Checkmarx Software Composition Analysis vs Fortify Static Code Analyzer comparison

The compared Checkmarx and OpenText solutions aren't in the same category. Checkmarx is ranked #8 in SCA , with an average rating of 9.1, and holds a 2.6% mindshare in the category. OpenText is ranked #3 in SCAS , with an average rating of 8.2, and holds a 23.2% mindshare. Additionally, 100% of Checkmarx users are willing to recommend the solution, compared to 87% of OpenText users who would recommend it.

Checkmarx Software Composit...

Read 12 Checkmarx Software Composition Analysis reviews

1,504 Views
1,126 Comparison Views

100% willing to recommend

Fortify Static Code Analyzer

Read 16 Fortify Static Code Analyzer reviews

1,957 Views
1,337 Comparison Views

87% willing to recommend

Checkmarx Software Composit...

Fortify Static Code Analyzer

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between Checkmarx Software Composition Analysis and Fortify Static Code Analyzer based on real PeerSpot user reviews.

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA).

To learn more, read our detailed Software Composition Analysis (SCA) Report (Updated: October 2024).

Buyer's Guide

Software Composition Analysis (SCA)

October 2024

Download the complete report

Helped 814,649 peers since 2012

Categories and Ranking

Checkmarx Software Composit...

Average Rating

9.2

Number of Reviews

Ranking in other categories

Software Composition Analysis (SCA) (8th)

Fortify Static Code Analyzer

Average Rating

8.2

Number of Reviews

Ranking in other categories

Static Code Analysis (3rd)

Mindshare comparison

While both are Security Software solutions, they serve different purposes. Checkmarx Software Composition Analysis is designed for Software Composition Analysis (SCA) and holds a mindshare of 2.6%, down 3.1% compared to last year.
Fortify Static Code Analyzer, on the other hand, focuses on Static Code Analysis, holds 23.2% mindshare, up 18.9% since last year.

Software Composition Analysis (SCA)

Static Code Analysis

Featured Reviews

Sujata Sujata Ghadage

Sr Manager consultant - Digital assurance Services at ADROSONIC

Mar 14, 2024

Offers great security in the area of vulnerability detection

I am more into the SAST side, which is related to Checkmarx Software Composition Analysis. Checkmarx recently introduced DAST and software composition analysis, but I am not aware much about it. Checkmarx Software Composition Analysis is a good tool with many rules, ensuring that the product offers vulnerability detection and provides good coverage. Though my company has not integrated Checkmarx Software Composition Analysis into SDLC, we do plan to do it in the future. The product helped our company deal with a major security breach when we had to deal with a lot of SQL-related issues stemming from some of the codes, which were written earlier not using a proper framework, owing to which there were many vulnerabilities in respect to LDAP, cross-site attacks and SQL injection. The product's most effective part for identifying vulnerabilities stems from the tool's SAST capabilities. The product's dashboard has improved our company's vulnerability management processes. The tool shows a proper dashboard and offers frequent remediation options and proper compliance status, which helps to know about the number of vulnerabilities and the dashboards. The accuracy of the product's vulnerability detection is 95 percent. At an organizational level, the product is hosted on the cloud. In my company, we use the product to scan reports. I don't see anything complex in the solution from the maintenance point of view. The product is deployed in a single location where multiple people use it. The product can be described as an access-based solution. For a particular project or depending on an assignment, access is given to certain people for a month or two. After the completion of a project or assignment, the product's access to a person is removed and given to another person who needs the solution for another project. I recommend the product to those who plan to use it. It is one of the best tools in the market. The product provides good coverage and ensures that the users experience a return on investment from its use in their environment. The tool is also helpful in dealing with vulnerabilities and false positives. I rate the overall tool a nine out of ten.

