G2

Roushan J.

Application Security Consultant

Enterprise (> 1000 emp.)

9/1/2026

"Effective SAST with Minimal false Positives"

4/5

What do you like best about Checkmarx?

I use Checkmarx for SAST code review, and it helps me identify security vulnerabilities early in the software development lifecycle, saving a lot of money by catching them in the code for each commit. I really like how it identifies security vulnerabilities, especially getting rid of common OWASP top 10 vulnerabilities like SQL injection and Cross-Site Scripting. I'm impressed that it can also detect business logic vulnerabilities, such as unauthorized access control, earlier in the development process. I also appreciate that it reports IDOR vulnerabilities from the OWASP top 10. The initial setup was easy, and I switched to Checkmarx from Fortify mainly because it provides less noise from false positives and offers deeper coverage of the OWASP top 10. Review collected by and hosted on G2.com.

What do you dislike about Checkmarx?

Some of false positive seems painful sometimes Review collected by and hosted on G2.com.

What problems is Checkmarx solving and how is that benefiting you?

I use Checkmarx to identify security vulnerabilities early in the development process, saving money by catching issues with every commit. It helps eliminate OWASP top 10 vulnerabilities, like SQL injection, Cross-Site Scripting, and unauthorized access control, even catching IDOR vulnerabilities. Review collected by and hosted on G2.com.

Response from Shane McLaughlin of Checkmarx

edit

Thank you for the thoughtful review, and for choosing Checkmarx after moving from Fortify.

We hear you on false positives. We are excited to let you know that we have made real progress on this this issue for our customers.

Our Next Gen SAST paired with Checkmarx Fusion merges a deterministic detection engine and an AI reasoning engine. We have measured an F1 score of 0.74, with 60–70% fewer false positives than standalone AI scanning.

Our Chief Product Officer Jonathan Rende lays it out in this blog, check it out. We would be happy to connect and show you a demo. Thank you for being a Checkmarx customer!

See how Checkmarx improved