Try our new research platform with insights from 80,000+ expert users

Checkmarx One vs Fortify Software Security Center comparison

Checkmarx and OpenText are both solutions in the Static Application Security Testing (SAST) category. Checkmarx is ranked #3 with an average rating of 8.3, while OpenText is ranked #30 with an average rating of 8.0. Checkmarx holds a 9.5% mindshare in SAST, compared to OpenText’s 0.4% mindshare. Additionally, 87% of Checkmarx users are willing to recommend the solution, compared to 100% of OpenText users who would recommend it.
Checkmarx One
Read 71 Checkmarx One reviews
  • 18,391 Views
  • 1,754 Comparison Views
87% willing to recommend
Fortify Software Security C...
Read 6 Fortify Software Security Center reviews
  • 490 Views
  • 51 Comparison Views
100% willing to recommend
 

Comparison Buyer's Guide

Download the report
Executive SummaryUpdated on Oct 8, 2024

Fortify Software Security Center and Checkmarx One are two prominent solutions competing in application security. Checkmarx One appears to have the upper hand due to its comprehensive features and ease of use.

Features: Fortify offers comprehensive vulnerability coverage, numerous integration options, and strong support. Checkmarx One is known for its intuitive functionality, robust scanning capabilities, and support for multiple programming languages.

Room for Improvement: Fortify users point out the need for improved reporting, faster scanning speeds, and enhanced analytics. Checkmarx One could benefit from better scan accuracy, a more user-friendly installation, and further optimization of its accuracy.

Ease of Deployment and Customer Service: Fortify's deployment is stable but has a steep learning curve. Customer service is proactive yet needs faster response times. Checkmarx One offers a smoother deployment and consistent customer support.

Pricing and ROI: Fortify has a manageable initial setup cost, though its ROI is questioned due to optimization time. Checkmarx One is more expensive but justifies its ROI with streamlined processes and faster integration.

DOWNLOAD THE COMPLETE REPORT
To learn more, read our detailed Checkmarx One vs. Fortify Software Security Center Report (Updated: June 2025).
Buyer's Guide
Checkmarx One vs. Fortify Software Security Center
June 2025
Download the complete report
Helped 860,592 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Categories and Ranking

Checkmarx One
Ranking in Static Application Security Testing (SAST)
3rd
Average Rating
7.6
Reviews Sentiment
6.9
Number of Reviews
71
Ranking in other categories
Application Security Tools (3rd), Vulnerability Management (24th), Static Code Analysis (3rd), API Security (5th), DevSecOps (5th), Risk-Based Vulnerability Management (9th)
Fortify Software Security C...
Ranking in Static Application Security Testing (SAST)
30th
Average Rating
7.8
Reviews Sentiment
8.3
Number of Reviews
6
Ranking in other categories
No ranking in other categories
 

Mindshare comparison

As of July 2025, in the Static Application Security Testing (SAST) category, the mindshare of Checkmarx One is 9.5%, down from 12.7% compared to the previous year. The mindshare of Fortify Software Security Center is 0.4%, up from 0.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST)
 

Featured Reviews

Syed Hasan - PeerSpot reviewer
Partner experiences excellent technical support and seamless initial setup
In my opinion, if we are able to extract or show the report, and because everything is going towards agent tech and GenAI, it would be beneficial if it could get integrated with our code base and do the fix automatically. It could suggest how the code base is written and automatically populate the source code with three different solution options to choose from. This would be really helpful.
Read full review
Jonathan Steyn - PeerSpot reviewer
Comprehensive vulnerability analysis and customization features with decent pricing
Software Security Center is highly customizable and helps me test all vulnerability data against the latest conventions like OWASP Top Ten, CVE Top twenty-five, and several other legal compliances. WebInspect supports a number of APIs and web endpoints. I find its feature of macro recording allows for testing vulnerabilities during multi-factor authentication sessions very valuable. I appreciate the ability to further analyze data with tools like Audit Workbench.
Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The solution is always updating to continuously add items that create a level of safety from vulnerabilities. It's one of the key features they provide that's an excellent selling point. They're always ahead of the game when it comes to finding any vulnerabilities within the database."
"The setup is very easy. There is a lot of information in the documents which makes the install not difficult at all."
"Checkmarx offers many valuable features, including Static Application Security Testing (SAST), Software Composition Analysis (SCA), Infrastructure as Code (IAC), Supply Chain Security, and API Security."
"The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete."
"The solution allows us to create custom rules for code checks."
"I have seen a return on investment from Checkmarx One."
"The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes."
"The most valuable feature of Checkmarx is the user interface, it is very easy to use. We do not need to configure anything, we only have to scan to see the results."
More Checkmarx One pros
"This is a stable solution at the end of the day."
"The reporting is very useful because you can always view an entire list of the issues that you have."
"You can easily download the tool's rule packs and update them."
"The overall rating for this tool is ten out of ten."
"Fortify Analytics' AI function helps scan and provides more detailed explanations and recommendations about vulnerabilities."
"Software Security Center is highly customizable and helps me test all vulnerability data against the latest conventions like OWASP Top Ten, CVE Top twenty-five, and several other legal compliances."
"I like the explanation of issues provided by Fortify Software Security Center."
 

