Checkmarx One Reviews

I am a partner of the vendor, and I can say that one of the clients with whom I am working has bought the licenses for Checkmarx One, and we are actually doing the security scans of their whole application base, code base, and everything.

Whatever solutions were provided by, or suggested by, Checkmarx One, we are going through them and implementing them. Some were valid and some were not applicable for us based on the scenario. That is the work experience I have working on Checkmarx One.

My experience with the initial setup of Checkmarx One is straightforward; it is not complex compared to other tools that I have tried.

Checkmarx One was deployed in a hybrid manner because they were scanning their production-based systems and then fixing the code base. It was hybrid, maybe on-premises with them, not completely on cloud.

My clients for Checkmarx One are usually enterprise-sized businesses. I have seen a return on investment from Checkmarx One.

In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically.

It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.

I would rate the stability of this solution a nine on a scale of 1 to 10 where one is low stability and 10 is high.

I would rate the scalability of this solution an eight on a scale of 1 to 10, where one is low scalability and 10 is high scalability.

I would rate technical support a nine from 1 to 10, where one is low quality of their technical support and 10 is high quality.

I have seen a return on investment from Checkmarx One.

The price of Checkmarx One should be fine as of now.

I would rate this solution a nine overall, from 1 to 10, where one is the worst solution and 10 is the best solution.

We have integrated Checkmarx into all the company's development pipelines. We use it to scan more than 4,000 repositories and around 25,000 pipelines. 

The integration is particularly useful as it works directly with several common SCM solutions in the market, such as GitHub and Bitbucket, and with CI/CD tools like Jenkins and GoCD. This allows us to register repositories quickly and scan code efficiently in our development process.

Checkmarx helps developers improve the maturity of their coding practices and brings a security mindset to development teams, product managers, and business areas. 

It aids in identifying and mitigating vulnerabilities early in the development cycle, enhancing the overall security posture of the organization.

The most valuable features of Checkmarx are its integration with multiple SCM solutions and CICD tools, its ability to scale according to user licenses, and the quick scanning process. Specifically, the Static Application Security Test (SAST) and Software Composition Analysis (SCA) are highly established and useful in identifying numerous vulnerabilities.

Checkmarx needs improvement in its Dynamic Application Security Testing (DAST) and API security features. The DAST solution uses the OWASP Zap engine, which is less powerful compared to other market solutions like Fortify's WebInspect. 

Additionally, the API security solution does not provide comprehensive results, and the secret scanning feature also needs enhancement. Furthermore, the container security and infrastructure as code scanning features are not mature enough and require significant improvements.

I have been working with Checkmarx for about two years.

Checkmarx scales very well according to the user licenses. The solution supports concurrent scans based on the number of committers, which is a significant improvement over the previous CXSAST solution that only supported a limited number of simultaneous scans. 

The scans are quick, but the time taken can vary based on the amount of code and the frequency of scans.

The technical support from the vendor is generally good, rated at about 8.5 out of ten. Checkmarx utilizes partners as integrators who offer enterprise support, including a dedicated technical account manager. The support from Checkmarx's team has improved, offering a four-hour SLA and 24/7 availability.

The initial setup is simple and quick due to its SaaS nature. It involves setting up the tenant, registering applications, and integrating with the company's SSO. The integration with CI/CD tools takes a bit more time and effort.

The implementation is typically done with the help of a partner who acts as an integrator and offers enterprise support. This includes the allocation of a dedicated professional as a technical account manager or customer success manager.

Checkmarx provides a good return on investment by preventing breaches and vulnerabilities that could be much more costly. It adds significant value by improving the security practices and mindset across the development lifecycle.

Checkmarx is not a cheap solution. For around 250 users or committers, the cost is approximately $500,000. However, the investment is justified considering the potential costs of security breaches and the benefits of improved security practices.

To achieve better results, consider performing both native integration in the SCM tool and integration using the CI/CD solution. This helps gain visibility into the deployment stages and ensures comprehensive code scanning. I'd rate the solution eight out of ten.

We use the solution to validate the source code and do SAST and security analysis. Checkmarx dynamics code analysis improved our software security posture by showcasing vulnerabilities within the code and identifying or providing recommendations on how to improve.

