Checkmarx Software Composition Analysis vs Fortify Static Code Analyzer comparison

The compared Checkmarx and OpenText solutions aren't in the same category. Checkmarx is ranked #8 in SCA , with an average rating of 9.0, and holds a 2.6% mindshare in the category. OpenText is ranked #3 in SCAS , with an average rating of 8.2, and holds a 11.9% mindshare. Additionally, 100% of Checkmarx users are willing to recommend the solution, compared to 88% of OpenText users who would recommend it.

Checkmarx Software Composit...

Read 13 Checkmarx Software Composition Analysis reviews

1,349 Views
988 Comparison Views

100% willing to recommend

Fortify Static Code Analyzer

Read 17 Fortify Static Code Analyzer reviews

1,719 Views
1,159 Comparison Views

88% willing to recommend

Checkmarx Software Composit...

Fortify Static Code Analyzer

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Fortify Static Code Analyzer based on real PeerSpot user reviews.

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA).

To learn more, read our detailed Software Composition Analysis (SCA) Report (Updated: March 2025).

Buyer's Guide

Software Composition Analysis (SCA)

March 2025

Download the complete report

Helped 847,862 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (8th)

Fortify Static Code Analyzer

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Static Code Analysis (3rd)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Checkmarx Software Composition Analysis is designed for Software Composition Analysis (SCA) and holds a mindshare of 2.6%, down 3.2% compared to last year.
Fortify Static Code Analyzer, on the other hand, focuses on Static Code Analysis, holds 11.9% mindshare, up 9.5% since last year.

Software Composition Analysis (SCA)

Static Code Analysis

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at Wiley

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Aphiwat Leetavorn.

CTO at Marco Technology

Provides extensive language support and enhances secure coding practices

The deployment of Fortify Static Code Analyzer needs to be simplified. It should be easier to install, perhaps through a container-based approach where everything is combined into one image or pack of containers. This change would facilitate easier installations and ensure all necessary components are connected and ready to use.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"What's most valuable in Checkmarx Software Composition Analysis is its ability to identify vulnerabilities in open-source components, especially if some critical issues exist."

"It is very easy and user friendly. It never requires any kind of technical support. You can do everything on your own."

"I appreciate the user-friendly interface. The GUI is excellent, providing detailed information on outdated versions, including version numbers and the flow of library calls. This allows me to plan and prioritize library changes based on potential vulnerabilities, even if the affected library is indirectly used in my project. The tool offers specific guidance on addressing these issues."

"The most valuable feature of Checkmarx Software Composition Analysis is the comprehensive security scan."

"The customer service and support were good."

"What's most valuable in Checkmarx Software Composition Analysis is that it provides security from the start. In the traditional approach, an enterprise or company validates the solution before launching to a production environment, but in the modern approach, security must be checked and provided from the beginning and from the design, and this is where Checkmarx Software Composition Analysis comes in. The solution helps you make sure that every open-source application that you use is secure, and that there's no vulnerability inside that open-source application."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

"The product is stable and scalable."

More Checkmarx Software Composition Analysis pros

"Automating the Jenkins plugins and the build title is a big plus."

"Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between."

"I recommend this product due to its good pricing, extensive language support, valuable features, and additional features like Fortify Academy."

"Fortify Static Code Analyzer's most valuable features are its ability to provide best practices for fixing code and its examples and capabilities to address security problems in the code. It effectively identifies security vulnerabilities by analyzing the code and offering insights on improving it."

"We write software, and therefore, the most valuable aspect for us is basically the code analysis part."

"The integration Subset core integration, using Jenkins is one of the good features."

"You can really see what's happening after you've developed something."

"Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it is finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it."

More Fortify Static Code Analyzer pros

Cons

"The quality of technical support has decreased over time, and it is not as good as it used to be."

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"Some of the recommendations provided by the product are generic. Even if the recommendations provided by the product are of low level, the appropriate ones can help users deal with vulnerabilities."

"I have received complaints from my customers that the pricing could be improved."

"I would rate the scalability a seven out of ten."

"In terms of areas for improvement, what could be improved in Checkmarx Software Composition Analysis is pricing because customers always compare the pricing among secure DevOps solutions in the market. Checkmarx Software Composition Analysis has a lot of competitors yet its features aren't much different. Pricing is the first thing customers consider, and from a partner perspective, if you can offer affordable pricing to your customers, it's more likely you'll have a winning deal. The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

"Its pricing can be improved. It is a little bit high priced. It would be better if it was a little less expensive. It is a good tool, and we're still figuring out how to fully leverage it. There are some questions regarding whether it can scan the MuleSoft code. We don't know if this is a gap in the tool or something else. This is one thing that we're just working through right now, and I am not ready to conclude that there is a weakness there. MuleSoft is kind of its own beast, and we're trying to see how we get it to work with Checkmarx."

"It can have better licensing models."

More Checkmarx Software Composition Analysis cons

"It comes with a hefty licensing fee."

"The deployment of Fortify Static Code Analyzer needs to be simplified."

