Checkmarx Software Composition Analysis vs Fortify Static Code Analyzer comparison

The compared Checkmarx and OpenText solutions aren't in the same category. Checkmarx is ranked #8 in SCA , with an average rating of 9.0, and holds a 2.5% mindshare in the category. OpenText is ranked #3 in SCAS , with an average rating of 8.2, and holds a 25.1% mindshare. Additionally, 100% of Checkmarx users are willing to recommend the solution, compared to 87% of OpenText users who would recommend it.

Checkmarx Software Composit...

Read 13 Checkmarx Software Composition Analysis reviews

1,437 Views
1,075 Comparison Views

100% willing to recommend

Fortify Static Code Analyzer

Read 16 Fortify Static Code Analyzer reviews

1,829 Views
1,289 Comparison Views

87% willing to recommend

Checkmarx Software Composit...

Fortify Static Code Analyzer

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Fortify Static Code Analyzer based on real PeerSpot user reviews.

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA).

To learn more, read our detailed Software Composition Analysis (SCA) Report (Updated: January 2025).

Buyer's Guide

Software Composition Analysis (SCA)

January 2025

Download the complete report

Helped 831,265 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (8th)

Fortify Static Code Analyzer

Average Rating

8.2

Reviews Sentiment

7.1

Number of Reviews

Ranking in other categories

Static Code Analysis (3rd)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Checkmarx Software Composition Analysis is designed for Software Composition Analysis (SCA) and holds a mindshare of 2.5%, down 3.2% compared to last year.
Fortify Static Code Analyzer, on the other hand, focuses on Static Code Analysis, holds 25.1% mindshare, up 19.9% since last year.

Software Composition Analysis (SCA)

Static Code Analysis

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at Wiley

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

Vishal Dhamke

Vice President Application Security North America at BNP Paribas

An expansive platform that comes with a comprehensive set of security rules and patterns to identify vulnerabilities

Setting up Fortify Static Application Security Testing (SAST) involves several steps to ensure that the tool is correctly configured and integrated into your development workflow say for instance Installation, License Activation, User Access and Permissions, Integration with Development Environment, Project Configuration, Custom Rules and Policies, etc. The initial setup is very easy, have used the enterprise version and a standalone version. The enterprise version definitely takes an ample amount of time to deploy because it needs to have a server along with other logistics in place along with a proper RBAC. The enterprise version would take an ample amount of time, but the standard version is just a few clicks. A team of four to five people is required for the maintenance and frequent updates are required to keep all the signatures up to date. I would rate the setup a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The most valuable feature of Checkmarx Software Composition Analysis is the comprehensive security scan."

"What's most valuable in Checkmarx Software Composition Analysis is its ability to identify vulnerabilities in open-source components, especially if some critical issues exist."

"The integration part is easy...It's a stable solution right now."

"The product is stable and scalable."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

"One of the strong points of this solution is that it allows you to incorporate it into a CICB pipeline. It has the ability to do incremental scans. If you scan a very large application, it might take two hours to do the initial scan. The subsequent scans, as people are making changes to the app, scan the Delta and are very fast. That's a really nice implementation. The way they have incorporated the functionality of the incremental scans is something to be aware of. It is quite good. It has been very solid. We haven't really had any issues, and it does what it advertises to do very nicely."

"The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all libraries that are vulnerable and the extent of their vulnerability."

"I appreciate the user-friendly interface. The GUI is excellent, providing detailed information on outdated versions, including version numbers and the flow of library calls. This allows me to plan and prioritize library changes based on potential vulnerabilities, even if the affected library is indirectly used in my project. The tool offers specific guidance on addressing these issues."

More Checkmarx Software Composition Analysis pros

"You can really see what's happening after you've developed something."

"It's helped us free up staff time."

"We've found the documentation to be very good."

"Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between."

"The integration Subset core integration, using Jenkins is one of the good features."

"Automating the Jenkins plugins and the build title is a big plus."

"The most valuable features include its ability to detect vulnerabilities accurately and its integration with our CI/CD pipeline."

"Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like password credentials and access keys embedded in the code."

More Fortify Static Code Analyzer pros

Cons

"In terms of areas for improvement, what could be improved in Checkmarx Software Composition Analysis is pricing because customers always compare the pricing among secure DevOps solutions in the market. Checkmarx Software Composition Analysis has a lot of competitors yet its features aren't much different. Pricing is the first thing customers consider, and from a partner perspective, if you can offer affordable pricing to your customers, it's more likely you'll have a winning deal. The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"Instant updates for end users to identify vulnerabilities as soon as possible will make Checkmarx Software Composition Analysis better. The UI of the solution could also be improved."

"The quality of technical support has decreased over time, and it is not as good as it used to be."

"Some of the recommendations provided by the product are generic. Even if the recommendations provided by the product are of low level, the appropriate ones can help users deal with vulnerabilities."

"I have received complaints from my customers that the pricing could be improved."

"Personally, I currently use it as a standalone tool without integrating it with other systems, and it meets my needs adequately. As a suggestion, I request on considering to add a "what if" feature to the application. Currently, when the tool identifies issues and suggests updates, if I want to explore different scenarios, I need to prepare another file, turn it into a ZIP, and run the analysis again. It would be more convenient if there was a "what if" option in the GUI. This feature could simulate a run, allowing me to quickly check the impact of changing one or more files or versions without the need for a full rerun."