The solution's user interface could be improved because it seems outdated. The solution should integrate with AI and machine learning.

I have been using Checkmarx for three to four months.

I rate the solution a nine out of ten for stability.

Checkmarx is a scalable solution. Around 200 users are using the solution in our organization.

I rate the solution a nine out of ten for scalability.

The solution’s technical support is good and responsive.

Positive

The solution’s deployment might take 10 to 15 minutes.

Before choosing Checkmarx, we evaluated SonarQube. We chose Checkmarx because SonarQube does not show the security analysis.

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed.

The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code.

Overall, I rate Checkmarx a nine out of ten.

One use case is when a development team finishes, or even in the middle of, development. They run Checkmarx, which shows potential vulnerabilities. If they don't understand something, they consult with me. 

I explain what Checkmarx is highlighting, why it's "shouting" as we say, the specific vulnerability, and the problem it found in the code. Then, together, we explore the code and decide if it's a valid issue requiring a fix. 

We also discuss how to fix it, or if it's a false positive because, in their environment, the problem either cannot exist or doesn't exist in the way they use their software.

We also have another use case. When a software company, like an integration company, does a project for us, we request them to run their code through Checkmarx. If they don't have their own tool, we run it on our Checkmarx and provide them with the report. We request, or rather insist, that they fix most, if not all, of the problems Checkmarx finds. 

These might be issues they didn't consider, but we put it in the contract that they have to submit their software to a "code check," meaning they can use Checkmarx or another approved tool. If they don't have a tool or refuse, then it's okay. The key is to have it in the contract and signed. 

Otherwise, fixing the software later becomes difficult, especially when the project is nearing completion. That's why we do it when the integration begins, so there's still time to address the issues. If you wait until the very end, it's too late.

The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes. When the development teams fix them, or even some of them, it significantly enhances the security of the software. 

For example, we had a project, an outsourced one, that provided code written in PHP and included dozens of open-source utilities, libraries, and the like. Their server-side code was in PHP, and their client-side was in JavaScript. Both sides also used many libraries and utilities.

When we ran Checkmarx, it found numerous problems in both their code and the third-party software, including hundreds of high- and medium-severity issues in the PHP code. I didn't dig into the specifics; I just said, "Look, it found hundreds of high and medium problems. You need to reduce them. Before testing starts, you need to provide us the code again, and we'll run it again."

They started fixing it, and while I didn't follow up on the specific fixes, perhaps they removed some libraries. As long as the number of high and medium problems in the Checkmarx report decreased, it meant they were making progress. They hadn't finished yet, though.

After they fixed about half of the problems, we allowed them to start integration. However, they still need to fix the remaining issues, and hopefully, they will.

The most valuable feature is that Checkmarx specifies the exact line of code where it finds the problem. They show it in the report, the exact line or two lines. They also show where the problem starts and where it's used. 

Even if it's used later in routines or messages during the computation, they show both sides. For example, they show the user input and where it's being used, even if it's saved in a different file. 

They follow the code, the function code, the method code, and all the calls until it's used because they have all the code mapped. So, they show where it starts, where it's being used, and they say it hasn't been checked all the way. They prove it, not just say it, by showing exactly where the issue is. 

Even if you don't know the software, like third-party software you want to fix or modify, you know where to start looking in the code.

As for the UI, it's okay. You give it the code, it runs, and it's pretty good.

There's one thing Checkmarx can maybe fix, actually two things.

First, when we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. 

We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped.

So, even if the software reaches capacity on the computer, even though it writes it in the logs, it should also give an indication in the GUI to the person running it, saying "not enough memory" or "not enough disk space."

Another problem is that when it's scanning and it has an internal problem, for example, it cannot check something, or an internal bug or internal problem, it's being found in the logs, but there's no indication to the user. Now, this is good for them because the user runs it, gets a report, everything's fine.

But in a way, it's not good for them because the user doesn't know there's a problem since they don't check the logs. Because mostly, only the manager looks at the logs and only if there's a problem being reported. You run a process, get a report, but in the logs, there might be an indication that it couldn't check several files or understand something. There's a problem, an internal problem that can be fixed, but nobody knows about it because we don't look at the code. The user doesn't look at the logs; only the business manager does, but they don't know because the user doesn't report it, because the user doesn't know.