"It can be tricky if you want to exclude some files from scanning. For instance, if you do not want to scan and push testing files to Fortify Software Security Center, that is tricky with some IDEs, such as IntelliJ. We found that there is an Exclude feature that is not working. We reported that to them for future fixing. It needs some work on the plugins to make them consistent across IDEs and make them easier."

"Not all languages are supported in Fortify."

"The generation of false positives should be reduced."

"Their licensing is expensive."

"The product shows false positives for Python applications."

"Fortify Static Code Analyzer is a good solution, but sometimes we receive false positives. If they could reduce the number of false positives it would be good."

More Fortify Static Code Analyzer cons

Pricing and Cost Advice

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"It is a little bit high priced. It would be better if it was a little less expensive."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"The licensing is expensive and is in the 50K range."

"The setup costs and pricing for Fortify may vary depending on the organization's needs and requirements."

"The price of Fortify Static Code Analyzer could be reduced."

"I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive."

"Although I am not responsible for the budget, Fortify SAST is expensive."

"From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago."

"It has a couple of license models. The one that we use most frequently is called their flexible deployment. We use this one because it is flexible and based on the number of code-contributing developers in the organization. It includes almost everything in the Fortify suite for one developer price. It gives access to not just the secure code analyzer (SCA) but also to FSC, the secure code. It gives us accessibility to scan central, which is the decentralized scanning farm. It also gives us access to the software security center, which is the vulnerability management platform."

"There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost. I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

847,862 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

37%

Manufacturing Company

14%

Computer Software Company

Healthcare Company

Financial Services Firm

29%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Checkmarx Software Composition Analysis?

The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all...

See all answers

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

See all answers

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

See all answers

What do you like most about Fortify Static Code Analyzer?

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...

See all answers

What is your experience regarding pricing and costs for Fortify Static Code Analyzer?

The pricing of Fortify Static Code Analyzer is good, with a flexible model that allows customers to choose a setup that suits their needs. There are some features that require additional purchases,...

See all answers

What needs improvement with Fortify Static Code Analyzer?

See all answers

Comparisons

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 33% of the time

Black Duck vs Checkmarx Software Composition Analysis

Compared 27% of the time

Semgrep vs Checkmarx Software Composition Analysis

Compared 8% of the time

Polaris Software Integrity Platform vs Checkmarx Software Composition Analysis

Compared 7% of the time

Mend.io vs Checkmarx Software Composition Analysis

Compared 5% of the time

More Checkmarx Software Composition Analysis Competitors

Black Duck vs Fortify Static Code Analyzer

Compared 34% of the time

Snyk vs Fortify Static Code Analyzer

Compared 18% of the time

Veracode vs Fortify Static Code Analyzer

Compared 13% of the time

Sonatype Lifecycle vs Fortify Static Code Analyzer

Compared 8% of the time

FOSSA vs Fortify Static Code Analyzer

Compared 1% of the time

More Fortify Static Code Analyzer Competitors

Product Reports

Buyer's Guide

Checkmarx Software Composition Analysis

April 2025

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Buyer's Guide

Fortify Static Code Analyzer

April 2025

Download Fortify Static Code Analyzer product report

Also Known As

CxSCA

Fortify Static Code Analysis SAST

Overview

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Checkmarx

Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.

Fortify Static Code Analyzer Benefits

CI/CD pipeline security: Fortify SCA integrates well with third-party tools such as ALM Octane, Atlassian Bamboo, Azure DevOps, Eclipse, Jenkins, and Jira. It offers real-time scan results, immediate recommendations, and collaborative auditing, and finds threats faster. It also discovers and prioritizes weaknesses to reduce risk.
Cost-effective: Improves coding actions by training users as they work to better understand the relationship of static application security testing (SAST). Fortify SCA is able to find more vulnerabilities than other solutions and delivers significantly fewer false positives.
Quick and reliable scanning: Fortify SCA will discover and eradicate weaknesses in byte, binary, or source code. SAST is able to stop the bulk of code issues at the start of development. The solution is able to discover 815 specific categories of risk, works through 27 programming languages and more than one million different APIs. Fortify SCA has a positive rate of 100% in the OWASP 1.2 benchmark.

Fortify Static Code Analyzer Features

Flexible deployment: Using Fortify On Demand, users can work in a complete SaaS environment. Fortify Hosted allows users to use on-premises and SaaS to work in a secure virtual space with complete control. Fortify-On-Prem gives users absolute control of the Fortify SCA solution.
Security assistant: Users have an interactive guide as they create code that provides risk analysis and anticipated outcomes. Security Assistant is an outstanding immediate feedback tool that gives instant results with significantly fewer false positives.
Audit assistant: This feature uses machine learning to reduce manual audit time while prioritizing the most important risks to users' networks. It provides automated audits in minutes. Any manual examinations are reduced, all issues are prioritized in accordance with organizational needs, and Fortify SCA consistently provides audit results to all projects.

Results from Real Users

“Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it.” - Arun D., Senior Architect at a healthcare company.

“Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between.” - Tom H., Director of Security at Merito

OpenText

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Information Not Available

Buyer's Guide

Software Composition Analysis (SCA)

March 2025

Download Free Report

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA). Updated: March 2025.

DOWNLOAD NOW

847,862 professionals have used our research since 2012.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.