Checkmarx Software Composition Analysis vs Fortify Static Code Analyzer comparison

The compared Checkmarx and OpenText solutions aren't in the same category. Checkmarx is ranked #8 in SCA , with an average rating of 9.0, and holds a 2.6% mindshare in the category. OpenText is ranked #3 in SCAS , with an average rating of 8.2, and holds a 11.5% mindshare. Additionally, 100% of Checkmarx users are willing to recommend the solution, compared to 88% of OpenText users who would recommend it.

Checkmarx Software Composit...

Read 13 Checkmarx Software Composition Analysis reviews

1,383 Views
1,029 Comparison Views

100% willing to recommend

Fortify Static Code Analyzer

Read 17 Fortify Static Code Analyzer reviews

1,809 Views
1,210 Comparison Views

88% willing to recommend

Checkmarx Software Composit...

Fortify Static Code Analyzer

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Fortify Static Code Analyzer based on real PeerSpot user reviews.

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA).

To learn more, read our detailed Software Composition Analysis (SCA) Report (Updated: February 2025).

Buyer's Guide

Software Composition Analysis (SCA)

February 2025

Download the complete report

Helped 842,388 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (8th)

Fortify Static Code Analyzer

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Static Code Analysis (3rd)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Checkmarx Software Composition Analysis is designed for Software Composition Analysis (SCA) and holds a mindshare of 2.6%, down 3.2% compared to last year.
Fortify Static Code Analyzer, on the other hand, focuses on Static Code Analysis, holds 11.5% mindshare, up 9.5% since last year.

Software Composition Analysis (SCA)

Static Code Analysis

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at Wiley

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Aphiwat Leetavorn.

CTO at Marco Technology

Provides extensive language support and enhances secure coding practices

The deployment of Fortify Static Code Analyzer needs to be simplified. It should be easier to install, perhaps through a container-based approach where everything is combined into one image or pack of containers. This change would facilitate easier installations and ensure all necessary components are connected and ready to use.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"One of the strong points of this solution is that it allows you to incorporate it into a CICB pipeline. It has the ability to do incremental scans. If you scan a very large application, it might take two hours to do the initial scan. The subsequent scans, as people are making changes to the app, scan the Delta and are very fast. That's a really nice implementation. The way they have incorporated the functionality of the incremental scans is something to be aware of. It is quite good. It has been very solid. We haven't really had any issues, and it does what it advertises to do very nicely."

"The customer service and support were good."

"What's most valuable in Checkmarx Software Composition Analysis is that it provides security from the start. In the traditional approach, an enterprise or company validates the solution before launching to a production environment, but in the modern approach, security must be checked and provided from the beginning and from the design, and this is where Checkmarx Software Composition Analysis comes in. The solution helps you make sure that every open-source application that you use is secure, and that there's no vulnerability inside that open-source application."

"The product is stable and scalable."

"The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all libraries that are vulnerable and the extent of their vulnerability."

"It is a stable solution...It is a scalable solution."

"The integration part is easy...It's a stable solution right now."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

More Checkmarx Software Composition Analysis pros

"The Software Security Center, which is often overlooked, stands out as the most effective feature."

"I like Fortify Software Security Center or Fortify SSC. This tool is installed on each developer's machine, but Fortify Software Security Center combines everything. We can meet there as security professionals and developers. The developers scan their code and publish the results there. We can then look at them from a security perspective and see whether they fixed the issues. We can agree on whether something is a false positive and make decisions."

"The integration Subset core integration, using Jenkins is one of the good features."

"The most valuable features include its ability to detect vulnerabilities accurately and its integration with our CI/CD pipeline."

"Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like password credentials and access keys embedded in the code."

"Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it is finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it."

"It's helped us free up staff time."

"You can really see what's happening after you've developed something."

More Fortify Static Code Analyzer pros

Cons

"Some of the recommendations provided by the product are generic. Even if the recommendations provided by the product are of low level, the appropriate ones can help users deal with vulnerabilities."

"Checkmarx Software Composition Analysis should improve dynamic analysis."

"Its pricing can be improved. It is a little bit high priced. It would be better if it was a little less expensive. It is a good tool, and we're still figuring out how to fully leverage it. There are some questions regarding whether it can scan the MuleSoft code. We don't know if this is a gap in the tool or something else. This is one thing that we're just working through right now, and I am not ready to conclude that there is a weakness there. MuleSoft is kind of its own beast, and we're trying to see how we get it to work with Checkmarx."

"Parts of the implementation process could improve by making it more user-friendly."

"I have received complaints from my customers that the pricing could be improved."

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"In terms of areas for improvement, what could be improved in Checkmarx Software Composition Analysis is pricing because customers always compare the pricing among secure DevOps solutions in the market. Checkmarx Software Composition Analysis has a lot of competitors yet its features aren't much different. Pricing is the first thing customers consider, and from a partner perspective, if you can offer affordable pricing to your customers, it's more likely you'll have a winning deal. The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

"The quality of technical support has decreased over time, and it is not as good as it used to be."

More Checkmarx Software Composition Analysis cons

"The deployment of Fortify Static Code Analyzer needs to be simplified."

"False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still contains many bugs and needs a thorough review."

"The generation of false positives should be reduced."

"Fortify Static Code Analyzer is a good solution, but sometimes we receive false positives. If they could reduce the number of false positives it would be good."

"The troubleshooting capabilities of this solution could be improved. This would reduce the number of cases that users have to submit."

"Fortify's software security center needs a design refresh."

