Checkmarx One vs Klocwork vs SonarQube Server (formerly SonarQube) comparison

Checkmarx and Perforce are both solutions in the Application Security Tools category. Checkmarx is ranked #3 with an average rating of 7.8, while Perforce is ranked #16 with an average rating of 8.4. Checkmarx holds a 10.7% mindshare in AS, compared to Perforce’s 1.5% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 92% of Perforce users who would recommend it.

Checkmarx One

Read 70 Checkmarx One reviews

21,297 Views
14,284 Comparison Views

87% willing to recommend

Klocwork

Read 23 Klocwork reviews

2,613 Views
1,557 Comparison Views

92% willing to recommend

SonarQube Server (formerly ...

Read 114 SonarQube Server (formerly SonarQube) reviews

33,796 Views
28,161 Comparison Views

81% willing to recommend

Checkmarx One

Klocwork

SonarQube Server (formerly ...

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx One, Klocwork, and SonarQube Server (formerly SonarQube) based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools.

To learn more, read our detailed Application Security Tools Report (Updated: April 2025).

Buyer's Guide

Application Security Tools

April 2025

Download the complete report

Helped 849,190 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Mindshare comparison

As of April 2025, in the Application Security Tools category, the mindshare of Checkmarx One is 10.7%, down from 15.1% compared to the previous year. The mindshare of Klocwork is 1.5%, up from 1.5% compared to the previous year. The mindshare of SonarQube Server (formerly SonarQube) is 25.1%, down from 26.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Rohit Kesharwani

Manager, Engineering at 7-Eleven.

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

AnirbanSarkar

Head - Solution Management Group at Meteonic Innovation Pvt. Ltd.

Lets you find defects during the development phase, so you don't have to wait till the development is over to find and address flaws

What needs improvement in Klocwork, compared to other products in the market, is the dashboard or reporting mechanisms that need to be a bit more flexible. The Klocwork dashboard could be improved. Though it's good, it's not as good as some of the other products in the market, which is a problem. The reporting could be more detailed and easier to sort out because sorting in Klocwork could be a bit more time-consuming, mainly when sorting defects based on filters, compared to how it's done on other tools such as Coverity. What I'd like added in the next release of Klocwork is the peer code review Cahoots which used to be a part of Klocwork, and the architecture analysis and both have been taken out of Klocwork. I found the two critical for specific deployments, so if those can be brought back to Klocwork, that would be very good.

Read full review

Wang Dayong

Senior Software Engineering Manager at Hill

Easy to integrate and has a plug-in that supports both C and C++ languages

The product provides false reports sometimes. It also fails to understand the context of the code. It reports that a line of code has issues without considering its relation with the previous line. The product should improve the report quality. While it asks us to improve the code quality, it would be good if it also suggests how to improve the quality.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature for me is the Jenkins Plugin."

"The user interface is excellent. It's very user friendly."

"What I like best about Checkmarx is that it has fewer false positives than other products, giving you better results."

"The ability to track the vulnerabilities inside the code (origin and destination of weak variables or functions)."

"The only thing I like is that Checkmarx does not need to compile."

"One of the most valuable features is it is flexible."

"It is a stable product."

"The feature that I have found most valuable is that its number of false positives is less than the other security application platforms. Its ease of use is another good feature. It also supports most of the languages."

More Checkmarx One pros

"There's a feature in Klocwork called 'on-the-fly analysis', which helps developers to find and fix the defects at the time of development itself."

"On-the-fly analysis and incremental analysis are the best parts of Klocwork. Currently, we are using both of these features very effectively."

"I like not having to dig through false positives. Chasing down a false positive can take anywhere from five minutes for a small easy one, then something that is complicated and goes through a whole bunch of different class cases, and it can take up to 45 minutes to an hour to find out if it is a false positive or not."

"The best advantage of Klocwork is the reduced setup time."

"Technical support is quite good."

"We like using the static analysis and code refactoring, which are very valuable because of our requirements to meet safety critical levels and reliability."

"The ability to create custom checkers is a plus."

"Klocwork's most valuable feature is the static code analysis feature. It detects the potential problem earlier to allow the developer to receive feedback quickly and then address it before it becomes a problem."

More Klocwork pros

"Integrate it into the developers' workbench so that they can bench check their code against what will be done in the server-based audit version."

