be successfully uploaded, but then they cannot be downloaded, with no error message indicating the issue during the upload process. This inconsistency needs to be addressed by JFrog to ensure reliable functionality for users like us."
 

Pricing and Cost Advice

"It is a good product but a little overpriced."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"If you want more, you have to pay more. You have to pay for additional modules or functionalities."
"For around 250 users or committers, the cost is approximately $500,000."
"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."
"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."
"The solution is costly."
"The number of users and coverage for languages will have an impact on the cost of the license."
More Checkmarx One pricing and cost advice
"The product pricing is competitive but worth negotiating for volume discounts or longer-term contracts."
"Regarding pricing, I focus on the platform's interface and user communication rather than costs."
report
See which vendors are best for you
Use our free recommendation engine to learn which DevSecOps solutions are best for your needs.
See recommendations
845,406 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
14%
Manufacturing Company
10%
Government
5%
No data available
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
See all answers
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
See all answers
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
See all answers
What needs improvement with JFrog DevOps Cloud Platform?
The product could benefit from enhanced integration capabilities with older software systems and more customizable reporting options. Improved support for mobile devices would also be advantageous,...
See all answers
What advice do you have for others considering JFrog DevOps Cloud Platform?
Overall, the solution has been a great asset to our team. I advise investing time in the initial setup and training to leverage its capabilities fully. Ensure you clearly understand your needs and ...
See all answers
What is your experience regarding pricing and costs for JFrog DevOps Cloud Platform?
The product pricing is competitive but worth negotiating for volume discounts or longer-term contracts. Licensing options are flexible, but ensure you understand the terms and any additional costs ...
See all answers
 

Comparisons

SonarQube Server (formerly SonarQube) vs Checkmarx One Logo
SonarQube Server (formerly SonarQube) vs Checkmarx One
Compared 43% of the time
Veracode vs Checkmarx One Logo
Veracode vs Checkmarx One
Compared 12% of the time
Fortify on Demand vs Checkmarx One Logo
Fortify on Demand vs Checkmarx One
Compared 6% of the time
Checkmarx SAST vs Checkmarx One Logo
Checkmarx SAST vs Checkmarx One
Compared 5% of the time
OWASP Zap vs Checkmarx One Logo
OWASP Zap vs Checkmarx One
Compared 4% of the time
More Checkmarx One Competitors
No data available
 

Product Reports

Buyer's Guide
Checkmarx One
March 2025
Checkmarx One reportDownload Checkmarx One product report
Buyer's Guide
AWS Marketplace
March 2025
JFrog DevOps Cloud Platform reportDownload JFrog DevOps Cloud Platform product report
 

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • API security
  • Dynamic Application Security Testing (DAST)
  • Container security
  • IaC security
  • Correlation, prioritization, and risk management
  • Codebashing secure code training
  • AI security
  • Tech partnerships extending AppSec into runtime analysis
  • Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

The JFrog DevOps Cloud Platform optimizes software development life cycles through robust artifact management, CI/CD automation, and strong version control. Notable for its security features, it supports seamless software version maintenance and vulnerability scanning. Praised for enhancing organizational efficiency, it ensures faster, secure deliveries, improving collaboration within teams.

JFrog
 

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Information Not Available
Buyer's Guide
Checkmarx One vs. JFrog DevOps Cloud Platform
March 2025
Free Report: Checkmarx One vs. JFrog DevOps Cloud Platform
Find out what your peers are saying about Checkmarx One vs. JFrog DevOps Cloud Platform and other solutions. Updated: March 2025.
DOWNLOAD NOW
845,406 professionals have used our research since 2012.
See our Checkmarx One vs. JFrog DevOps Cloud Platform report.
See our list of best DevSecOps vendors.

We monitor all DevSecOps reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.