What is Checkmarx used for?

Checkmarx is an application security testing platform combining SAST, SCA, API security and AI-assisted triage in a unified platform for development and security teams. It is a good fit for unifying application security tooling and securing AI-assisted software development.

How much does Checkmarx cost?

Checkmarx doesn't publish fixed prices; pricing is quoted on request.

Is Checkmarx open source?

No. Checkmarx is proprietary (closed-source) software. Open-source alternatives to Checkmarx include Semgrep, Horusec and Grype.

What are some alternatives to Checkmarx?

Checkmarx competes with Veracode, Snyk and Aikido Security. For open-source options, see Enlisted's ranked list of open-source Checkmarx alternatives.

Checkmarx: features, pricing and alternatives

About Checkmarx

Checkmarx is a commercial application security vendor whose Checkmarx One platform brings multiple testing engines under a single view of risk. It targets organizations in sectors such as financial services, healthcare, insurance and the public sector that need to scan the software they build and the open source they use.

The platform covers code security with static analysis, secrets detection, infrastructure as code scanning and API security, plus supply chain features like software composition analysis, malicious package protection, container security and repository health. Newer pieces address AI supply chain security, an AI bill of materials, LLM scanning and DAST for AI. The hybrid scanning engine Fusion and AI agents for developers and triage sit on top.

Checkmarx is proprietary and delivered as a hosted platform, with an MCP server for connecting AI coding tools. It also publishes a pricing page and offers integrations and partner programs; customers should check the vendor for current packaging.

Key features

Static application security testing
Software composition analysis for dependencies
API security scanning
Malicious package protection
AI supply chain and LLM scanning
AI agents for developer assistance and triage

Good fit for

→Unifying application security tooling
→Securing AI-assisted software development

Tags: security; appsec; sast; sca; aspm; api-security; devsecops

Checkmarx: questions and answers

What is Checkmarx used for?: Checkmarx is an application security testing platform combining SAST, SCA, API security and AI-assisted triage in a unified platform for development and security teams. It is a good fit for unifying application security tooling and securing AI-assisted software development.
How much does Checkmarx cost?: Checkmarx doesn't publish fixed prices; pricing is quoted on request.
Is Checkmarx open source?: No. Checkmarx is proprietary (closed-source) software. Open-source alternatives to Checkmarx include Semgrep, Horusec and Grype.
What are some alternatives to Checkmarx?: Checkmarx competes with Veracode, Snyk and Aikido Security. For open-source options, see Enlisted's ranked list of open-source Checkmarx alternatives.