Try our new research platform with insights from 80,000+ expert users

Aqua Cloud Security Platform vs Checkmarx One comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Jan 7, 2025

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Aqua Cloud Security Platform
Ranking in Container Security
26th
Ranking in DevSecOps
13th
Average Rating
8.0
Reviews Sentiment
6.8
Number of Reviews
16
Ranking in other categories
Cloud and Data Center Security (19th), Cloud Workload Protection Platforms (CWPP) (21st), Cloud-Native Application Protection Platforms (CNAPP) (19th), Software Supply Chain Security (17th)
Checkmarx One
Ranking in Container Security
15th
Ranking in DevSecOps
3rd
Average Rating
7.8
Reviews Sentiment
6.6
Number of Reviews
81
Ranking in other categories
Application Security Tools (2nd), Static Application Security Testing (SAST) (3rd), Vulnerability Management (17th), Static Code Analysis (2nd), API Security (3rd), Dynamic Application Security Testing (DAST) (2nd), Risk-Based Vulnerability Management (8th), Application Security Posture Management (ASPM) (3rd), AI Security (2nd)
 

Mindshare comparison

As of March 2026, in the Container Security category, the mindshare of Aqua Cloud Security Platform is 2.9%, down from 3.7% compared to the previous year. The mindshare of Checkmarx One is 2.3%, down from 2.6% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Container Security Mindshare Distribution
ProductMindshare (%)
Checkmarx One2.3%
Aqua Cloud Security Platform2.9%
Other94.8%
Container Security
 

Featured Reviews

Burak AKCAGUN - PeerSpot reviewer
Business Development Manager at Axoft Ukraine
A robust and cost-effective solution, excelling in scalability, on-premises support, and responsive technical support, making it well-suited for enterprises navigating stringent regulatory environment
The most crucial aspect is runtime protection, specifically image scanning before preproduction and deployment. Customers find it invaluable to have the ability to check for vulnerabilities in an image before deployment, similar to a sandbox environment. This feature ensures that customers can identify any potential issues with the image, such as misconfigurations or vulnerabilities, before integrating it into their workloads and infrastructure. In their source pipeline, companies can identify issues before deploying changes. This is crucial because customers prefer resolving any problems or misconfigurations before the deployment process. Software change security, including GSPM Cloud, is a key feature customers seek in their infrastructure.
Shahzad Shahzad - PeerSpot reviewer
Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution
Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance
Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"From what I understand, the initial setup is simple."
"The CSPM product is great at securing our cloud accounts and I really like the runtime protection for containers and functions too."
"We use Aqua Security for the container security features."
"Support is very helpful."
"The most valuable feature is the security."
"The container security element of this product has been very valuable to our organization."
"The DTA, which stands for Dynamic Threat Analysis, allows me to analyze Docker images in a sandbox environment before deployment, helping me anticipate risks."
"The most helpful feature of Aqua Security is Drift Prevention, which is a feature that allows images to be immutable. In addition, one of the main reasons we went with Aqua Security is because it provides strong protection when it comes to runtime security."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"We use the solution for dynamic application testing."
"The UI is user-friendly."
"What I like best about Checkmarx is that it has fewer false positives than other products, giving you better results."
"The most valuable feature is the application tracking reporting."
"It shows in-depth code of where actual vulnerabilities are."
"Overall, I use Checkmarx One as a strategic control point to improve developer velocity while strengthening application security across the full software lifecycle."
"The report function is the solution's greatest asset."
 

Cons

"Aqua Security lacks a lot in reporting."
"I would like Aqua Security to look into is the development of a web security portal."
"They want to release improvements to their product to work with other servers because now there are more focused on the Kubernetes environment. They need to improve the normal servers. I would like to have more options."
"There's room for improvement, particularly in management capabilities as it may not be comprehensive enough for all customers, and it has been lacking in the realm of cloud security posture management."
"Aqua Security could provide more open documentation so that their learning resources can be more easily accessed and searched through online. Right now, a lot of the documentation is closed and not available to the public."
"We would like to see an improvement in the overview visibility that this solution offers."
"It's a bit hard to use the user roles. That was a bit confusing."
"Since we are working from home, we would like to have the proper training for Aqua."
"The tool is currently quite static in terms of finding security vulnerabilities. It would be great if it was more dynamic and we had even more tools at our disposal to keep us safe. It would help if there was more scanning or if the process was more automated."
"If it is a very large code base then we have a problem where we cannot scan it."
"For Checkmarx One, I think that adding repositories and scanning impromptu code could improve it."
"Checkmarx needs to be more scalable for large enterprise companies."
"There are some downtimes when Checkmarx One is being upgraded to the latest version or some improvement is there."
"One area for improvement in Checkmarx is pricing, as it's more expensive than other products."
"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."
"Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context."
 

Pricing and Cost Advice

"The pricing of this solution could be improved."
"It comes at a reasonable cost."
"Dealing with licensing costs isn't my responsibility, but I know that the licenses don't depend on the number of users, but instead are priced according to your workload."
"Aqua Security is not cheap, and it's not very expensive, such as Splunk, they are in the middle."
"They were reasonable with their pricing. They were pretty down-to-earth about the way they pitched their product and the way they tried to close the deal. They were one of the rare companies that approached the whole valuation in a way that made sense for our company, for our needs, and for their own requirements as well... They will accommodate your needs if they are able to understand them and they're stated clearly."
"The number of users and coverage for languages will have an impact on the cost of the license."
"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."
"The price of Checkmarx could be reduced to match their competitors, it is expensive."
"The interface used to create custom rules comes at an additional cost."
"The license has a vague language around P1 issues and the associated support. Make sure to review these in order to align them with your organizational policies."
"The tool's pricing is fine."
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."
report
Use our free recommendation engine to learn which Container Security solutions are best for your needs.
884,873 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
22%
Computer Software Company
10%
Manufacturing Company
9%
Government
9%
Financial Services Firm
17%
Manufacturing Company
10%
Computer Software Company
9%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business6
Midsize Enterprise1
Large Enterprise10
By reviewers
Company SizeCount
Small Business32
Midsize Enterprise9
Large Enterprise46
 

Questions from the Community

What do you think of Aqua Security vs Prisma Cloud?
Aqua Security is easy to use and very manageable. Its main focus is on Kubernetes and Docker. Security is a very valuable feature and their speed of integration is very good. The initial setup was ...
What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
What is your experience regarding pricing and costs for Checkmarx?
Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additional applications and users. I advise negotiating multi-year contracts or bundle...
What needs improvement with Checkmarx?
One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If it is possible to set it in the SAST portal to scan the repositories automaticall...
 

Also Known As

Aqua Security Platform, CloudSploit, Argon
No data available
 

Overview

 

Sample Customers

HPE Salesforce Telstra Ellie Mae Cathay Pacific HomeAway
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Find out what your peers are saying about Aqua Cloud Security Platform vs. Checkmarx One and other solutions. Updated: March 2026.
884,873 professionals have used our research since 2012.