Checkmarx One vs Veracode comparison

Checkmarx and Veracode are both solutions in the Application Security Tools category. Checkmarx is ranked #3 with an average rating of 8.2, while Veracode is ranked #2 with an average rating of 8.1. Additionally, 88% of Checkmarx users are willing to recommend the solution, compared to 89% of Veracode users who would recommend it.

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Nov 2, 2025

Veracode and Checkmarx One compete in the application security testing category. Veracode seems to have an edge due to its comprehensive AppSec training and integration capabilities.

Features: Veracode offers robust scanning capabilities and an API for seamless integration, making it ideal for automated DevOps environments like Jenkins. Its comprehensive vulnerability management includes static, dynamic, and software composition analysis, all within a SaaS model, reducing infrastructure overhead. Checkmarx One stands out with its extensive language support and strong SAST capabilities that do not require code compilation, offering deep insights into code analysis with customizable rules and results with fewer false positives.

Room for Improvement: Veracode could improve the accuracy of its reporting and work on reducing false positives and enhancing its interface and API integration based on user feedback. Checkmarx One could benefit from improving false-positive rates and enhancing integration, especially with dynamic and API security. Users are also looking for better support for emerging technologies and more flexible pricing for smaller teams.

Ease of Deployment and Customer Service: Veracode is praised for its cloud-based deployment flexibility across private, public, and hybrid configurations, and its responsive customer service. However, users note delays in resolution times. Checkmarx One offers primarily on-premises deployment with cloud options, which can suit complex security requirements. Its customer support excels in initial integration assistance.

Pricing and ROI: Veracode's higher cost is attributed to its rich features and services like eLearning, which provides value for larger enterprises but might be costly for smaller organizations. Feedback suggests a positive ROI through reduced testing and quality assurance time. Checkmarx One is similarly priced but justified by its comprehensive scanning and reduced false positives, offering scalability for a lower total cost of ownership.

To learn more, read our detailed Checkmarx One vs. Veracode Report (Updated: January 2026).

Buyer's Guide

Checkmarx One vs. Veracode

January 2026

Download the complete report

Helped 881,082 peers since 2012

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Categories and Ranking

Cortex Cloud by Palo Alto N...

Q&A Highlights

it_user1354977

Works at Securities America

Jul 08, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

My opinions are my own and do not represent any other entities that I may be or have been affiliated with. On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon. As for Checkmarx vs SonarQube... Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25. Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse. SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it. I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission. In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode. Hope that helps

See all answers

Featured Reviews

Nuno-Santos

Cybersecurity Analyst at a tech services company with 11-50 employees

Has improved real-time threat detection and unified cloud protection through AI and automation

Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent. They changed the names of the products and are now clarifying their offer. The family of the products is not easy to follow because it's very recent. Regarding the generative AI security tool, I know for sure it's Agentic. Based on my experience with Palo Alto, I can suggest what Cortex Cloud by Palo Alto Networks could make better or what additional functions could be added. This is the best tool in the market. It's not the time to tell what they could do better because it's a recent tool. The market is now adopting it. Our experience doesn't show that they need to do more.

Read full review

Shahzad Shahzad

Senior Solution Architect | L3+ Systems & Cloud Engineer | SRE Specialist at Canada Cloud Solution

Enable secure development workflows while identifying opportunities for faster scans and improved AI guidance