So, my suggestion for them is this: if they have problems, they should say, 'Here is the report,' but also indicate to the user somewhere, perhaps in the GUI, not necessarily in the report itself, 'We found 100 problems while looking at your code. Please provide us the logs so we can try to fix those.' Then they can ask if the user has any problems. This way, users would know to send them their logs, and they could improve their software, meaning fix the problems.

Now, they may not want to do this because they'll get flooded with millions of responses and millions of problems from all over the world. They would have to fix them, and people might get angry, asking why they provided a report when there were hidden problems. People might say, 'How come you gave me a report with seven or eight problems when analyzing it, there were internal problems with your code? So it's not a perfect report.'"

So, these internal issues are logged but not communicated to the user through the Checkmarx interface (GUI) or report.

The solution also has a few false positives. So, if they had an easier way for users to send an email directly, instead of just opening a ticket. Because when we open a ticket, they want all the logs and everything, and it becomes a hassle.

Perhaps they could implement an easier system where users can send a snippet of the code, along with an explanation of why they believe it's a false positive, referencing the specific report. 

This way, Checkmarx could analyze the information and the development team could potentially fix the product in those areas. It wouldn't require them to necessarily respond to the user, but I'm not sure if that's feasible for most companies. 

I have been using it for one year. 

If you have enough memory, it's scalable. You need a lot of memory for it to be scalable. 

Once you have enough memory, it is stable and scalable, and there are one or two parameters you can modify to make it even more scalable. Scalability is relatively fine.

For the scanning option, the default is to use only one main language, but you can request multiple languages. It's scalable.

Nowadays, nearly all the developers, when they finish development, either they or the team leader runs it, and they have to fix the problems.

The customer service and support are okay because the thing is, we spoke with the integrator, so we didn't reach Checkmarx tech support.

Positive

The setup was done by an integration company. 

I would definitely recommend it. It's an excellent solution.  

Overall, I would rate the solution a nine out of ten because there is always room for improvement. 

Checkmarx could perhaps give more examples of solutions in the reports. It's very good, but sometimes the solutions they give are not necessarily relevant to the code or how it's written. 

So, Checkmarx should give more examples of solutions. Although, it's not that bad because they give a few, one or two. And if you want more, you can look online. But it would help if they could refine it and give additional options for solutions.

Whenever a web application needs to be moved into production, a static code analysis or source code review must be done. The analyst runs several tools on the web application and collects details. Completing a source code review for a particular application will take around five working days.

Since we moved to Checkmarx, it has reduced the time significantly. Usually, we get the report within a day. It lists all the critical vulnerabilities and provides remediation. We provide suggestions to the customers and the project owners to fix the loopholes immediately so that we can move to production. Sometimes, the life cycle is reduced from five days to one day.

Static code reviews are small projects. Previously, with a team of four analysts, we did two project reviews every month. Since we started using the solution, we could do four projects every week with the same team.

It is very easy for the analyst to have everything in a consolidated single pane of glass. Previously, they ran multiple tools. They used one tool for source code analysis and another for static code review. Then, I manually verified each result. Since we moved to Checkmarx, it has been very easy for the analyst.

The tool gives us a shareable report that can be easily shared with management once the product is done. The solution’s performance and the consolidated information it provides are valuable. The platform is completely on the cloud. There are no scalability or connectivity issues. The platform is stable. It can be accessed from anywhere.

We used open-source tools before. We had to deploy the tools in the customers' environment to establish the connection between the tools and their product application. Since Checkmarx is a SaaS-based platform, we need only the forward connection from Checkmarx to the tool. The tool handles everything else. We just need a single firewall rule to be enabled on the platform to establish the connection.

The deployment is very simple. We need just one rule to forward the web application to Checkmarx. The scanning engine is very good. Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%. The tool has greatly reduced the time and effort our analysts need to do their tasks. It's very useful if we need to perform a short-term project. It is greatly helpful in fixing loopholes and vulnerabilities swiftly.

