Aman, thank you for the feedback. We understand the challenges that can arise when development teams adopt new languages, frameworks, and file types.

Checkmarx has recently expanded its language-agnostic scanning capabilities through a new hybrid scanning engine that combines deterministic analysis with AI-powered detection, enabling broader coverage across modern and emerging technologies, including AI-generated code and polyglot environments. This approach is designed to reduce gaps created by evolving development practices while maintaining high-fidelity results.

We appreciate you highlighting the .mjs support issue, and feedback like this helps us continue improving coverage and compatibility for modern software development workflows. Please reach out to us if you would like to discuss more, and again thank you for the feedback!

Thank you for the thoughtful review, and for choosing Checkmarx after moving from Fortify.

We hear you on false positives. We are excited to let you know that we have made real progress on this this issue for our customers.

Our Next Gen SAST paired with Checkmarx Fusion merges a deterministic detection engine and an AI reasoning engine. We have measured an F1 score of 0.74, with 60–70% fewer false positives than standalone AI scanning.

Our Chief Product Officer Jonathan Rende lays it out in this blog, check it out. We would be happy to connect and show you a demo. Thank you for being a Checkmarx customer!

Poorna, thank you for your thoughtful review and we are glad that you appreciate our ability to alert developers to reviews even before code moves to production. That's our goal: to make security embedded in the whole process so developers don't have to worry about it and can focus on creating.

Regarding your feedback: reducing noise is actually an area where Checkmarx has invested heavily. Recent innovations like Checkmarx Fusion validate findings across multiple detection engines to reduce false positives, while Triage Assist prioritizes vulnerabilities based on real attackability, reachability, and exploitability.

Our customers are seeing results. I am sharing a video of one customer who appreciated our ability to identify false positives and give developers the chance to review before merging. Check it out, and please reach out to us with any other questions. We are happy to set up a demo session.

Thank you for the feedback Nitesh! We understand that differences between scan results from Salesforce Security Portal scans and Checkmarx scans can be challenging when comparing findings across tools. To address this, Checkmarx has recently introduced a new hybrid scanning engine and Finding Analysis Engine designed to improve scan fidelity and consistency by validating findings, reducing noise, and surfacing the vulnerabilities that matter most.

The result is an industry-leading F1 score and a 60% reduction in false positives, helping teams gain greater confidence in their scan results and prioritize remediation more effectively.

We're also glad to hear that Checkmarx is delivering fast scans, actionable vulnerability insights, intuitive workflows, and strong support for your team.

Let us know how we can continue to support your team, reach out any time and again, thank you for your review!

Thanks Naushad for your review. Glad to hear you are identifying vulnerabilities early in the life cycle. Our research has found that the cost to fix one if it is missed through the stages (through IDE, CI/DC, supply chain, and run time) can multiply as much as 10 times in each stage. To your issues with setup and speed, these are two areas we are working on. Our latest Risk Orchestration feature centralizes scanning results in a more user-friendly way, and our just released hybrid NG-SAST security scanning engine achieved an F1 score of 0.64 – more than three times the 0.20 average across competing approaches that Checkmarx evaluated.

Thank you for your review, and I invite you to learn more!

Amshu, sorry you stopped using Checkmarx due to cost, it would be great to explore this further so you can get the maximum benefit of our platform.

Also with regards to usability, one area where Checkmarx has made significant investments is Risk Orchestration within Checkmarx One ASPM, which provides a single, unified view of findings across SAST, SCA, IaC, APIs, containers, secrets, cloud, and third-party tools. By correlating and prioritizing risks based on exploitability, reachability, and business impact, teams spend less time navigating multiple dashboards and manually triaging findings.

This approach reduces alert noise, eliminates redundant triage, and gives developers actionable remediation guidance directly within their existing workflows, helping make application security easier to adopt, faster to manage, and more cost-effective at scale.

Again, thanks for your review, and we would appreciate the chance to find out how we can make our experience a better investment for you. Reach out any time!

Arya, thank you for the thoughtful feedback! We’re glad Checkmarx is helping you find risk earlier across source code, open source, APIs, and other application components. We also understand that false positives and scan time can add friction for developers.

That’s why Checkmarx One is investing heavily in higher-fidelity scanning, not just more findings. Our new hybrid SAST engine combines deterministic analysis, purpose-tuned AI, and a Finding Analysis Engine to confirm true positives and suppress false ones before results reach developers.

In head-to-head testing across seven production codebases, it achieved a 0.64 F1 score, more than 3x the evaluated average, while reducing false positives by 60%. The goal is to help teams cut through noise, prioritize genuinely exploitable risk, and remediate faster without slowing delivery.

We appreciate your review!

Prioritization of findings in the enterprise is definitely something we have improved. I recently talked to two customers who pointed out that our Risk Orchestration in Checkmarx One ASPM can help with this.

RO pulls in findings across areas like SAST, SCA, IaC, API security, secrets, containers, DAST, plus third-party signals, and then creates a unified risk score/view so teams can focus on what matters most. Please reach out and we will demo it for you, checkmarx.com/product/aspm

Thanks for your review! We understand that pricing is an important consideration for growing startups, especially in LATAM, and appreciate your input as you evaluate the platform.

I invite you to consider agentic capabilities like Developer Assist, Triage Assist, and Remediation Assist to reduce manual work, prioritize real risk, and deliver contextual fixes faster. Checkmarx also saves our customers money with a hybrid AI approach that avoids relying only on expensive large LLM calls. That helps reduce token consumption and cost at scale while maintaining high-confidence results. Our goal is to help teams adopt AI coding securely, efficiently, and economically.

We would be happy to talk more, and we thank you for taking the time to tell us what you think.

Tadele, thank you for the feedback! We've made significant investments to address these areas. Our new hybrid scanning engine combines deterministic analysis with AI-powered reasoning to deliver higher-quality results, achieving the industry's highest scanning fidelity while reducing false positives by 60%. This helps developers spend less time validating findings and more time remediating real risks.

To improve usability and reporting, Checkmarx One ASPM now includes Risk Orchestration, which provides a single, unified view of findings across security tools, reduces alert noise, and prioritizes risks based on real exploitability and business impact. This simplifies navigation, streamlines reporting, and enables faster, more efficient triage and remediation workflows.

Together, these innovations are designed to improve scan efficiency, reduce noise, and create a more intuitive experience for both developers and security teams.

We hope you check them out, and we would be happy to discuss more. Thank you for your review!