Checkmarx One is a very strong platform, but there are several areas where it can improve to support modern DevSecOps workflows even better. For example, better real-time developer guidance is needed. The IDE plugin should offer richer AI-powered auto-fixes similar to SNYK Code or GitHub Copilot Security, as current guidance is good but not deeply contextual for large-scale enterprise codebases. This matters because it reduces developer friction and accelerates shift-left adoption. More transparency control over the correlation engines is another need. The correlation engine is powerful but not fully transparent. Users want to understand why vulnerabilities were correlated or de-prioritized, which helps AppSec teams trust the prioritization logic. Faster SAST scan and more language coverage is needed since SAST scan can still be slow for very large mono-repos and there is limited deep support for new language frameworks like Rust and Go, along with advanced coverage for serverless-specific frameworks. This matters because large organizations want sub-minute scans in CI/CD as cloud-native ecosystems evolve fast. A strong API security module is another area for enhancement. API security scanning could be improved with active testing, API discovery, full Swagger, OpenAPI, drift detection, and schema-based fuzzing. This is important as API attacks are one of the biggest AppSec risks in 2025. Checkmarx One is strong, but I see a few areas for improvement including faster SAST scanning for large mono-repos, deeper language framework support, more transparent correlation logic, and stronger API security that includes discovery and runtime context. The IDE plugin could offer more AI-assisted fixes, and the SBOM lifecycle tracking can evolve further. Enhancing integration with SIEM and SOAR would also make enterprise adoption smoother, and these improvements would help developers and AppSec teams move faster with more accuracy.

Read full review

reviewer2703864

Head of Security Architecture at a healthcare company with 5,001-10,000 employees

Onboarding developers successfully while improving code security through IDE integration

Regarding room for improvement, we have some problems when onboarding new projects because the build process has to be done in a certain way, as Veracode analyzes the binaries and not the code by itself alone. If the process is not configured correctly, it doesn't work. That's one of the things that we are discussing with Veracode. Something positive that we've been able to do is submit formal feature requests to them, and they are working on them; they've already solved some of them. This encourages us to propose new ideas and improvements. Another improvement that we asked for this use case is to be able to configure how Veracode Fix proposes and fixes because sometimes it makes proposals using libraries that go against our architecture design made by the enterprise architecture team. For example, we want them to propose using another library, and that's something we already asked Veracode, and they are working on it. We want to specify when you see this kind of vulnerability, you can only propose these two options.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I have seen several benefits from using Cortex Cloud by Palo Alto Networks: It was easy to use and easy to migrate from the IBM platform."

"I have absolutely seen improvements in our incident close rates, with mean time to detect and respond reduced significantly, sometimes by at least forty to fifty percent."

"Overall, Cortex Cloud by Palo Alto Networks is a technically strong product, and I rate it ten out of ten."

"The AI and automation features in detecting and responding to high-risk threats are impressive; it's one of the best tools regarding AI technology and unifies security in one platform in real-time, improving vulnerability analysis, incident response, and compliance reporting."

"Cortex Cloud by Palo Alto Networks has impacted our organization positively by keeping our machines secure and our team using the dashboard to find issues quickly."

"The main benefit to using this solution is that we find vulnerabilities in our software before the development cycle is complete."

"The user interface is excellent. It's very user friendly."

"We use the solution for dynamic application testing."

"It is very useful because it fits our requirements. It is also easy to use. It is not complex, and we are satisfied with the results."

"We use the solution to validate the source code and do SAST and security analysis."

"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."

"The user interface is modern and nice to use."

"Checkmarx One has positively impacted our organization as we tend to find vulnerabilities very early in the development cycle."

More Checkmarx One pros

"I can have quick results by just uploading compiled components."

"I like the sandbox, the ability to upload compiled code, and how easy it is."

"The solution can scan old databases and old code written 20 years back."

"Ad-hoc scanning during the development cycle and reports for audits are valuable features."

"The dashboards and the threat insights it provides are very good. The dashboards are intuitive and pretty straightforward, but also pretty detailed."

"It helps me to detect vulnerabilities."

"I like Veracode's integration with our CI/CD. It automatically scans our code when we do the build. It can also detect any security flaws in our third-party libraries. Veracode is good at pinpointing the sections of code that have vulnerabilities."

"It has caught lots of flaws that could have been exploited, like SQL injection flaws. It has also improved developer engagement with information security."

More Veracode pros

Cons

"Cortex Cloud by Palo Alto Networks is creating some confusion in terms of names because this is recent."

"The pricing is high, making ROI challenging to justify, especially during transitions between solutions."

"Some aspects of the GUI can be confusing and make it difficult for me to find certain options or navigate where needed."

"Overall, I rate Cortex Cloud by Palo Alto Networks as an eight out of ten. I think that it could improve on price, as I know that the Google solution has the best price, and this is one of the conditions."