"Apart from the security point of view, I like that it makes it easy to detect code smells and other issues in terms of code quality and standards."

"SonarQube is scalable. My company has 50 users."

"We are using the Community edition. So, we don't have to incur any licensing costs. This is the best part."

"The initial setup is simple. It requires some security, but it's simple."

"This solution has helped with the integration and building of our CICD pipeline."

"There are many options and examples available in the tool that help us fix the issues it shows us."

"It is a good deal compared to all other tools on the market."

More SonarQube Server (formerly SonarQube) pros

Cons

"Checkmarx could improve the REST APIs by including automation."

"They could work to improve the user interface. Right now, it really is lacking."

"Checkmarx could improve by reducing the price."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"Checkmarx could improve the speed of the scans."

"Some of the descriptions were found to be missing or were not as elaborate as compared to other descriptions. Although, they could be found across various standard sources but it would save a lot of time for developers, if this was fixed."

"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."

"The interactive application security testing, or IAST, the interactive part where you're looking at an application that lives in a runtime environment on a server or virtual machine, needs improvement."

More Checkmarx One cons

"The way to define the rules is too complex. The definition/rules for static analysis could be automated according to various SILs, so as to avoid confusion."

"Modern languages, such as Angular and .NET, should be included as a part of Klocwork. They have recently added Kotlin as a part of their project, but we would like to see more languages in Klocwork. That's the reason we are using Coverity as a backup for some of the other languages."

"I believe it should support more languages, such as Python and JavaScript."

"Now the only issue we have is that whenever we need to get the code we have to build it first. Then we can get the report."

"We bought Klocwork, but it was limited to one little program, but the program is now sort of failing. So, we have a license for usage on a program that is sort of failing, and we really can't use the license on anything else."

"Klocwork sometimes provides too many additional warnings which require expertise to manage."

"Under NIST cybersecurity standards, we must address vulnerabilities within a specified time after discovering them. When we try to propagate those updates and fixes through the system, it would be nice if the clients could reconnect to the existing server or have the server dynamically updated in some way. I know that isn't easy, but maybe processes could be enhanced to make that more streamlined from a DevOps perspective."

"The main problem is that since it only parses the code, the warnings or the problems that are given as a result of the report can sometimes require a lot of effort to analyze."

More Klocwork cons

"Dynamic scanning is missing and there are some issues with security scanning."

"We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major."

"Technical support and the price could be better."

"One thing to improve would be the integration. There is a steep learning curve to get it integrated."

"SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan. For example, when the developer writes the code and does the corresponding unit test, he can cover functional and non-functional. So the SonarQube could be improved by helping to execute unit tests and test dynamically, using various parameters, and to help detect any vulnerabilities. Currently, it'll just give the test case and say whether it passes or fails—it won't give you any other input or dynamic testing. They could use artificial intelligence to build a feature that would help developers identify and fix issues in the early stages, which would help us deliver the product and reduce costs. Another area with room for improvement is in regard to automating things, since the process currently needs to be done manually."

"We did have some trouble with the LDAP integration for the console."

"Ease of use/interface."

"The product's user documentation can be vastly improved."

More SonarQube Server (formerly SonarQube) cons

Pricing and Cost Advice

"I believe pricing is better compared to other commercial tools."

"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."

"If you want more, you have to pay more. You have to pay for additional modules or functionalities."

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

"It is not expensive, but sometimes, their pricing model or licensing model is not very clear. There are similar variables, such as projects or developers, and sometimes, it is a little bit confusing."

"It is an expensive solution."

"For around 250 users or committers, the cost is approximately $500,000."

"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."

More Checkmarx One pricing and cost advice

"Klocwork should not to be quite so heavy handed on the licensing for very specific programs."

"Licensing fees are paid annually, but they also have a perpetual license."

"The pricing for Klocwork is very competitive if you compare it from apple to apple. It has competitive pricing regarding the licensing model and the per-license cost. Klocwork isn't a high-end investment for anyone deploying it; even SMBs can afford it. The Klocwork cost per user would depend on the license type, so I'm unable to mention a ballpark figure because it would depend on the type of installation and how the deployment will be, and the nodes to give an accurate calculation or figure. The total price depends on the package, so my company could never publish pricing for Klocwork on the website. My team first collects information from potential clients on the deployment scenario, project environment, etc., before suggesting a package for Klocwork. My rating for Klocwork in terms of pricing is a five because of its flexible license models. There's a license model for every type of organization, whether small, midsize, or enterprise, so it's a five out of five for me."