Read full review

Vishal Dhamke

Vice President Application Security North America at BNP Paribas

Dec 29, 2023

An expansive platform with comprehensive security rules and patterns to identify vulnerabilities

Setting up Fortify Static Application Security Testing (SAST) involves several steps to ensure that the tool is correctly configured and integrated into your development workflow, for example: installation, license activation, user access and permissions, integration with the development environment, project configuration, custom rules and policies, etc. The initial setup is very easy. I have used the enterprise version and a standalone version. The enterprise version definitely takes an ample amount of time to deploy because it needs to have a server, other logistics, and a proper RBAC in place. The enterprise version would take an ample amount of time, but the standard version is just a few clicks. A team of four to five people is required for the maintenance, and frequent updates are required to keep all the signatures up to date. I would rate the setup a nine out of ten.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"It is a stable solution...It is a scalable solution."

"What's most valuable in Checkmarx Software Composition Analysis is its ability to identify vulnerabilities in open-source components, especially if some critical issues exist."

"The customer service and support were good."

"The integration part is easy...It's a stable solution right now."

"The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all libraries that are vulnerable and the extent of their vulnerability."

"What's most valuable in Checkmarx Software Composition Analysis is that it provides security from the start. In the traditional approach, an enterprise or company validates the solution before launching to a production environment, but in the modern approach, security must be checked and provided from the beginning and from the design, and this is where Checkmarx Software Composition Analysis comes in. The solution helps you make sure that every open-source application that you use is secure, and that there's no vulnerability inside that open-source application."

"The product is stable and scalable."

"It is very easy and user friendly. It never requires any kind of technical support. You can do everything on your own."

More Checkmarx Software Composition Analysis pros

"The integration Subset core integration, using Jenkins is one of the good features."

"You can really see what's happening after you've developed something."

"It's helped us free up staff time."

"The reference provided for each issue is extremely helpful."

"We write software, and therefore, the most valuable aspect for us is basically the code analysis part."

"Fortify integrates with various development environments and tools, such as IDEs (Integrated Development Environments) and CI/CD pipelines."

"I like the Fortify taxonomy as it provides us with a list of all of the vulnerabilities found. Fortify release updated rule packs quarterly, with accompanying documentation, that lets us know what new features are being released."

"The most valuable features include its ability to detect vulnerabilities accurately and its integration with our CI/CD pipeline."

More Fortify Static Code Analyzer pros

Cons

"Personally, I currently use it as a standalone tool without integrating it with other systems, and it meets my needs adequately. As a suggestion, I request on considering to add a "what if" feature to the application. Currently, when the tool identifies issues and suggests updates, if I want to explore different scenarios, I need to prepare another file, turn it into a ZIP, and run the analysis again. It would be more convenient if there was a "what if" option in the GUI. This feature could simulate a run, allowing me to quickly check the impact of changing one or more files or versions without the need for a full rerun."

"I would rate the scalability a seven out of ten."

"API security is an area with shortcomings that needs improvement."

"It can have better licensing models."

"Instant updates for end users to identify vulnerabilities as soon as possible will make Checkmarx Software Composition Analysis better. The UI of the solution could also be improved."

"The quality of technical support has decreased over time, and it is not as good as it used to be."

"Parts of the implementation process could improve by making it more user-friendly."

"I have received complaints from my customers that the pricing could be improved."

More Checkmarx Software Composition Analysis cons

"Streamlining the upgrade process and enhancing compatibility would make it easier for us to keep our security tools up-to-date."

"It can be tricky if you want to exclude some files from scanning. For instance, if you do not want to scan and push testing files to Fortify Software Security Center, that is tricky with some IDEs, such as IntelliJ. We found that there is an Exclude feature that is not working. We reported that to them for future fixing. It needs some work on the plugins to make them consistent across IDEs and make them easier."

"Fortify's software security center needs a design refresh."

"It comes with a hefty licensing fee."

"The pricing is a bit high."

"The troubleshooting capabilities of this solution could be improved. This would reduce the number of cases that users have to submit."

"Fortify Static Code Analyzer is a good solution, but sometimes we receive false positives. If they could reduce the number of false positives it would be good."