"The Dynamic Application Security Testing (DAST) feature should be better."

"Checkmarx One can be improved by reducing noise and improving false positive filtering."

"Its pricing model can be improved. Sometimes, it is a little complex to understand its pricing model."

"Scanning speed optimization is an area where improvements can be made, and we can reduce false positives."

"I would like the product to include more debugging and developed tools. It needs to also add enhancements on the coding side."

"The solution sometimes reports a false auditable code or false positive."

"Creating and editing custom rules in Checkmarx is difficult because the license for the editor comes at an additional cost, and there is a steep learning curve."

"The lack of ability to review compiled source code. It would then be able to compete with other scanning tools, such as Veracode."

More Checkmarx One cons

"They need to have a plug-in, a better integration with the development environment."

"Their platform is not consistent. It needs a lot of user experience updates. It's slow performing, and they log you out of the system every 15 minutes, so using the platform is challenging from a developer's perspective because you always have to log in."

"It would be nice if Veracode were bundled with some preferred vendors like Salesforce and offered at a discount."

"Veracode needs to shift to a more modern approach because it still feels traditional in its way of doing code scanning compared with others, such as Snyk."

"There is room for improvement in the speed of the system. Sometimes, the servers are very busy and slow... Also, the integration with SonarQube is very weak, so we had to implement a custom solution to extend it."

"One feature I would like would be more selectivity in email alerts. While I like getting these, I would like to be able to be more granular in which ones I receive."

"The Greenlight product that integrates into the IDE is not available for PHP, which is our primary language."

"A high number of false positives are reported and this should be reduced."

More Veracode cons

Pricing and Cost Advice

Information not available

"This solution is expensive. The customized package allows you to buy additional users at any time."

"The price of Checkmarx could be reduced to match their competitors, it is expensive."

"For around 250 users or committers, the cost is approximately $500,000."

"It is an expensive solution."

"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."

"Checkmarx is not a cheap scanning tool, but none of the security tools are cheap. Checkmarx is a powerful scanning tool, and it’s essential to have one of these products."

"The solution is costly."

"The solution's price is high and you pay based on the number of users."

More Checkmarx One pricing and cost advice

"Licensing cost is on a yearly basis and there are no additional costs, the pricing is straightforward."

"I don't really get too involved in the cost sides of things that's in my job, I'm more of a technical focus, but I have heard from my manager and a couple other people that the solution is quite expensive."

"The cost of Veracode is high."

"I think licensing needs to be changed or updated so that it works with adjustments. Pricing is expensive compared to the amount of scanning we perform."

"The pricing is reasonable compared to other tools."

"When I looked at the pricing, it was definitely a value. In terms of the service and what it's checking, the cost was very reasonable, particularly because we could have multiple code bases as part of a project."

"Veracode is one of the more expensive solutions in the market, but it is worth the expense because of the eLearning and the security consultations; everything is included in the license."

"The pricing is a bit high."

More Veracode pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

881,082 professionals have used our research since 2012.

Answers from the Community

it_user1354977

Works at Securities America

Jul 8, 2020

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

2 out of 3 answers

Donovan Greeff

Head of Software Delivery at a tech services company with 51-200 employees

Jul 6, 2020

Read full answer

Durga Gudimetla

Factory Head, Web (Digital), Social, Mobile Enterprise COE at a pharma/biotech company with 10,001+ employees

Jul 7, 2020

SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.

Read full answer

See all 3 answers

Top Industries

By visitors reading reviews

Performing Arts

10%

Financial Services Firm

10%

Manufacturing Company

Computer Software Company

Financial Services Firm

18%

Manufacturing Company

10%

Computer Software Company

10%

Government

Financial Services Firm

17%

Computer Software Company

13%

Manufacturing Company

10%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

By reviewers
Company Size	Count
Small Business	32
Midsize Enterprise	9
Large Enterprise	46

By reviewers
Company Size	Count
Small Business	69
Midsize Enterprise	44
Large Enterprise	115

Questions from the Community

What is your experience regarding pricing and costs for Cortex Cloud by Palo Alto Networks?

