The most valuable features are the easy to understand interface, and it's very user-friendly. Reduce the code using cxsast plugin. It will scan code line by line and find most of vulnerabilities. Very easy to use. Vulnerability report is awesome. Review collected by and hosted on G2.com.

UI should update. Reduce the false positive. Please upgrade rules set to avoid the false positive. Review collected by and hosted on G2.com.

Checkmarx has an impressive Codebashing feature that has the edge over SonarQube. The application tracking-reporting feature is good too. I like the "delta-scan" feature as it is really good for cases when there are very frequent scans needed (e.g. with every major code commit, we don't want the entire source code scan to happen again). Having used both tools extensively (SonarQube and Checkmarx), I prefer Checkmarx overall. Checkmarx also fares better compared to peers when it comes to finding any vulnerabilities within the database. Since ours is a user-information driven application, it becomes even more imminent to identify the data-specific vulnerabilities at the earliest. Review collected by and hosted on G2.com.

Dashboarding could be better. The UI to show the current issue and the descriptive/suggestive text for the potential fix could be more "obvious" to the end-users. SonarQube scores over Checkmarx in this regard. Also, dashboarding could provide a little more flexibility towards the creation of new widgets. One more thing that I disliked about Checkmarx is that I could not find a free version in the market. Even for making an initial comparison, I had to contact the sales rep (the sales rep were pretty quick to respond, though). Review collected by and hosted on G2.com.

Easy to scan any application to find any security threats Review collected by and hosted on G2.com.

Even after marking false positives, the same issue sometimes still appears as a high or critical security issue. Review collected by and hosted on G2.com.

It identifies all the security vulnerabilities making your code secure than ever before. It also categorises the vulnerability into different categories based on the risk associated. Can be easily integrated with your CI pipeline to have you code scan with every build Review collected by and hosted on G2.com.

We can have a more better and user friendly UI to go through the report. Review collected by and hosted on G2.com.

The best features of Checkmarx are:

1) Open Source vulnerability scanner

2) Integration with multiple Ci/CD orchestration tools

3) Real-time reporting of static code vulnerabilities Review collected by and hosted on G2.com.

I feel the Jenkins code snippet of Checkmarx is a bit complex, and it could be a lot simpler. Review collected by and hosted on G2.com.

CheckMarx has been used as an application to scan the applications to rectify vulnerability in the code and to check the security lapses. I have been using CheckMarx to check the same in my .NET application and have found CheckMarx to be of great use. I would like to mention a few good things about it:

1.) It supports many languages. In my case, it can find the lapses in C#, JavaScript, jQuery, TypeScript.

2.) The description is quite clear about the issues, which makes it easier to understand the problem statement behind the security lapse.

3.) The online community present for CheckMarx is quite good, which makes it easier to find the resolution. Review collected by and hosted on G2.com.

Even though CheckMarx is quite helpful to check the security threats in the application code, there are a few things that can be improved by the CheckMarx team to make it more useful and efficient:

1.) There are many false positives, which increase a lot of issues that in turn are required to be marked as non-exploitable.

2.) The per-user cost of CheckMarx subscription is high, which makes it difficult for small organizations to own it completely. Review collected by and hosted on G2.com.

The report generated by this tool is comprehensive and easy to understand It has good charts Review collected by and hosted on G2.com.

The report some times have false positives and duplication Review collected by and hosted on G2.com.

ease of deployment. Number of supported languages and best place to fix function. Review collected by and hosted on G2.com.

Too much detail in the report for small security shops. Review collected by and hosted on G2.com.

I like the way that the Checkmarx report provides a detailed account of all potential vulnerabilities and then provides examples of how the issue can be fixed. This is very helpful when it comes to trying to resolve all issues. Review collected by and hosted on G2.com.

As with anything automated, some issues that are found are just non-issues. We use several different security gating products like Checkmarx and I would say that it is less often incorrect than the others. Review collected by and hosted on G2.com.

Results are pretty good with CheckMarx. This tool is helpful to build secure source code. CheckMarx scan report gives detailed view of each issue and flowchart is given for the variables which might cause security threat. Code scanning is fast. Review collected by and hosted on G2.com.

Sometimes reports generated by the CheckMarx scan contain lot of false positive issues even though code is designed in a way that ensures security. This decreases the readability of the reports. Review collected by and hosted on G2.com.