We can run only one project at a time. We haven't tested multiple projects at the same time. Currently, not all the projects are visible under one pane. We handle one-time projects. As a manager, I do not have the overall visibility of all projects simultaneously. I have already raised a support ticket requesting the ability to manage all projects from a single pane. There may be an option for it. However, I am not aware of it. The solution must provide more integration with different platforms.

I have been using the solution for three months.

I rate the tool's stability an eight out of ten.

The tool is scalable since it is a cloud-based solution. We have served over 100 customers.

The setup is straightforward. Our analysts had a training for half a day. They were able to use the product form the next day. We just need to purchase a license. Since it is a SaaS-based solution, no additional deployment is required. We only need to enable the firewall rule.

The solution helps us push the application into production much sooner than anticipated. If we have a web application that needs to go live, traditionally, it takes 15 days to a month to push it into production after all the security checks. If the other teams can patch the vulnerabilities as soon as we suggest them, Checkmarx can help us push the product into production within a week. It's very easy to rescan.

If someone has too many applications, they can directly integrate Checkmarx into the CI/CD pipeline. We got the license and are running the solution for our customers. We do not charge our customers for the solution. Overall, I rate the product an eight out of ten.

Our company uses the solution to check the vulnerabilities in our products at the build level. We capture, identify potential issues and fixes, and publish reports on a weekly basis. 

We work in the banking industry and have a license for 100 users.

The report function is the solution's greatest asset. We can configure reports in our build pipeline. We set them to publish scores and consolidate all the pod answers. We go through reports to understand issues and next steps. We get availability of code by clicking on that particular section. 

We are able to speed up services because the semi-application is done in the report.

The solution is very easy to navigate. 

The solution sometimes reports a false auditable code or false positive. This is not a bug but something within the software's operation that should be addressed. 

I have been using the solution for four years. 

The stability is rated an eight out of ten. 

The solution is scalable and we can use the VCM feature for multiple projects or incidents. Scalability is rated an eight out of ten. 

Technical support is very helpful so is rated a seven out of ten. 

Neutral

We did not previously use a different solution. 

Our finance team handled the setup so I don't have details. 

Our finance team implemented the solution. 

I rate the solution a seven out of ten. 

Our main uses of this solution are to ensure our required compliance policies are met, and that we are applying best practice.

This solution helps to remediate the compliance requirements we have. 

The product also increases the quality of the code the developers are able to implement. 

The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal.

We would like to be able to run scans from our local system, rather than having to always connect to the product server, which is a longer process.

We have been using this solution for two years.

The stability of this solution depends on the size of application to be scanned, as larger files result in lower performance levels.

This solution is not very easily scalable, and seems to lack the capability to manage a high volume of applications.

The technical support team for this solution are very supportive and skilled. They also define SLA's for their customers.

We found the initial setup of this solution to be okay, but it is very reliant on server capacity.

We would recommend that organizations considering this solution think about the size of the project involved, as this product works best with very small-scale applications.

I would rate this solution a seven out of ten.

We are currently using the solution for scanning code-level vulnerabilities. 

Checkmarx is more developer friendly. Developers are aware of how to use Checkmarx. It's not too complicated, and they can understand what the problem is in their code, and it helps them to write secure code. That's a big thing. It's not an obstacle for developers. They can easily write their code and make it more secure with Checkmarx. That's the main positive point.

A non-developer may struggle with the solution. 

Codebashing is the learning platform that comes bundled with Checkmarx. The thing with Codebashing is that they give you tips on how to write secure code. However, I saw other developers complain about this. Instead of telling you what the good practices are, it would be more helpful, when we are writing the code, alongside that code, to have Codebashing tell us where exactly we are going wrong and how to help secure code and if there are specific scenarios we should be considering. Basically, the integration needs to be better. 

There's a general lack of space. 

Checkmarx has a slightly difficult compilation with the CI/CD pipeline. If it could be easily integrated into the CI/CD pipeline, then it would be much easier for developers rather than being an extra step that developers have to take to make the code secure. 

We've used the solution since 2019.

The solution is stable and reliable. There are no bugs or glitches. It doesn't crash or freeze.

In general, it can scale. 

