shouldiuse.io

Categories

VERDICT

Checkmarx Review

Depends

Should I use Checkmarx?

Agentic application security platform combining hybrid scanning, AI-powered agents, and unified risk intelligence - checkmarx.com

· 1 month ago

Buy if you are a large organization with dedicated security staff that needs enterprise-grade SAST, SCA, and agentic AI scanning in one platform. Small teams and startups should pick Snyk, Semgrep, or Aikido instead — this is heavy, quote-priced tooling built for the world's largest enterprises.

Confidence

Medium. Based on ~30 public sources; pricing is quote-only so no figures verified.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityOnly truncated third-party mentions found
  • Security posture

Pricing

Contact sales

Quote-based enterprise packages

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed

Best for

  • Enterprise dev teams at scale
  • Orgs needing SAST + SCA unified
  • Companies with dedicated AppSec staff
  • Government buyers (FedRAMP via CXG)

Not for

  • Small teams and startups — heavy overkill
  • Anyone wanting transparent, published pricing
  • Teams without staff to tune noisy scanner results
  • Solo developers — a linter and Semgrep cover you

Gotchas - check before you buy

high

March 2026 supply chain attack: data confirmed stolen; run vendor risk review

medium

Quote-based pricing; expect negotiation, often via AWS Marketplace

medium

Hour-long scans can slow CI/CD pipelines on big repos

low

Guess: platform lock-in makes migrating scan history to rivals painful

Pros and cons

Pros

  • Users consistently praise ease of use
  • SAST, SCA, container, and agentic AI in one platform
  • 4.6/5 on Gartner Peer Insights
  • FedRAMP-listed offering for government buyers
  • VS Code extension and straightforward rule writing

Cons

  • Scans can take hours on large codebases
  • No published pricing; quote-only sales process
  • Confirmed 2026 supply chain breach with stolen data
  • Reddit users cite sales and communication issues

Sources & method

- 16 sources - Confirmed supply chain attack in March 2026 with stolen data; Checkmarx published ongoing incident updates through July 2026.

official x3review x9security x2news x2
  • Supply chain attack (March 2026), Checkmarx confirmed hackers stole data in a supply chain compromise; ongoing security updates posted as of July 2026.

Key stats

  • Value for money: 2/5

    Rating

  • Not disclosed

    Starting price

  • 16

    Sources

  • Analyzed

  • Value for money: 2/5. Quote-only pricing, no published tiers, sales friction reported
  • Ease of use: 4/5. Users consistently praise ease of use on G2
  • Feature depth: 5/5. SAST, SCA, container, hybrid scanning, agentic AI combined
  • Support quality. Only truncated third-party mentions found
  • Security posture: 2/5. Confirmed 2026 supply chain breach with data stolen
  • 4.3/5 G2 rating 73 reviews
  • 4.6/5 Gartner Peer Insights Customers' Choice 2024
  • $2.5B Valuation Hellman & Friedman acquisition
  • 1,385+ Customers detected companies using Checkmarx One (Bloomberry)

Pricing

Quote-based enterprise packages

Not disclosed

  • Premium Service package sold via AWS Marketplace
  • Negotiated deals commonly achieve discounts (Vendr)

Security

Confirmed supply chain attack in March 2026 with stolen data; Checkmarx published ongoing incident updates through July 2026.

  • Supply chain attack (March 2026)Checkmarx confirmed hackers stole data in a supply chain compromise; ongoing security updates posted as of July 2026.11

What users say

Reviews trend positive (4.2–4.6 across G2 and Gartner), with praise for ease of use offset by complaints about slow scans and sales friction.

“Checkmarx is solid for SAST and SC[A]”
Reddit, r/cybersecurity
“Checkmarx scans can take hours”
StackHawk comparison guide
“Users consistently praise the ease of [use]”
G2 reviews

Alternatives

Compare Checkmarx with each alternative.

  • Snyk

    Developer-friendly SCA/SAST with smoother GitHub workflow integration

    Checkmarx vs Snyk

  • Semgrep

    Fast, lightweight SAST with simple custom rules

  • Aikido

    All-round security platform built for smaller, faster-moving teams

Companies that use it

  • PCL Construction⁷
  • Time Inc.
  • Specops Software
Full analysis

Based on ~30 public sources; pricing is quote-only so no figures verified.

Enterprise AppSec with real depth — but quote-only pricing, hour-long scans, and a 2026 breach. Overkill for small teams.

Methodology

Based on ~30 public sources; pricing is quote-only so no figures verified.

Read how a report is made.

Sources

  1. Checkmarx Reviews 2026 — G2g2.com
    review
  2. Checkmarx One Reviews & Ratings 2026 — Gartnergartner.com
    review
  3. The Developer-First Alternative to Checkmarx — StackHawkstackhawk.com
    review
  4. Snyk or Checkmarx — Reddit r/cybersecurityreddit.com
    review
  5. Checkmarx vs Semgrep — Reddit r/devsecopsreddit.com
    review
  6. Fortify vs Checkmarx vs Veracode SAST — Redditreddit.com
    review
  7. AppSec Platform Pricing — Checkmarxcheckmarx.com
    official
  8. Checkmarx pricing 2026 — Beagle Securitybeaglesecurity.com
    review
  9. Checkmarx Software Pricing — Vendrvendr.com
    review
  10. Checkmarx One Premium Service — AWS Marketplaceaws.amazon.com
    official
  11. Checkmarx Confirms Data Stolen in Supply Chain Attack — SecurityWeeksecurityweek.com
    security
  12. Ongoing Checkmarx Supply Chain Security Incident — Checkmarx blogcheckmarx.com
    security
  13. Checkmarx One for Government (CXG) — FedRAMPfedramp.gov
    official
  14. Cyber unicorn Checkmarx hits market with $2.5B price — Calcalistcalcalistech.com
    news
  15. Companies using Checkmarx One — Bloomberrybloomberry.com
    news
  16. Checkmarx Alternatives: 9 Tools Compared — Pixeepixee.ai
    review

Add this review to your site

This check for Checkmarx says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Depends Checkmarx Independent review on Should I Use It

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.