Checkmarx

Enterprise application security platform covering SAST, SCA, secrets, IaC, API and container scanning.

PaidCode security and static analysis tools

Updated Nov 2, 2026 · AppBreakup editorial · Web

Visit Checkmarx See 7 alternatives

Is Checkmarx free?

No, it's a paid product

4 alternatives with a free option

Switch from Checkmarx to

All 7

SonarQube
Starting price: $34/month (Team plan, up to 100k LOC)
Veracode
Paid
Semgrep
Starting price: $30 per contributor/month (Teams)

Verified facts: 4 of 4
Alternatives ranked: 7
Approved reviews: 0
Visits sent from here: 0

About Checkmarx

Checkmarx is one of the long-established enterprise application security testing vendors. Its Checkmarx One platform bundles static analysis (SAST), software composition analysis for open-source dependencies, secrets detection, infrastructure-as-code scanning, API security, container security, malicious package protection and DAST, with an application security posture management layer that correlates findings into one risk view. Newer additions include AI agents for developer assistance and triage, a hybrid scanning engine that combines rules with AI, and scanning of AI supply chains, LLMs and MCP servers. It integrates with source control, CI pipelines and IDEs. Checkmarx targets large enterprises and regulated industries, and lists SOC 2, ISO 27001 and FedRAMP authorisation. Pricing is not published; it is sold through sales and cloud marketplaces on annual contracts. It is a heavier tool than developer-first scanners like Semgrep, with more coverage across languages and attack surfaces but more setup and tuning.

Best for: Large enterprises that want one vendor for SAST, SCA and broader AppSec posture management.

What works

Covers SAST, SCA, secrets, IaC, API and containers in one platform
Posture management correlates findings across scanners
FedRAMP authorised for public-sector buyers

Why people leave

No published pricing or free tier
Heavier to roll out and tune than developer-first scanners
Aimed at large organisations rather than small teams

Checkmarx vs SonarQube, Veracode and Semgrep

From each app's listing and the prices verified on its own site. A dash means we haven't verified it yet.

Attribute	Checkmarx	SonarQube	Veracode	Semgrep
Pricing	Paid	Free plan + paid	Paid	Free plan + paid
Verified price	—	$34/month (Team plan, up to 100k LOC)	—	$30 per contributor/month (Teams)
Free plan	No	Private projects up to 50k LOC	No	Yes, up to 10 contributors
Open source	No	Yes	No	Yes
Self-hostable	No	Yes	No	No
Platforms	Web	Web, Self-hosted	Web	Web, Windows, macOS, Linux

Top Checkmarx alternatives

See all 7

1
SonarQube
Combines code quality and security checks, with a self-hosted community edition.
76.8
2
Veracode
Comparable enterprise AppSec suite with SAST, DAST, SCA and pen-testing services.
68.8
3
Semgrep
Faster, developer-friendly scanning with easy custom rules and a free tier.
64.8
4
CodeQL
Free for public repos and built into GitHub code scanning.
59.4
5
Snyk
Developer-first scanning for code, dependencies, containers and IaC, with a free tier and IDE plugins instead of a heavy enterprise rollout.
57.5

Why people left Checkmarx

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from Checkmarx, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of Checkmarx

Your rating of Checkmarx

Name

Never shown publicly. A work email helps us verify you.

Title

Your review

What did you use it for, and what was good or bad? At least 40 characters.

Did you switch from another app?

Why did you leave it?

How can we verify you use it? (optional)

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

I received money, credit or a gift for writing this review. (Incentivized reviews are shown but don't count toward rankings.)

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

Checkmarx: common questions

What is Checkmarx?

Checkmarx: Enterprise application security platform covering SAST, SCA, secrets, IaC, API and container scanning. Best for large enterprises that want one vendor for SAST, SCA and broader AppSec posture management. Available for Web.

Is Checkmarx free?

No, Checkmarx is a paid product.

Is Checkmarx open source?

No, Checkmarx is not open source. Open-source alternatives include SonarQube and Semgrep.

What platforms does Checkmarx run on?

Checkmarx is available for Web.

What are the best alternatives to Checkmarx?

The highest-ranked Checkmarx alternatives right now are SonarQube, Veracode and Semgrep. See the full ranked list for pricing, platforms and verified facts.

Checkmarx vs SonarQube: what's the difference?

Checkmarx is a paid product; SonarQube is free with paid plans. SonarQube is open source and Checkmarx is not. Both run on Web.

See all 7 Checkmarx alternatives

Checkmarx facts

4 of 4 verified

Scanners: SAST, SCA, secrets, IaC, API; Checked Nov 2, 2026checkmarx.com(opens source in a new tab); “Fusion SAST ● Secrets Detection ● IaC Security ● API Security”
Certifications: SOC 2 Type II, ISO 27001; Checked Nov 8, 2026checkmarx.com(opens source in a new tab); “SOC 2 Type II Certified ISO 27001 Certified FedRAMP Authorized 01 Exploits don’t wait.”
FedRAMP: Authorized; Checked Nov 8, 2026checkmarx.com(opens source in a new tab); “FedRAMP Authorized 01 Exploits don’t wait.”
Customers: 1,600+ enterprises; Checked Nov 8, 2026checkmarx.com(opens source in a new tab); “Trusted by security teams at 1,600+ enterprise customers”