G2

Roushan J.

Application Security Consultant

Enterprise (> 1000 emp.)

9/1/2026

"Effective SAST with Minimal false Positives"

4/5

What do you like best about Checkmarx?

I use Checkmarx for SAST code review, and it helps me identify security vulnerabilities early in the software development lifecycle, saving a lot of money by catching them in the code for each commit. I really like how it identifies security vulnerabilities, especially getting rid of common OWASP top 10 vulnerabilities like SQL injection and Cross-Site Scripting. I'm impressed that it can also detect business logic vulnerabilities, such as unauthorized access control, earlier in the development process. I also appreciate that it reports IDOR vulnerabilities from the OWASP top 10. The initial setup was easy, and I switched to Checkmarx from Fortify mainly because it provides less noise from false positives and offers deeper coverage of the OWASP top 10. Review collected by and hosted on G2.com.

What do you dislike about Checkmarx?

Some of false positive seems painful sometimes Review collected by and hosted on G2.com.

What problems is Checkmarx solving and how is that benefiting you?

I use Checkmarx to identify security vulnerabilities early in the development process, saving money by catching issues with every commit. It helps eliminate OWASP top 10 vulnerabilities, like SQL injection, Cross-Site Scripting, and unauthorized access control, even catching IDOR vulnerabilities. Review collected by and hosted on G2.com.