Checkmarx is a solid application security tool that helps identify security vulnerabilities throughout the software development lifecycle, including with its AI features. Its ability to alert developers to application flaws even before the code moves to production is especially appreciable. The UI is easy to navigate and delivers fast performance, and its ability to integrate with multiple repos and CI/CD pipelines is great. Although the pricing is a bit higher, it still feels worth it. Support is fair enough. Review collected by and hosted on G2.com.
It tends to generate more noise, and even items that are negligible still get flagged. The scan speed is a bit slow compared to other tools in the market, but it does deliver on results. Pricing also feels a bit on the higher side. Review collected by and hosted on G2.com.
Poorna, thank you for your thoughtful review and we are glad that you appreciate our ability to alert developers to reviews even before code moves to production. That's our goal: to make security embedded in the whole process so developers don't have to worry about it and can focus on creating.
Regarding your feedback: reducing noise is actually an area where Checkmarx has invested heavily. Recent innovations like Checkmarx Fusion validate findings across multiple detection engines to reduce false positives, while Triage Assist prioritizes vulnerabilities based on real attackability, reachability, and exploitability.
Our customers are seeing results. I am sharing a video of one customer who appreciated our ability to identify false positives and give developers the chance to review before merging. Check it out, and please reach out to us with any other questions. We are happy to set up a demo session.
See how Checkmarx improved