"I know the areas that they are trying to improve on. They've been getting feedback for several years. There are two main points. The first thing is keeping current with static code languages. I know it is difficult because code languages pop up all the time or there are new variants, but it is something that Fortify needs to put a better focus on. They need to keep current with their language support. The second thing is a philosophical issue, and I don't know if they'll ever change it. They've done a decent job of putting tools in place to mitigate things, but static code analysis is inherently noisy. If you just take a tool out of the box and run a scan, you're going to get a lot of results back, and not all of those results are interesting or important, which is different for every organization. Currently, we get four to five errors on the side of tagging, and it notifies you of every tiny inconsistency. If the tool sees something that it doesn't know, it flags, which becomes work that has to be done afterward. Clients don't typically like it. There has got to be a way of prioritizing. There are a ton of filter options within Fortify, but the problem is that you've got to go through the crazy noisy scan once before you know which filters you need to put in place to get to the interesting stuff. I keep hearing from their product team that they're working on a way to do container or docker scanning. That's a huge market mover. A lot of people are interested in that right now, and it is relevant. That is definitely something that I'd love to see in the next version or two."

"Streamlining the upgrade process and enhancing compatibility would make it easier for us to keep our security tools up-to-date."

More Fortify Static Code Analyzer cons

Pricing and Cost Advice

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"It is a little bit high priced. It would be better if it was a little less expensive."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"The licensing is expensive and is in the 50K range."

"It has a couple of license models. The one that we use most frequently is called their flexible deployment. We use this one because it is flexible and based on the number of code-contributing developers in the organization. It includes almost everything in the Fortify suite for one developer price. It gives access to not just the secure code analyzer (SCA) but also to FSC, the secure code. It gives us accessibility to scan central, which is the decentralized scanning farm. It also gives us access to the software security center, which is the vulnerability management platform."

"The setup costs and pricing for Fortify may vary depending on the organization's needs and requirements."

"I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive."

"Although I am not responsible for the budget, Fortify SAST is expensive."

"There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost. I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use."

"From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago."

"The price of Fortify Static Code Analyzer could be reduced."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

842,388 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

37%

Manufacturing Company

14%

Computer Software Company

Healthcare Company

Financial Services Firm

30%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Checkmarx Software Composition Analysis?

The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all...

See all answers

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

See all answers

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

See all answers

What do you like most about Fortify Static Code Analyzer?

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...

See all answers

What is your experience regarding pricing and costs for Fortify Static Code Analyzer?

I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive.

See all answers

What needs improvement with Fortify Static Code Analyzer?

False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still Con...

See all answers

Comparisons

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 31% of the time

Black Duck vs Checkmarx Software Composition Analysis

Compared 28% of the time

Semgrep vs Checkmarx Software Composition Analysis

Compared 8% of the time

Polaris Software Integrity Platform vs Checkmarx Software Composition Analysis

Compared 7% of the time

Sonatype Lifecycle vs Checkmarx Software Composition Analysis

Compared 6% of the time

More Checkmarx Software Composition Analysis Competitors

Black Duck vs Fortify Static Code Analyzer

Compared 35% of the time

Snyk vs Fortify Static Code Analyzer

Compared 18% of the time

Veracode vs Fortify Static Code Analyzer

Compared 13% of the time

Sonatype Lifecycle vs Fortify Static Code Analyzer

Compared 8% of the time

Klocwork vs Fortify Static Code Analyzer

Compared 1% of the time

More Fortify Static Code Analyzer Competitors

Product Reports

Buyer's Guide

Checkmarx Software Composition Analysis

March 2025

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Buyer's Guide

Fortify Static Code Analyzer

March 2025

Download Fortify Static Code Analyzer product report

Also Known As

CxSCA

Fortify Static Code Analysis SAST

Overview

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Checkmarx

Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.

Fortify Static Code Analyzer Benefits

CI/CD pipeline security: Fortify SCA integrates well with third-party tools such as ALM Octane, Atlassian Bamboo, Azure DevOps, Eclipse, Jenkins, and Jira. It offers real-time scan results, immediate recommendations, and collaborative auditing, and finds threats faster. It also discovers and prioritizes weaknesses to reduce risk.
Cost-effective: Improves coding actions by training users as they work to better understand the relationship of static application security testing (SAST). Fortify SCA is able to find more vulnerabilities than other solutions and delivers significantly fewer false positives.
Quick and reliable scanning: Fortify SCA will discover and eradicate weaknesses in byte, binary, or source code. SAST is able to stop the bulk of code issues at the start of development. The solution is able to discover 815 specific categories of risk, works through 27 programming languages and more than one million different APIs. Fortify SCA has a positive rate of 100% in the OWASP 1.2 benchmark.

Fortify Static Code Analyzer Features

Flexible deployment: Using Fortify On Demand, users can work in a complete SaaS environment. Fortify Hosted allows users to use on-premises and SaaS to work in a secure virtual space with complete control. Fortify-On-Prem gives users absolute control of the Fortify SCA solution.
Security assistant: Users have an interactive guide as they create code that provides risk analysis and anticipated outcomes. Security Assistant is an outstanding immediate feedback tool that gives instant results with significantly fewer false positives.
Audit assistant: This feature uses machine learning to reduce manual audit time while prioritizing the most important risks to users' networks. It provides automated audits in minutes. Any manual examinations are reduced, all issues are prioritized in accordance with organizational needs, and Fortify SCA consistently provides audit results to all projects.

Results from Real Users

“Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it.” - Arun D., Senior Architect at a healthcare company.

“Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between.” - Tom H., Director of Security at Merito

OpenText

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Information Not Available

Buyer's Guide

Software Composition Analysis (SCA)

February 2025

Download Free Report

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA). Updated: February 2025.

DOWNLOAD NOW

842,388 professionals have used our research since 2012.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.