"Parts of the implementation process could improve by making it more user-friendly."

More Checkmarx Software Composition Analysis cons

"The product shows false positives for Python applications."

"The price can be improved."

"Their licensing is expensive."

"Not all languages are supported in Fortify."

"The generation of false positives should be reduced."

"It comes with a hefty licensing fee."

"False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still contains many bugs and needs a thorough review."

More Fortify Static Code Analyzer cons

Pricing and Cost Advice

"It is a little bit high priced. It would be better if it was a little less expensive."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"Although I am not responsible for the budget, Fortify SAST is expensive."

"I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive."

"The setup costs and pricing for Fortify may vary depending on the organization's needs and requirements."

"It has a couple of license models. The one that we use most frequently is called their flexible deployment. We use this one because it is flexible and based on the number of code-contributing developers in the organization. It includes almost everything in the Fortify suite for one developer price. It gives access to not just the secure code analyzer (SCA) but also to FSC, the secure code. It gives us accessibility to scan central, which is the decentralized scanning farm. It also gives us access to the software security center, which is the vulnerability management platform."

"From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago."

"There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost. I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use."

"The licensing is expensive and is in the 50K range."

"The price of Fortify Static Code Analyzer could be reduced."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

831,265 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

37%

Manufacturing Company

15%

Computer Software Company

Logistics Company

Financial Services Firm

30%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Checkmarx Software Composition Analysis?

The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all...

See all answers

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

See all answers

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

See all answers

What do you like most about Fortify Static Code Analyzer?

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...

See all answers

What is your experience regarding pricing and costs for Fortify Static Code Analyzer?

I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive.

See all answers

What needs improvement with Fortify Static Code Analyzer?

False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still Con...

See all answers

Comparisons

Black Duck vs Checkmarx Software Composition Analysis

Compared 31% of the time

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 26% of the time

Semgrep vs Checkmarx Software Composition Analysis

Compared 11% of the time

Polaris Software Integrity Platform vs Checkmarx Software Composition Analysis

Compared 6% of the time

Mend.io vs Checkmarx Software Composition Analysis

Compared 5% of the time

More Checkmarx Software Composition Analysis Competitors

Black Duck vs Fortify Static Code Analyzer

Compared 35% of the time

Snyk vs Fortify Static Code Analyzer

Compared 19% of the time

Veracode vs Fortify Static Code Analyzer

Compared 12% of the time

Sonatype Lifecycle vs Fortify Static Code Analyzer

Compared 9% of the time

Klocwork vs Fortify Static Code Analyzer

Compared 1% of the time

More Fortify Static Code Analyzer Competitors

Product Reports

Buyer's Guide

Checkmarx Software Composition Analysis

January 2025

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Buyer's Guide

Fortify Static Code Analyzer

December 2024

Download Fortify Static Code Analyzer product report

Also Known As

CxSCA

Fortify Static Code Analysis SAST

Learn More

Checkmarx

OpenText

Overview

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.

Fortify Static Code Analyzer Benefits

CI/CD pipeline security: Fortify SCA integrates well with third-party tools such as ALM Octane, Atlassian Bamboo, Azure DevOps, Eclipse, Jenkins, and Jira. It offers real-time scan results, immediate recommendations, and collaborative auditing, and finds threats faster. It also discovers and prioritizes weaknesses to reduce risk.
Cost-effective: Improves coding actions by training users as they work to better understand the relationship of static application security testing (SAST). Fortify SCA is able to find more vulnerabilities than other solutions and delivers significantly fewer false positives.
Quick and reliable scanning: Fortify SCA will discover and eradicate weaknesses in byte, binary, or source code. SAST is able to stop the bulk of code issues at the start of development. The solution is able to discover 815 specific categories of risk, works through 27 programming languages and more than one million different APIs. Fortify SCA has a positive rate of 100% in the OWASP 1.2 benchmark.

Fortify Static Code Analyzer Features

Flexible deployment: Using Fortify On Demand, users can work in a complete SaaS environment. Fortify Hosted allows users to use on-premises and SaaS to work in a secure virtual space with complete control. Fortify-On-Prem gives users absolute control of the Fortify SCA solution.
Security assistant: Users have an interactive guide as they create code that provides risk analysis and anticipated outcomes. Security Assistant is an outstanding immediate feedback tool that gives instant results with significantly fewer false positives.
Audit assistant: This feature uses machine learning to reduce manual audit time while prioritizing the most important risks to users' networks. It provides automated audits in minutes. Any manual examinations are reduced, all issues are prioritized in accordance with organizational needs, and Fortify SCA consistently provides audit results to all projects.

Results from Real Users

“Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it.” - Arun D., Senior Architect at a healthcare company.

“Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between.” - Tom H., Director of Security at Merito

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Information Not Available

Buyer's Guide

Software Composition Analysis (SCA)

January 2025

Download Free Report

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA). Updated: January 2025.

DOWNLOAD NOW

831,265 professionals have used our research since 2012.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.