Checkmarx One review

Checkmarx One is the enterprise platform on this list for organizations that want SAST to be one part of a central application security program. Its SAST engine combines rules-based and LLM-based scanning, which Checkmarx says extends detection to languages and frameworks that deterministic rules do not cover. The Essentials package bundles SAST, SCA, API security and application security posture management, and add-ons cover DAST, containers, IaC, secrets, malicious packages and AI assistants for triage, remediation and developer guidance. Findings show up in IDEs, pull request checks and pipelines with fix guidance. Checkmarx also keeps a SAST-only package for existing on-prem customers. The cost is opacity and effort: every package needs a custom quote, so we could not verify a price, and a platform with this many modules takes longer to roll out and tune than SonarQube Cloud or Semgrep. It ranks lower here on ease of use and value, not on scanning depth.

Who it is for

Large enterprises consolidating SAST, SCA and API security

Price

See vendor pricing (USD check pending).

US price check pending. See the vendor pricing page.

Key features

• SAST that combines rules-based and LLM-based scanning to reach languages beyond deterministic rules
• Essentials package bundles SAST, SCA, API Security and ASPM
• Findings in IDEs, PR checks and pipelines with fix guidance
• Add-ons for DAST, container, IaC, secrets detection and malicious package protection
• Triage Assist, Remediation Assist and Developer Assist AI add-ons

Strengths and weaknesses

• Strength: One platform and one risk view across code, dependencies and APIs
• Strength: Packages scale from Essentials to Professional and Enterprise
• Strength: On-prem SAST package for existing self-hosted customers
• Weakness: Every package is sold through a custom quote
• Weakness: Many capabilities, including secrets and IaC, are add-ons
• Weakness: Rollout and tuning take more effort than self-serve tools

Key facts

• Pricing: Custom quote, Essentials, Professional and Enterprise packages
• Core scanners: SAST, SCA, API Security, ASPM
• Deployment: SaaS platform, plus an on-prem SAST package

Where it ranks

Checkmarx One is No. 8 in our Best Static Code Analysis Tools verdict.