The solution is costly, with high-end capabilities suitable for enterprises. It is less affordable for startups or sm...

See all answers

What needs improvement with Cortex Cloud by Palo Alto Networks?

Regarding areas for improvement, the tool performs its functions well, but frequent name changes across Palo Alto Net...

See all answers

What is your primary use case for Cortex Cloud by Palo Alto Networks?

Cortex Cloud by Palo Alto Networks serves as our primary tool for understanding our assets and performing API integra...

See all answers

What alternatives are there for Fortify WebInspect and Fortify SCA?

I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as ...

See all answers

What do you like most about Checkmarx?

Compared to the solutions we used previously, Checkmarx has reduced our workload by almost 75%.

See all answers

What is your experience regarding pricing and costs for Checkmarx?

Checkmarx One is a premium solution, so budget accordingly. Make sure you understand how licensing scales with additi...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. Son...

See all answers

What do you like most about Veracode Static Analysis?

I like its integration with GitHub. I like using it from GitHub. I can use the GitHub URL and find out the vulnerabil...

See all answers

What is your experience regarding pricing and costs for Veracode Static Analysis?

My experience with pricing, setup cost, and licensing for Veracode is that it is fairly moderate.

See all answers

Comparisons

Prisma Cloud by Palo Alto Networks vs Cortex Cloud by Palo Alto Networks

Compared 19% of the time

Wiz vs Cortex Cloud by Palo Alto Networks

Compared 17% of the time

Microsoft Defender for Cloud vs Cortex Cloud by Palo Alto Networks

Compared 8% of the time

SentinelOne Singularity Cloud Security vs Cortex Cloud by Palo Alto Networks

Compared 7% of the time

Qualys TotalCloud vs Cortex Cloud by Palo Alto Networks

Compared 3% of the time

More Cortex Cloud by Palo Alto Networks Competitors

SonarQube vs Checkmarx One

Compared 48% of the time

Checkmarx SAST vs Checkmarx One

Compared 4% of the time

OpenText Core Application Security vs Checkmarx One

Compared 3% of the time

OWASP Zap vs Checkmarx One

Compared 2% of the time

GitHub Advanced Security vs Checkmarx One

Compared 2% of the time

More Checkmarx One Competitors

SonarQube vs Veracode

Compared 12% of the time

GitHub Advanced Security vs Veracode

Compared 5% of the time

Coverity Static vs Veracode

Compared 4% of the time

OWASP Zap vs Veracode

Compared 3% of the time

JFrog Xray vs Veracode

Compared 3% of the time

More Veracode Competitors

Product Reports

Buyer's Guide

Cortex Cloud by Palo Alto Networks

January 2026

Cortex Cloud by Palo Alto Networks report

Download Cortex Cloud by Palo Alto Networks product report

Buyer's Guide

Checkmarx One

January 2026

Download Checkmarx One product report

Buyer's Guide

Veracode

January 2026

Download Veracode product report

Also Known As

No data available

Crashtest Security , Veracode Detect

Overview

Cortex Cloud by Palo Alto Networks provides comprehensive cybersecurity management, focusing on enhancing security operations with advanced automation and threat intelligence, addressing complex security challenges efficiently.

Cortex Cloud by Palo Alto Networks integrates cloud-scale data analytics and automation to streamline security operations, enabling faster threat detection and response. It leverages AI and machine learning to provide real-time threat intelligence and automate routine tasks, reducing the burden on security teams. Users benefit from improved visibility across networks and greater operational efficiency, making it crucial for enterprises aiming to secure their digital assets against evolving cyber threats.

What are the key features of Cortex Cloud by Palo Alto Networks?

Automated Threat Detection: Identifies and mitigates threats in real-time using AI algorithms.
Advanced Analytics: Provides in-depth data insights for proactive threat prevention.
Incident Management: Streamlines incident response with automated workflows.
Scalable Architecture: Offers flexibility to grow with organizational needs.

What benefits or ROI should you expect from Cortex Cloud by Palo Alto Networks reviews?

