Checkmarx Software Composition Analysis vs FOSSA comparison

Checkmarx Software Composit...

Read 15 FOSSA reviews

2,414 Views
2,366 Comparison Views

92% willing to recommend

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 5, 2024

FOSSA and Checkmarx Software Composition Analysis both compete in the realm of open-source software management. FOSSA appears to have the upper hand due to its seamless integration into build pipelines and high compatibility with developer ecosystems.

Features: FOSSA is known for its robust dependency scanning features during build-time, seamless integration into build pipelines, and high compatibility with various developer ecosystems. Checkmarx offers comprehensive security scans, early-stage vulnerability detection in open-source applications, and strong integration with developer tools.

Room for Improvement: FOSSA could enhance distribution acknowledgments, implement snippet matching, and improve security vulnerability scanning. Checkmarx needs to address the speed of updates, improve the user interface's efficiency, and offer more competitive pricing.

Ease of Deployment and Customer Service: FOSSA offers flexible deployment options across Public Cloud and On-premises environments with excellent support. Checkmarx supports various deployment options but has experienced some scaling and response time challenges, although the support has improved over time.

Pricing and ROI: FOSSA's pricing is competitive but mid-range, with costs often justified by the benefits provided. Checkmarx's pricing is higher with a complex licensing model. Both products are seen to generate substantial ROI, with FOSSA recognized for its operational benefits.

To learn more, read our detailed Checkmarx Software Composition Analysis vs. FOSSA Report (Updated: June 2026).

Checkmarx Software Composition Analysis vs. FOSSA

Download the complete report

Helped 900,644 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Checkmarx Software Composit...

Ranking in Software Composition Analysis (SCA)

10th

Average Rating

9.0

Reviews Sentiment

7.6

Number of Reviews

Ranking in other categories

No ranking in other categories

FOSSA

Ranking in Software Composition Analysis (SCA)

9th

Average Rating

8.6

Reviews Sentiment

7.9

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of June 2026, in the Software Composition Analysis (SCA) category, the mindshare of Checkmarx Software Composition Analysis is 2.8%, up from 2.5% compared to the previous year. The mindshare of FOSSA is 2.4%, down from 3.2% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Software Composition Analysis (SCA) Mindshare Distribution
Product	Mindshare (%)
FOSSA	2.4%
Checkmarx Software Composition Analysis	2.8%
Other	94.8%

Software Composition Analysis (SCA)

Featured Reviews

Tharindu Malwenna

Senior Application Security Engineer at a newspaper with 5,001-10,000 employees

Efficient library identification and upgrade suggestions improve application security

We have many third-party libraries in our organization. I used Checkmarx Software Composition Analysis to identify all the libraries we use and determine whether they are used or unused within the application Checkmarx Software Composition Analysis provides identification of libraries and…

Read full review

reviewer2588340

Senior Software Engineer at a manufacturing company with 10,001+ employees

Dependency management enhanced with update suggestions but lacks precise vulnerability tracking

FOSSA does not show the exact line of code with vulnerabilities, which adds time to the process as we have to locate these manually. Some other tools like Check Point or SonarQube provide exact line numbers for bugs. Also, the process in FOSSA can be quite contradicting and not very straightforward for new users.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"Checkmarx unifies all the features in its service."

"One of the strong points of this solution is that it allows you to incorporate it into a CICB pipeline. It has the ability to do incremental scans. If you scan a very large application, it might take two hours to do the initial scan. The subsequent scans, as people are making changes to the app, scan the Delta and are very fast. That's a really nice implementation. The way they have incorporated the functionality of the incremental scans is something to be aware of. It is quite good. It has been very solid. We haven't really had any issues, and it does what it advertises to do very nicely."

"We were able to reduce the number of vulnerable libraries by 50%, leading to significant operational improvement."

"Checkmarx Software Composition Analysis is one of the most important products in the IT security market."

"The integration part is easy...It's a stable solution right now."

"What's most valuable in Checkmarx Software Composition Analysis is that it provides security from the start. In the traditional approach, an enterprise or company validates the solution before launching to a production environment, but in the modern approach, security must be checked and provided from the beginning and from the design, and this is where Checkmarx Software Composition Analysis comes in. The solution helps you make sure that every open-source application that you use is secure, and that there's no vulnerability inside that open-source application."

"What's most valuable in Checkmarx Software Composition Analysis is its ability to identify vulnerabilities in open-source components, especially if some critical issues exist."

"The product is stable and scalable."

More Checkmarx Software Composition Analysis pros

"It's easy to use, it's easy to maintain, and it saves you time on your open-source license compliance work."

"I am impressed with the tool’s seamless integration and quick results."

"FOSSA suggests solutions for dependency mismatches."

"FOSSA is well worth the investment; it is an opportunity to scale your operations, especially for a legal team to maintain pace with your technical teams in a cost-efficient way."

"Overall, it's a great product."

"Being able to know the licenses of the libraries is most valuable because we sell products, and we need to provide to the customers the licenses that we are using."

