Checkmarx One vs GitHub comparison

Read 93 GitHub reviews

2,518 Views
1,112 Comparison Views

100% willing to recommend

Checkmarx One

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Jan 5, 2025

Checkmarx One and GitHub compete in the software development and security space. Checkmarx holds an advantage in code vulnerability scanning and remediation guidance, while GitHub excels in collaboration and code management.

Features: Checkmarx One excels in comprehensive code analysis, integration with development tools, and detailed reporting, enabling developers to enhance secure coding skills. It supports many programming languages and performs security checks across various environments. GitHub is known for its version control and collaboration features, supporting project management through pull requests, code reviews, and actions. It integrates extensively with development lifecycle tools and maintains robust code versioning.

Room for Improvement: Checkmarx One could reduce false positives, expand programming language support, and improve licensing flexibility. Its setup may require complex customization, and users seek clearer documentation and broader tool integrations. GitHub users request better security features, integration with project management tools, and user-friendliness for non-technical members. Handling large files and enhancing automation in workflows are also noted areas for improvement.

Ease of Deployment and Customer Service: Checkmarx One supports on-premises, hybrid, and public cloud setups but faces challenges in complex deployments. Its technical support is responsive but could improve on extended ticket handling. GitHub, primarily cloud-based, is easier to deploy with reliable support and straightforward technical assistance, emphasizing cloud simplicity and user-friendly deployment.

Pricing and ROI: Checkmarx One is viewed as expensive, influenced by user numbers and language support, offering significant ROI through security enhancements. Its pricing model is considered rigid, seen as a premium option. GitHub is cost-effective, especially with its free tier for public repositories, offering competitive rates for private ones. Users find its pricing reasonable, highlighting flexibility and accessibility.

To learn more, read our detailed Checkmarx One vs. GitHub Report (Updated: March 2025).

Checkmarx One vs. GitHub

Download the complete report

Helped 845,406 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx One

Ranking in Application Security Tools

3rd

Average Rating

7.6

Reviews Sentiment

6.9

Number of Reviews

Ranking in other categories

Static Application Security Testing (SAST) (3rd), Vulnerability Management (21st), Static Code Analysis (2nd), API Security (3rd), DevSecOps (2nd), Risk-Based Vulnerability Management (8th)

GitHub

Ranking in Application Security Tools

6th

Average Rating

8.8

Reviews Sentiment

7.5

Number of Reviews

Ranking in other categories

Version Control (3rd)

Mindshare comparison

As of April 2025, in the Application Security Tools category, the mindshare of Checkmarx One is 10.7%, down from 15.1% compared to the previous year. The mindshare of GitHub is 0.8%, down from 1.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

Rohit Kesharwani

Manager, Engineering at 7-Eleven.

Provides good security analysis and security identification within the source code

We integrate Checkmarx into our software development cycle using GitLab's CI/CD pipeline. Checkmark has been the most helpful for us in the development stage. The solution's incremental scanning feature has impacted our development speed. The solution's vulnerability detection is around 80% to 90% accurate. I would recommend Checkmarx to other users because it is one of the good tools for doing security analysis and security identification within the source code. Overall, I rate Checkmarx a nine out of ten.

Read full review

Pervez Roy

Solutions Architect at Small Systems LTD

Very good for collaboration on software projects

We use GitHub for code repository alongside Bitbucket GitHub is very good for collaboration on software projects. We prefer Bitbucket for commercial use, while GitHub is used for open source. You can get the differences, history of changes, and version control for various pull requests. You can…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"The identification of verification-related security vulnerabilities is really important and one of the key things. It also identifies vulnerabilities for any kind of third-party tool coming into the system or any third-party tools that you are using, which is very useful for avoiding random hacking."

"The most valuable features of Checkmarx are the SCA module and the code-checking module. Additionally, the solutions are explanatory and helpful."

"The most valuable feature for me is the Jenkins Plugin."

"Less false positive errors as compared to any other solution."

"The most valuable features of Checkmarx are the Best Fix Location and the Payments option because you can save a lot of time trying to mitigate the configuration. Using these tools can save you a lot of time."

"We use the solution to validate the source code and do SAST and security analysis."

"The administration in Checkmarx is very good."

"The solution improved the efficiency of our code security reviews. It helps tremendously because it finds hundreds of potential problems sometimes."

More Checkmarx One pros

"GitHub Actions, specifically in the DevOps field, have been extremely valuable."

"The most important feature of GitHub is the maintainability of the versions of the code."

"The features that I have found most valuable are that it can support you for most of the road map and it can automate some tasks which works really well with collaboration with the teams. They are really interested in how they organize the history of the code itself which is good."

"The Projects Tab, which shows you the todo list and the progress for projects, is very helpful."

"I recommend using GitHub because it is reliable and helpful for developers."

"The version control functionality for this solution has been most valuable, especially when managing projects with multiple versions."

"The control is the most valuable feature as developers can work on a single code."

"The solution has been stable for us."

More GitHub pros

Cons

"Checkmarx being Windows only is a hindrance. Another problem is: why can't I choose PostgreSQL?"

"I would like to see the DAST solution in the future."

