Try our new research platform with insights from 80,000+ expert users
Checkmarx One Logo

Checkmarx One pros and cons

Vendor: Checkmarx
3.9 out of 5
Badge Leader

Pros & Cons summary

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.
Get the report

Prominent pros & cons

PROS

Checkmarx One allows for pre-compile scanning, providing seamless SAST scanning of uncompiled code, natively integrating with all key repo formats like Git and SVN.
The integration with multiple SCM solutions and CICD tools allows for quick scanning and scaling according to user licenses.
Checkmarx One offers valuable features including SAST, Software Composition Analysis, and AI integrations, boosting efficiency and accuracy in scanning.
By implementing Checkmarx One, organizations find vulnerabilities early in the development cycle, reducing the timeline for releases and increasing speed to market.
Checkmarx One reduces false positives effectively, enhancing developer productivity and allowing for better application security management.

CONS

Checkmarx One can improve by expanding coverage for more application languages and frameworks, including mobile applications and open-source development tools.
Licensing models and support for Swift language need improvement, as major customers require support for lower prices.
Checkmarx One reports many false positives, necessitating manual segregation as "Not exploitable."
A more comprehensive support for custom rule creation and improved accessibility for these rules in Checkmarx One is necessary.
Checkmarx One could benefit from better scaling for large enterprises and improved scanning speed to fit seamlessly into continuous delivery pipelines.
 

Checkmarx One Pros review quotes

RJ
Founder at a tech company with 51-200 employees
Feb 2, 2017
The process of remediating software security vulnerabilities can now be performed (ongoing) as portions of the application are being built in advance of being compiled.
it_user318207 - PeerSpot reviewer
Senior Software Security Analyst at a financial services firm with 1,001-5,000 employees
Sep 26, 2016
It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc).
it_user531780 - PeerSpot reviewer
Senior Software Security Analyst at a financial services firm with 1,001-5,000 employees
Oct 13, 2016
We were using HPE Security Fortify to scan code for security vulnerabilities, but it can scan only after a successful compile. If the code has dependencies or build errors, the scan fails. With Checkmarx, pre-compile scanning is seamless. This allows us to scan more code.
Learn what your peers think about Checkmarx One. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,082 professionals have used our research since 2012.
it_user538254 - PeerSpot reviewer
Assistant Manager Business Development at a tech services company with 501-1,000 employees
Oct 23, 2016
Less false positive errors as compared to any other solution.
it_user547335 - PeerSpot reviewer
Innovation Consultant (Security Analyst) at a tech services company with 1,001-5,000 employees
Nov 6, 2016
Checkmarx pinpoints the vulnerability in the code and also presents the flow of malicious input across the application.
GG
Technical Program Manager at a engineering company with 10,001+ employees
Jan 16, 2017
The ability to track the vulnerabilities inside the code (origin and destination of weak variables or functions).
it_user592359 - PeerSpot reviewer
SRE Vice Group Manager at a tech services company with 10,001+ employees
Jan 23, 2017
The solution allows us to create custom rules for code checks.
it_user598917 - PeerSpot reviewer
Senior Manager at a financial services firm
Jan 31, 2017
Scan reviews can occur during the development lifecycle.
YD
Sr. Security Engineer at SugarCRM
Jul 4, 2017
Vulnerability details is valuable.
it_user607392 - PeerSpot reviewer
Security test engineer at a tech vendor with 10,001+ employees
Feb 12, 2017
The solution communicates where to fix the issue for the purpose of less iterations.
 

Checkmarx One Cons review quotes

RJ
Founder at a tech company with 51-200 employees
Feb 2, 2017
The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools.
it_user318207 - PeerSpot reviewer
Senior Software Security Analyst at a financial services firm with 1,001-5,000 employees
Sep 26, 2016
Meta data is always needed.
it_user531780 - PeerSpot reviewer
Senior Software Security Analyst at a financial services firm with 1,001-5,000 employees
Oct 13, 2016
Checkmarx reports many false positives that we need to manually segregate and mark “Not exploitable”.
Learn what your peers think about Checkmarx One. Get advice and tips from experienced pros sharing their opinions. Updated: January 2026.
881,082 professionals have used our research since 2012.
it_user538254 - PeerSpot reviewer
Assistant Manager Business Development at a tech services company with 501-1,000 employees
Oct 23, 2016
Licensing models and Swift language support are the aspects in which this product needs to improve. Swift is a new language, in which major customers require support for lower prices.
it_user547335 - PeerSpot reviewer
Innovation Consultant (Security Analyst) at a tech services company with 1,001-5,000 employees
Nov 6, 2016
Some of the descriptions were found to be missing or were not as elaborate as compared to other descriptions. Although, they could be found across various standard sources but it would save a lot of time for developers, if this was fixed.
GG
Technical Program Manager at a engineering company with 10,001+ employees
Jan 16, 2017
The lack of ability to review compiled source code. It would then be able to compete with other scanning tools, such as Veracode.
it_user592359 - PeerSpot reviewer
SRE Vice Group Manager at a tech services company with 10,001+ employees
Jan 23, 2017
This product requires you to create your own rulesets. You have to do a lot of customization.
it_user598917 - PeerSpot reviewer
Senior Manager at a financial services firm
Jan 31, 2017
C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported.
YD
Sr. Security Engineer at SugarCRM
Jul 4, 2017
Implementing a blackout time for any user or teams: Needs improvement.
it_user607392 - PeerSpot reviewer
Security test engineer at a tech vendor with 10,001+ employees
Feb 12, 2017
The resolutions should also be provided. For example, if the user faces any problem regarding an installation due to the internal security policies of their company, there should be a resolution offered.