Cons

"The pricing can get a bit expensive, depending on the company's size."
"Checkmarx could improve the solution reports and false positives. The false positives could be reduced. For example, we have alerts that are tagged as vulnerabilities but when you drill down they are not."
"The product can be improved by continuing to expand the application languages and frameworks that can be scanned for vulnerabilities. This includes expanded coverage for mobile applications as well as open-source development tools."
"Micro-services need to be included in the next release."
"I expect application security vendors to cover all aspects of application security, including SAST, DAST, and even mobile application security testing. And it would be much better if they provided an on-premises and cloud option for all these main application security features."
"The Dynamic Application Security Testing (DAST) feature should be better."
"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."
"With Checkmarx, normally you need to use one tool for quality and you need to use another tool for security. I understand that Checkmarx is not in the parity space because it's totally different, but they could include some free features or recommendations too."
More Checkmarx One cons
"Improvements needed for Software Security Center include better aggregation views of datasets."
"Improvements needed for Software Security Center include better aggregation views of datasets."
"We are having issues with false positives that need to be resolved."
"The product's overlap feature is restrictive and requires more customization efforts, which can be expensive."
"Fortify Software Security Center's setup is really painful."
"This solution is difficult to implement, and it should be made more comfortable for the end-users."
"I am not satisfied with the percentage of false positives, which is around eighteen percent."
 

Pricing and Cost Advice

"It is an expensive solution."
"Checkmarx is comparatively costlier than other products, which is why some of the customers feel reluctant to go for it, though performance-wise, Checkmarx can compete with other products."
"I believe pricing is better compared to other commercial tools."
"Be cautious of the one-year subscription date. Once it expires, your price will go up."
"I would rate the solution’s pricing an eight out of ten. The tool’s pricing is higher than others and it is for the license alone."
"Most of my customers opted for a perpetual license. They prefer to pay the highest amount up front for the perpetual license and then pay for additional support annually."
"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."
"If you want more, you have to pay more. You have to pay for additional modules or functionalities."
More Checkmarx One pricing and cost advice
"This is a costly solution that could be cheaper."
"The solution is priced fair."
"As a Fortify partner company providing technical support, I find the product expensive in our country, where local, inexpensive products are available."
report
See which vendors are best for you
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
See recommendations
860,592 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
21%
Computer Software Company
14%
Manufacturing Company
10%
Government
6%
Manufacturing Company
19%
Financial Services Firm
16%
Computer Software Company
11%
Government
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
No data available
 

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?
I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.
See all answers
What do you like most about Checkmarx?
Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.
See all answers
What is your experience regarding pricing and costs for Checkmarx?
The pricing is relatively expensive due to the product's quality and performance, but it is worth it.
See all answers
What do you like most about Micro Focus Software Security Center?
You can easily download the tool's rule packs and update them.
See all answers
What is your experience regarding pricing and costs for Micro Focus Software Security Center?
In the beginning, it was difficult for me to verify that our usage of Fortify Software Security Center corresponded to the license and criteria. Now, we have negotiated a number of details to respe...
See all answers
What needs improvement with Micro Focus Software Security Center?
I would like the false positive issue to diminish. I have experienced a lot of false positives, but I think this is due to using an older version. I hope the new version will resolve my problem.
See all answers
 

Comparisons

SonarQube Server (formerly SonarQube) vs Checkmarx One Logo
SonarQube Server (formerly SonarQube) vs Checkmarx One
Compared 36% of the time
Veracode vs Checkmarx One Logo
Veracode vs Checkmarx One
Compared 11% of the time
Checkmarx SAST vs Checkmarx One Logo
Checkmarx SAST vs Checkmarx One
Compared 7% of the time
OpenText Core Application Security vs Checkmarx One Logo
OpenText Core Application Security vs Checkmarx One
Compared 5% of the time
OWASP Zap vs Checkmarx One Logo
OWASP Zap vs Checkmarx One
Compared 5% of the time
More Checkmarx One Competitors
OpenText Core Application Security vs Fortify Software Security Center Logo
OpenText Core Application Security vs Fortify Software Security Center
Compared 56% of the time
Acunetix vs Fortify Software Security Center Logo
Acunetix vs Fortify Software Security Center
Compared 44% of the time
More Fortify Software Security Center Competitors
 

Product Reports

Buyer's Guide
Checkmarx One
June 2025
Checkmarx One reportDownload Checkmarx One product report
Buyer's Guide
Static Application Security Testing (SAST)
June 2025
Fortify Software Security Center reportDownload Fortify Software Security Center product report
 

Also Known As

No data available
Micro Focus Software Security Center, Application Security Center, HPE Application Security Center, WebInspect
 

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • API security
  • Dynamic Application Security Testing (DAST)
  • Container security
  • IaC security
  • Correlation, prioritization, and risk management
  • Codebashing secure code training
  • AI security
  • Tech partnerships extending AppSec into runtime analysis
  • Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx
Software Security Center enables management, development, and security teams to work together to triage, track, validate, automate, and manage software security activities.
OpenText
 

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC
Neosecure, Acxiom, Skandinavisk Data Center A/S, Parkeon
Buyer's Guide
Checkmarx One vs. Fortify Software Security Center
June 2025
Free Report: Checkmarx One vs. Fortify Software Security Center
Find out what your peers are saying about Checkmarx One vs. Fortify Software Security Center and other solutions. Updated: June 2025.
DOWNLOAD NOW
860,592 professionals have used our research since 2012.
See our Checkmarx One vs. Fortify Software Security Center report.
See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.