"The generation of false positives should be reduced."

More Fortify Static Code Analyzer cons

Pricing and Cost Advice

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"It is a little bit high priced. It would be better if it was a little less expensive."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"The licensing is expensive and is in the 50K range."

"From our standpoint, we are significantly better off with Fortify due to the favorable pricing we secured five years ago."

"There is a licensing fee, and if you bring them to the company and you want them to do the installation and the implementation in the beginning, there is a separate cost. Similarly, if you want consultation or training, there is a separate cost. I see it as suitable only for enterprises. I do not see it suitable for a small business or individual use."

"I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive."

"Although I am not responsible for the budget, Fortify SAST is expensive."

"The setup costs and pricing for Fortify may vary depending on the organization's needs and requirements."

"It has a couple of license models. The one that we use most frequently is called their flexible deployment. We use this one because it is flexible and based on the number of code-contributing developers in the organization. It includes almost everything in the Fortify suite for one developer price. It gives access to not just the secure code analyzer (SCA) but also to FSC, the secure code. It gives us accessibility to scan central, which is the decentralized scanning farm. It also gives us access to the software security center, which is the vulnerability management platform."

"The price of Fortify Static Code Analyzer could be reduced."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

814,649 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

35%

Manufacturing Company

15%

Computer Software Company

11%

Logistics Company

Financial Services Firm

30%

Computer Software Company

13%

Manufacturing Company

11%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about Checkmarx Software Composition Analysis?

The tool's visual scan analysis shows me all the libraries' vulnerabilities and license types. It helps identify the most complex issues with licenses. It provides good visibility. SCA shows me all...

See all answers

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

We have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage.

See all answers

What needs improvement with Checkmarx Software Composition Analysis?

Checkmarx Software Composition Analysis should improve dynamic analysis.

See all answers

What do you like most about Fortify Static Code Analyzer?

Integrating the Fortify Static Code Analyzer into our software development lifecycle was straightforward. It highlights important information beyond just syntax errors. It identifies issues like pa...

See all answers

What is your experience regarding pricing and costs for Fortify Static Code Analyzer?

I rate the pricing of Fortify Static Code Analyzer as a seven out of ten since it is a bit expensive.

See all answers

What needs improvement with Fortify Static Code Analyzer?

False positives need improvement in the future. Fortify's vulnerability remediation guidance helps improve code security, but I think they need to improve the focus of the solution, as it still Con...

See all answers

Comparisons

Black Duck vs Checkmarx Software Composition Analysis

Compared 34% of the time

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 23% of the time

Semgrep vs Checkmarx Software Composition Analysis

Compared 12% of the time

Polaris Software Integrity Platform vs Checkmarx Software Composition Analysis

Compared 6% of the time

Snyk vs Checkmarx Software Composition Analysis

Compared 5% of the time

More Checkmarx Software Composition Analysis Competitors

Black Duck vs Fortify Static Code Analyzer

Compared 33% of the time

Snyk vs Fortify Static Code Analyzer

Compared 21% of the time

Veracode vs Fortify Static Code Analyzer

Compared 11% of the time

Sonatype Lifecycle vs Fortify Static Code Analyzer

Compared 9% of the time

CodeSonar vs Fortify Static Code Analyzer

Compared 1% of the time

More Fortify Static Code Analyzer Competitors

Product Reports

Buyer's Guide

Checkmarx Software Composition Analysis

November 2024

Checkmarx Software Composition Analysis report

Download Checkmarx Software Composition Analysis product report

Buyer's Guide

Fortify Static Code Analyzer

November 2024

Download Fortify Static Code Analyzer product report

Also Known As

CxSCA

Fortify Static Code Analysis SAST

Learn More

Checkmarx

OpenText

Overview

Checkmarx Software Composition Analysis (SCA) helps organizations manage the risks associated with open source and third-party components in their software applications. While leveraging open source libraries and third-party dependencies is common practice, it can also introduce security vulnerabilities and license risks.