Increased Efficiency: Automation reduces manual efforts in threat management.
Enhanced Security Posture: Improved visibility leads to better threat preparedness.
Cost Savings: Minimizes expenses related to manual threat detection and response.
Scalability: Grows with the organization, reducing the need for constant upgrades.

Cortex Cloud by Palo Alto Networks is favored in sectors like finance, healthcare, and telecommunications, where data security is paramount. Its ability to integrate with existing infrastructure and provide real-time insights makes it a preferred choice for securing sensitive information and ensuring compliance within industry regulations.

Palo Alto Networks

Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.

Checkmarx One offers comprehensive application scanning across the SDLC:

Static Application Security Testing (SAST)
Software Composition Analysis (SCA)
API security
Dynamic Application Security Testing (DAST)
Container security
IaC security
Correlation, prioritization, and risk management
Codebashing secure code training
AI security
Tech partnerships extending AppSec into runtime analysis
Developer tool integrations including: CI/CD tools, development frameworks, feedback tools, IDEs, programming languages and SCMs

Checkmarx One provides everything you need to secure application development from the first line of code through deployment and runtime in the cloud. With an ever-evolving set of AppSec engines, correlation and prioritization features, and AI capabilities, Checkmarx One helps consolidate expanding lists of AppSec tools and make better sense of results. Its capabilities are designed to provide an improved developer experience to build trust with development teams and ensure the success of your AppSec program investment.

Checkmarx

Veracode is a leading provider of application security solutions, offering tools to identify, mitigate, and prevent vulnerabilities across the software development lifecycle. Its cloud-based platform integrates security into DevOps workflows, helping organizations ensure that their code remains secure and compliant with industry standards.

Veracode supports multiple application security testing types, including static analysis (SAST), dynamic analysis (DAST), software composition analysis (SCA), and manual penetration testing. These tools are designed to help developers detect vulnerabilities early in development while maintaining speed in deployment. Veracode also emphasizes scalability, offering features for enterprises that manage a large number of applications across different teams. Its robust reporting and analytics capabilities allow organizations to continuously monitor their security posture and track progress toward remediation.

What are the key features of Veracode?

Static Analysis (SAST) - Scans source code for vulnerabilities before deployment.
Dynamic Analysis (DAST) - Examines applications in a running state to detect flaws in real-time.
Software Composition Analysis (SCA) - Identifies risks in open-source libraries and third-party components.
Manual Penetration Testing - Offers expert analysis for more complex vulnerabilities.
Integrations with DevOps tools - Seamlessly integrates with CI/CD pipelines for automated security checks.

What benefits should users consider in Veracode reviews?

Early detection of vulnerabilities - Helps developers fix security issues early in the development process.
Scalability - Supports organizations with large-scale application portfolios.
Compliance support - Ensures applications meet various security standards and regulations.
Developer training - Provides tools for educating developers on secure coding practices.
Comprehensive reporting - Offers detailed reports that track remediation and risk trends.

Veracode is widely adopted in industries like finance, healthcare, and government, where compliance and security are critical. It helps these organizations maintain strict security standards while enabling rapid development through its integration with Agile and DevOps methodologies.

Veracode helps businesses secure their applications efficiently, ensuring they can deliver safe and compliant software at scale.

Veracode

Sample Customers

Information Not Available

YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech Case Study: Liveperson Implements Innovative Secure SDLC

Manhattan Associates, Azalea Health, Sabre, QAD, Floor & Decor, Prophecy International, SchoolCNXT, Keap, Rekner, Cox Automotive, Automation Anywhere, State of Missouri and others.

Buyer's Guide

Checkmarx One vs. Veracode

January 2026

Free Report: Checkmarx One vs. Veracode

Find out what your peers are saying about Checkmarx One vs. Veracode and other solutions. Updated: January 2026.

DOWNLOAD NOW

881,082 professionals have used our research since 2012.

See our Checkmarx One vs. Veracode report.

See our list of best Application Security Tools vendors, best Static Application Security Testing (SAST) vendors, and best Container Security vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.