"When we first ran it on a big project, there wasn't enough memory on the computer. It originally ran with eight gigabytes, and now it runs with 32. The software stopped at some point, and while I don't think it said it ran out of memory, it just said "stopped" and something else. We had to go to the logs and send them to the integrator, and eventually, they found a memory issue in the logs and recommended increasing the memory. We doubled it once, and it didn't seem enough. We doubled it again, and it helped."

"Micro-services need to be included in the next release."

"In terms of dashboarding, the solution could provide a little more flexibility in terms of creating more dashboards. It has some of its own dashboards that come out of the box. However, if I have to implement my own dashboards that are aligned to my organization's requirements, that dashboarding feature has limited capability right now."

"Some of the descriptions were found to be missing or were not as elaborate as compared to other descriptions. Although, they could be found across various standard sources but it would save a lot of time for developers, if this was fixed."

"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."

"This product requires you to create your own rulesets. You have to do a lot of customization."

More Checkmarx One cons

"One area for improvement in GitHub could be integration with other tools, such as test management or project management tools."

"We are not able to access GitHub from our VPN."

"If you are uploading or cloning a large file, with more than 25 megs, it's pretty slow."

"It would be better if the amount of storage were increased."

"The integration with Visual Studio Code could be more streamlined."

"GitHub should work on enhancing its search capability. The tool should add some more features and functionalities."

"The solution can improve by adding video guides, official guides, or short courses that cater to beginners who are new to the system. These resources could offer step-by-step guidance on how to use GitHub, including common procedures such as pulling and committing. Currently, many of us have to resort to searching for information on how to do these tasks via Google. An official guide provided by GitHub itself would be a valuable asset to newcomers and would save them time and effort."

"GitHub uses basic configuration, but messaging is not clear."

More GitHub cons

Pricing and Cost Advice

"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."

"The number of users and coverage for languages will have an impact on the cost of the license."

"We got a special offer for a 30% reduction for three years, after our first year. I think for a real source-code scanning tool, you have to add a lot of money for Open Source Analysis, and AppSec Coach (160 Euro per user per year)."

"The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security."

"We have purchased an annual license to use this solution. The price is reasonable."

"The solution's price is high and you pay based on the number of users."

"Checkmarx is not a cheap scanning tool, but none of the security tools are cheap. Checkmarx is a powerful scanning tool, and it’s essential to have one of these products."

"Before implementing the product I would evaluate if it is really necessary to scan so many different languages and frameworks. If not, I think there must be a cheaper solution for scanning Java-only applications (which are 90% of our applications)."

More Checkmarx One pricing and cost advice

"GitHub is a cost-effective solution."

"You don't have to pay for a license if you are using the free version."

"The licensing model for GitHub is user-based. Whenever the new developer joins we have to get a new license and register their ID. The overall price of the solution is reasonable."

"The tool offers a free program. As you go, you can upgrade from the community version to the professional one. I believe it costs about ten dollars per person, per month."

"I use the free version of the tool."

"My company purchased it. Before, we used to receive the free version, but then they purchased some of the features."

"If I consider the market standards, the product's price is pocket-friendly."

"We pay a subscription-based yearly licensing fee for the solution."

More GitHub pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

845,406 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Computer Software Company

14%

Manufacturing Company

10%

Government

Financial Services Firm

13%

Manufacturing Company

12%

Computer Software Company

11%

University

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as well. Veracode is only a cloud solution. Hope this helps.

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

What is your experience regarding pricing and costs for Checkmarx?

The pricing is relatively expensive due to the product's quality and performance, but it is worth it.

What do you like most about GitHub?

The control is the most valuable feature as developers can work on a single code.

What is your experience regarding pricing and costs for GitHub?

The pricing of GitHub depends on the choice of solutions, such as building one's own GitHub Runners to save money or using GitHub's Runners with extra costs. The pricing is considered reasonable an...

What needs improvement with GitHub?

There are still areas for improvement with GitHub Actions and their deployment workflows, as they have made significant progress but are not yet polished. Occasionally, stability can be an issue, t...

SonarQube Server (formerly SonarQube) vs Checkmarx One

Comparisons

Compared 43% of the time

Veracode vs Checkmarx One

Compared 12% of the time

Fortify on Demand vs Checkmarx One

Compared 6% of the time

Checkmarx SAST vs Checkmarx One

Compared 5% of the time

OWASP Zap vs Checkmarx One

Compared 4% of the time

More Checkmarx One Competitors

Bitbucket vs GitHub

Compared 17% of the time

Fortify on Demand vs GitHub

Compared 15% of the time

Snyk vs GitHub

Compared 12% of the time

AWS CodeCommit vs GitHub

Compared 11% of the time

Atlassian SourceTree vs GitHub

Compared 7% of the time

More GitHub Competitors

Product Reports

Checkmarx One

Download Checkmarx One product report

Download GitHub product report

Overview

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

GitHub is a web-based Git repository hosting service. It offers all of the distributed revision control and source code management (SCM) functionality of Git as well as adding its own features. Unlike Git, which is strictly a command-line tool, GitHub provides a Web-based graphical interface and desktop as well as mobile integration. It also provides access control and several collaboration features such as bug tracking, feature requests, task management, and wikis for every project.

Sample Customers

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Dominion Enterprises, NASA, Braintree, SAP, CyberAgent

Checkmarx One vs. GitHub