"One of the things that I really like about FOSSA is that it allows you to go very granular. For example, if there's a package that's been flagged because it's subject to a license that may be conflicts with or raises a concern with one of the policies that I've set, then FOSSA enables you to go really granular into that package to see which aspects of the package are subject to which licenses. We can ultimately determine with our engineering teams if we really need this part of the package or not. If it's raising this flag, we can make really actionable decisions at a very micro level to enable the build to keep pushing forward."

"Prior to a Puppet Enterprise release, it would take approximately two to three weeks of dedicated engineering time by a single release engineer to go through license compliance, and we just did a release in late July or early August, and with FOSSA our license compliance review took five to ten minutes."

More FOSSA pros

Cons

"The solution could improve by determining the success factor of an upgrade, which is currently lacking."

"Instant updates for end users to identify vulnerabilities as soon as possible will make Checkmarx Software Composition Analysis better. The UI of the solution could also be improved."

"It can have better licensing models."

"Some of the recommendations provided by the product are generic. Even if the recommendations provided by the product are of low level, the appropriate ones can help users deal with vulnerabilities."

"Parts of the implementation process could improve by making it more user-friendly."

"The performance of Checkmarx Software Composition Analysis also needs improvement because sometimes, it's slow, and in particular, scanning could take several hours."

"An area for improvement in Checkmarx Software Composition Analysis is for the updates to be fast."

"Personally, I currently use it as a standalone tool without integrating it with other systems, and it meets my needs adequately. As a suggestion, I request on considering to add a "what if" feature to the application. Currently, when the tool identifies issues and suggests updates, if I want to explore different scenarios, I need to prepare another file, turn it into a ZIP, and run the analysis again. It would be more convenient if there was a "what if" option in the GUI. This feature could simulate a run, allowing me to quickly check the impact of changing one or more files or versions without the need for a full rerun."

More Checkmarx Software Composition Analysis cons

"The solution provides contextualized, actionable, intelligence that alerts us to compliance issues, but there is still a little bit of work to be done on it. One of the issues that I have raised with FOSSA is that when it identifies an issue that is an error, why is it in error? What detail can they give to me? They've improved, but that still needs some work. They could provide more information that helps me to identify the dependencies and then figure out where they originated from."

"The technical support has room for improvement."

"For open-source management, FOSSA's out-of-the-box policy engine is easy to use, but the list of licenses is not as complete as we would like it to be. They should add more open-source licenses to the selection."

"The reports don't really work that well for us. They do provide good information but they perform poorly with either the number of projects, or components, in the system."

"FOSSA does not show the exact line of code with vulnerabilities, which adds time to the process as we have to locate these manually."

"I would like more customized categories because our company is so big. This is doable for them. They are still in the stages of trying to figure this out since we are one of their biggest companies that they support."

"We have seen some inaccuracies or incompleteness with the distribution acknowledgments for an application, so there's certainly some room for improvement there. Another big feature that's missing that should be introduced is snippet matching, meaning, not just matching an entire component, but matching a snippet of code that had been for another project and put in different files that one of our developers may have created."

"On the dashboard, there should be an option to increase the column width so that we can see the complete name of the GitHub repository. Currently, on the dashboard, we see the list of projects, but to see the complete name, you have to hover your mouse over an item, which is annoying."

More FOSSA cons

Pricing and Cost Advice

"We don't have a license. The usage is limited to one, two, three, five, or ten people. It is currently used for all projects, and there are plans to increase its usage."

"The license model is somewhat perplexing as it comprises multiple aspects that can be confusing for customers. The model is determined by the number of registered users and the number of projects being scanned, along with a third component that adds to the complexity."

"My customers need to pay for the licensing part, and they need to opt for an annual subscription."

"It is a little bit high priced. It would be better if it was a little less expensive."

"Pricing for Checkmarx Software Composition Analysis needs to be competitive."

"The solution's pricing is good and reasonable because you can literally use a lot of it for free."

"The solution's cost is a five out of ten."

"FOSSA is a fairly priced product. It is not either cheaper or expensive. The pricing lies somewhere in the middle. The solution is worth the money that we are spending to use it."

"FOSSA is not cheap, but their offering is top-notch. It is very much a "you get what you pay for" scenario. Regardless of the price, I highly recommend FOSSA."

"Its price is reasonable as compared to the market. It is competitively priced in comparison to other similar solutions on the market. It is also quite affordable in terms of the value that it delivers as compared to its alternative of hiring a team."

See which vendors are best for you

Use our free recommendation engine to learn which Software Composition Analysis (SCA) solutions are best for your needs.

See recommendations

900,644 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

21%

Manufacturing Company

Construction Company

Insurance Company

Manufacturing Company

19%

Financial Services Firm

13%

Comms Service Provider

Educational Organization

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

By reviewers
Company Size	Count
Small Business	7
Large Enterprise	8

By reviewers
Company Size	Count
Small Business	5
Midsize Enterprise	1
Large Enterprise	8

Questions from the Community

What is your experience regarding pricing and costs for Checkmarx Software Composition Analysis?

Pricing is complex and high for small organizations but offers great benefits for larger organizations. It is notably different compared to competitors like GitHub Advanced Security.

What needs improvement with Checkmarx Software Composition Analysis?