There are certain scenarios where scalability becomes an issue. I can't really give any examples, however, while it can scale, there may be hiccups. 

We may have up to a few hundred users on the solution. 

As far as I'm aware, there is a team at Checkmarx that we can contact and they are there to help us with some basic queries. It's not continuous support. It's more like they're there on the side, and we can contact them as and when required.

Positive

We have used and looked at a mix of options, including Veracode and FOSSA.

Right now, I don't really have a competing vendor in my company, so I can't compare. More importantly, I don't have that much experience with others to compare anything accurately.

I did not handle the initial setup and, therefore, cannot speak to how easy or difficult the process would be. 

The licensing is okay. I'd rate it 3.7 out of five. It is moderately priced yet not overly expensive. 

Right now, we are partners.

We have the solution deployed in the cloud and on-premises. It's a hybrid setup.

I'd rate the solution seven out of ten.

I'd recommend the product to other users. 

It is used for scanning for some other purposes. We needed Checkmarx to figure out some OS top ten issues in the codec.

The only thing I like is that Checkmarx does not need to compile. That's a good feature.

Checkmarx is not good because it has too many false positive issues. The software does not understand the code very well. It does not handle the process very well and misunderstands the logic, resulting in too many false positives. As per my experience, more than 80% of the issues are false positives, and it takes too much time to figure out which ones are true and which ones are false positives. 

Therefore, this is one of the areas of improvement for Checkmarx. It requires in-depth knowledge of the coding. 

I have been using Checkmarx for more than a year. We are using the latest version. 

I would rate it as four because the scanning engine can crash sometimes.

I would rate scalability a three out of ten. 

The technical support is not good because they charge an extra fee. If we pay them on a call basis, they will charge extra. We can only give them emails; if we have a problem, it takes over half a year to fix the issue. They're just too slow.

Neutral

The deployment is easy, but it may take around half an hour or even more because the software is huge. Also, good hardware performance is required, such as big memory and disk space.

It requires a lot of disk space and good hardware performance, and the speed is slow.

The deployment is pretty tough to do by myself.

It's expensive. I would give it a four out of ten.

We just calculated the speed of Checkmarx; it is around 40 lines of code per second. It's too slow, so we now use a Chinese software called XCheck, which is much better. It can scan around 2,000 or 5,000 lines per second, depending on the code complexity. XCheck is a product of a Chinese company called Tencent.

Overall, I would rate the solution a three out of ten. 

We mainly use this solution for static comprehension testing.

We use it for non-functional insight because it's a security vulnerability scanner. We can use Checkmarx for scanning anytime on our code base. We integrated that as part of our build-a-pipeline, and it helps us detect early. We have piloted in few applications for the shift of testing. From a metric perspective, I am unsure how we benefited from the quantifiable data, but we did benefit.

The administration in Checkmarx is very good. You can create specific teams which give you access to specific projects.

The benefits could be improved. We are a banking company, so we focus on security. We use Checkmarx for multiple applications, and IAST is an interactive application security testing that Checkmarx claims; however, we have not explored it yet.

We want to have a holistic view of the portfolio-level dashboard and not just an individual technical project level. We want an option to group several projects and view them at a business level. Additional features could include a comprehensive dashboard and secret scanning capabilities.

We have been using this solution for four years. It is deployed on-premises.

I rate the stability a six out of ten. We've had some stability issues, which may have been because of how we deployed the solution. When multiple scans are running in multiple applications, it closes down. This also happens where there is a large code base. After it runs for about 35 minutes, it abruptly closes. We have been discussing this issue with the Checkmarx team for it to be fixed.

I rate the scalability a six out of ten, and we have 100 staff engineers using this solution.

Our Checkmarx team interacts with their technical support.

I've used Veracode, and there isn't a big difference between both solutions.

I rate the initial setup a seven out of ten. When we integrated it, we built a pipeline, which was done by a separate DevOps team. Checkmarx is installed at the enterprise level, and we have a Checkmarx Dev team that runs the solution.

I rate this solution an eight out of ten. I would recommend going for a piloting approach. With Checkmarx, you have different presets and can determine the security vulnerability standard. Also, check the stability before proceeding with the adoption.