"This solution offers competitive pricing."

"There are other solutions on the market such as Microsoft Visual Studio. They have been adding more static code analysis features that come for free. It is getting better all the time. That is one of the possibilities is that we've been considering that we may stop using the Klocwork because it doesn't give us any added value."

"The limitation that we have is that Klocwork is licensed to certain programs, and if you want to license them to other programs, you have to pay more money."

"Klocwork is still tight on their licensing. If Klocwork would loosen up on the licensing, and where the license could be used, and how many different programs could be run on it, then we have several development programs that I would love to be able to use it for going forward."

"When it comes to licensing, the solution has two packages, one for a fixed and the other for a floating server, with the former being more cost effective than the latter."

"The price of this solution is more expensive than competitors. However, it works better than competitors."

"I am satisfied with the pricing."

"A low cost long-term solution for non-critical situations."

"The beauty of this solution is the free open-source version is capable enough in doing pretty much what an enterprise-level version can do."

"It is very expensive. Its price should be improved."

"We are using the free, unlicensed version."

"This solution is free."

"On the pricing side, it's 3,000 Euros for 1 million lines of code."

More SonarQube Server (formerly SonarQube) pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

849,190 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Computer Software Company

14%

Manufacturing Company

10%

Government

Educational Organization

33%

Manufacturing Company

21%

Computer Software Company

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

See all answers

What do you like most about Klocwork?

It's integrated into our CI, continuous integration.

See all answers

What is your experience regarding pricing and costs for Klocwork?

Klocwork was competitively priced, making it a cost-effective solution for us.

See all answers

What needs improvement with Klocwork?

We would like Klocwork to connect to Git and notify developers of issues tied to specific commits. Currently, this fe...

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which ...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and securi...

See all answers

Comparisons

Veracode vs Checkmarx One

Compared 12% of the time

Fortify on Demand vs Checkmarx One

Compared 6% of the time

Checkmarx SAST vs Checkmarx One

Compared 5% of the time

OWASP Zap vs Checkmarx One

Compared 4% of the time

Coverity vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

Coverity vs Klocwork

Compared 30% of the time

Polyspace Code Prover vs Klocwork

Compared 13% of the time

Parasoft SOAtest vs Klocwork

Compared 3% of the time

Fortify Static Code Analyzer vs Klocwork

Compared 2% of the time

PVS‑Studio vs Klocwork

Compared 2% of the time

More Klocwork Competitors

Coverity vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

SonarQube Cloud (formerly SonarCloud) vs SonarQube Server (formerly SonarQube)

Compared 10% of the time

GitHub Advanced Security vs SonarQube Server (formerly SonarQube)

Compared 10% of the time

Veracode vs SonarQube Server (formerly SonarQube)

Compared 7% of the time

CAST Highlight vs SonarQube Server (formerly SonarQube)

Compared 1% of the time

More SonarQube Server (formerly SonarQube) Competitors

Product Reports

Buyer's Guide

Checkmarx One

April 2025

Download Checkmarx One product report

Buyer's Guide

Klocwork

April 2025

Download Klocwork product report

Buyer's Guide

SonarQube Server (formerly SonarQube)

March 2025

SonarQube Server (formerly SonarQube) report

Download SonarQube Server (formerly SonarQube) product report

Also Known As

No data available

Sonar

Interactive Demo

Demo not available

Checkmarx

Demo not available

Perforce

Sonar

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Klocwork detects security, safety, and reliability issues in real-time by using this static code analysis toolkit that works alongside developers, finding issues as early as possible, and integrates with teams, supporting continuous integration and actionable reporting.

Perforce

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

Sonar

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

ACCESS Co Ltd, Risk-AI, Winbond Electronics, Bristol-Myers Squibb Pharmaceutical Research Institute, University of Southern California, Alebra Technologies, SIMULIA, Risk Management Solutions, Brigham Young University, SRD, HRL

Information Not Available

Buyer's Guide

Application Security Tools

April 2025

Download Free Report

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Application Security Tools. Updated: April 2025.

DOWNLOAD NOW

849,190 professionals have used our research since 2012.