Checkmarx SCA offers a multifaceted approach to managing these risks by:

Automatically scanning project repositories, build configurations, and manifests to create a comprehensive inventory of all components, including version information and associated licenses.
Performing vulnerability assessments on each component, including identifying and prioritizing actual exploitable or reachable vulnerabilities.
Protecting organizations from software supply chain attacks involving malicious packages, such as the XZ Utils backdoor.
Identifying licenses associated and providing insights into license obligations, restrictions, and potential conflicts.
Integrating seamlessly into existing development workflows and CI/CD pipelines.
Providing actionable remediation guidance to help organizations address identified vulnerabilities and compliance issues effectively.

Fortify Static Code Analyzer (SCA) utilizes numerous algorithms in addition to a dynamic intelligence base of secure coding protocols to investigate an application’s source code for any potential risk of malicious or dangerous threats. Additionally, the solution will prioritize the most critical concerns and give direction on how users can repair those concerns. This solution researches each and every potential route that workflow and data can travel to discover and repair all possible vulnerabilities. Fortify SCA allows users to create safe and secure software quickly. Users are able to discover potential security gaps more quickly with precise outcomes and repair them immediately.

Fortify Static Code Analyzer Benefits

CI/CD pipeline security: Fortify SCA integrates well with third-party tools such as ALM Octane, Atlassian Bamboo, Azure DevOps, Eclipse, Jenkins, and Jira. It offers real-time scan results, immediate recommendations, and collaborative auditing, and finds threats faster. It also discovers and prioritizes weaknesses to reduce risk.
Cost-effective: Improves coding actions by training users as they work to better understand the relationship of static application security testing (SAST). Fortify SCA is able to find more vulnerabilities than other solutions and delivers significantly fewer false positives.
Quick and reliable scanning: Fortify SCA will discover and eradicate weaknesses in byte, binary, or source code. SAST is able to stop the bulk of code issues at the start of development. The solution is able to discover 815 specific categories of risk, works through 27 programming languages and more than one million different APIs. Fortify SCA has a positive rate of 100% in the OWASP 1.2 benchmark.

Fortify Static Code Analyzer Features

Flexible deployment: Using Fortify On Demand, users can work in a complete SaaS environment. Fortify Hosted allows users to use on-premises and SaaS to work in a secure virtual space with complete control. Fortify-On-Prem gives users absolute control of the Fortify SCA solution.
Security assistant: Users have an interactive guide as they create code that provides risk analysis and anticipated outcomes. Security Assistant is an outstanding immediate feedback tool that gives instant results with significantly fewer false positives.
Audit assistant: This feature uses machine learning to reduce manual audit time while prioritizing the most important risks to users' networks. It provides automated audits in minutes. Any manual examinations are reduced, all issues are prioritized in accordance with organizational needs, and Fortify SCA consistently provides audit results to all projects.

Results from Real Users

“Fortify Static Code Analyzer tells us if there are any security leaks or not. If there are, then it's notifying us and does not allow us to pass the DevOps pipeline. If it finds everything's perfect, as per our given guidelines, then it is allowing us to go ahead and start it, and we are able to deploy it.” - Arun D., Senior Architect at a healthcare company.

“Its flexibility is most valuable. It is such a flexible tool. It can be implemented in a number of ways. It can do anything you want it to do. It can be fully automated within a DevOps pipeline. It can also be used in an ad hoc, special test case scenario and anywhere in between.” - Tom H., Director of Security at Merito

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

Information Not Available

Buyer's Guide

Software Composition Analysis (SCA)

October 2024

Download Free Report

Find out what your peers are saying about Black Duck, Veracode, Snyk and others in Software Composition Analysis (SCA). Updated: October 2024.

DOWNLOAD NOW

814,649 professionals have used our research since 2012.

We monitor all Software Composition Analysis (SCA) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.