The solution could improve by determining the success factor of an upgrade, which is currently lacking.

What is your primary use case for Checkmarx Software Composition Analysis?

What is your experience regarding pricing and costs for FOSSA?

The solution's pricing is good and reasonable because you can literally use a lot of it for free. You have to pay for the features you need, which I think is fair. If you want to get value for free...

What needs improvement with FOSSA?

What is your primary use case for FOSSA?

I have worked with FOSSA primarily to manage the dependencies in our projects. For example, if I take a Spring Boot application, FOSSA helps in identifying mismatches or unsupported dependencies th...

Black Duck SCA vs Checkmarx Software Composition Analysis

Comparisons

Compared 25% of the time

Veracode vs Checkmarx Software Composition Analysis

Compared 12% of the time

JFrog Xray vs Checkmarx Software Composition Analysis

Compared 11% of the time

CAST SBOM Manager vs Checkmarx Software Composition Analysis

Compared 8% of the time

Polaris Platform vs Checkmarx Software Composition Analysis

Compared 3% of the time

More Checkmarx Software Composition Analysis Competitors

Snyk vs FOSSA

Compared 22% of the time

Black Duck SCA vs FOSSA

Compared 19% of the time

Mend.io vs FOSSA

Compared 8% of the time

Contrast SCA vs FOSSA

Compared 8% of the time

GitLab vs FOSSA

Compared 4% of the time

More FOSSA Competitors

Product Reports

Checkmarx Software Composition Analysis

Download Checkmarx Software Composition Analysis product report

Checkmarx Software Composition Analysis report

Download FOSSA product report

Also Known As

CxSCA

No data available

Overview

Checkmarx Software Composition Analysis offers robust features for identifying vulnerabilities in open source components. It integrates seamlessly into development processes, ensuring security from the start with its user-friendly interface and AI-enhanced suggestions. Ideal for .NET and Java applications.

Checkmarx Software Composition Analysis is an essential tool for developers looking to manage and secure open-source components. Known for its ease of integration and user-friendly design, it excels in providing comprehensive security by detecting vulnerabilities and offering actionable solutions. Developers gain from its configurability and visibility into library vulnerabilities. It further supports development with version upgrade suggestions and detailed insights, ensuring secure open-source component integration. Enhancing its effectiveness, AI-powered suggestions minimize false positives and improve scalability. While optimization of speed, performance, and pricing are anticipated, its strong integration capabilities within CI/CD pipelines make it a preferred choice for secure software development.

What are the key features of Checkmarx Software Composition Analysis?

User-Friendly Interface: Simplifies navigation and enhances usability for developers.
Incremental Scan Capability: Allows efficient continuous security assessments.
Vulnerability Detection: Provides detailed insights and solutions for identified issues.
AI-powered Suggestions: Minimizes false positives and enhances efficiency.
License Management: Assists in handling and managing license issues effectively.

What benefits can users expect from Checkmarx Software Composition Analysis?

Enhanced Security: Maintains robust protection against vulnerabilities in open source components.
Compliance Assurance: Ensures adherence to industry standards and regulations.
Visibility and Insight: Offers detailed insights into potential risks within libraries.
Scalability: Supports large-scale integration without compromising on performance.

In industries like banking and insurance, Checkmarx Software Composition Analysis proves instrumental. Utilizing static code analysis, it assists these sectors by identifying security weaknesses in software. Its integration capability with CI/CD pipelines ensures that applications adhere to strict industry compliance and security standards.

Checkmarx

FOSSA automates license compliance and manages dependencies in development environments, offering efficient policy engines and integration with build pipelines, valuable to legal and DevOps teams.

FOSSA offers deep dependency scanning, seamless compatibility with developer tools, and integrates smoothly into CI/CD pipelines. It automates license checks to save resources and maintains policy compliance. It helps in identifying open-source licensing issues and tracks dependencies to prevent vulnerabilities, easing developer workload and enhancing security practices. Despite these advantages, it requires improvements in security scanning, project categorization, and has calls for enhanced reporting and documentation. Also desired are API improvements, a broader license selection, and more global repository coverage.

What are the key features?

Deep Dependency Scanning: Evaluates dependencies to prevent vulnerabilities.
Integration with Developer Tools: Compatible with a wide range of tools.
Policy Engine: Automates license checks for compliance.
Command-Line Tool: Monitors open-source components efficiently.

What benefits should be considered?

Reduced Developer Workload: Automates processes to lessen manual tasks.
Improved Security: Identifies and mitigates vulnerabilities.
Compliance Assurance: Ensures adherence to licensing policies.
Resource Efficiency: Saves time and effort in dependency management.

In specific industries, FOSSA is used for compliance and dependency management in mobile application build processes. It scans client-facing app dependencies to identify licensing issues, integrating seamlessly into CI/CD pipelines. Its command-line tool supports legal and engineering teams in addressing licensing concerns efficiently.

Sample Customers

AXA, Liveperson, Aaron's, Playtech, Morningstar

AppDyanmic, Uber, Twitter, Zendesk, Confluent

Checkmarx Software Composition Analysis vs. FOSSA