Checkmarx One

VS Code, JetBrains, Visual Studio, Eclipse plugins; free KICS and SCA realtime scanners; ASCA as-you-type checks.

Checkmarx Developer Assist is an agentic MCP-server-based assistant giving realtime prevention and remediation in the IDE.

Checkmarx One CLI ('cx') plus VS Code extension pre-commit scans; SCA Resolver runs resolution on-prem.

Decorates PRs/MRs with a summary comment of new and fixed vulnerabilities and policy violations.

Policies can 'Break the Build' on violation; Protected Branches patterns govern which branches trigger scans and gates.

Repository or zip scans up to 22M LOC; SAST and API Security also support incremental delta scans.

Scans fire on push and pull/merge-request webhooks, plus Risk Recalculation; no scheduled or cron rescan documented.

Cloud Insights correlates deployed images with source via third-party CNAPPs (Wiz, AWS, Sysdig), feeding runtime exposure into risk scores.

Graph-based SAST needing no compilation; hundreds of queries per language, Best Fix Location, visual Attack Vector.

Attack Vector shows source-to-sink tainted data flow; Best Fix Location is chosen within that data-flow graph.

Open-source 2ms engine scans working tree plus optional git commit history; also Slack, Discord, Confluence, Paligo.

Live Secrets Validation automatically determines if discovered secrets are still valid and exploitable; uses high-entropy analysis, contextual flagging, and structural pattern recognition. No provider-level verification; customers must rotate via issuing services.

File analysis, package-manager or lock-file resolution, and evidence analysis against Checkmarx vulnerability databases.

Exploitable Path reuses SAST to trace the call path to the vulnerable method; Python, Java, JavaScript, C# only.

Suspected Malware taxonomy: typosquatting, StarJacking, ChainJacking, repojacking, account takeover, data exfiltration, crypto mining.

Effective License designation, Full/Partial/No copyleft classification, license severity, and source-path evidence.

CycloneDX (v1.3–v1.7 depending on surface) and SPDX v2.3, XML or JSON; can also scan an existing SBOM.

KICS engine across Ansible, CloudFormation, Dockerfile, Kubernetes, Terraform, Docker Compose, Crossplane, Pulumi, NifCloud.

Dedicated Container Security scanner for Dockerfiles and named images, plus private registry auth for DockerHub, ECR, GCR, GAR.

Cloud posture and runtime data come from third-party CNAPPs (Wiz, AWS, Sysdig) via Cloud Insights, not a native CSPM engine.

DAST is a platform engine and links to API Security, but requires separate DAST and API Security licenses.

Custom SAST queries can target QA and business-logic purposes; no dedicated maintainability or code-smell engine.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Enabling Exploitable Path surfaces genuinely unused dependencies; dead source-code detection not documented.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not documented anywhere in the module catalog, docs, or release notes; no module-boundary governance capability exists.

Not offered in vendor documentation reviewed as of 2026-09-05.

Analytics tracks vulnerability trends, remediation status, and metrics by team, project, and environment; no code-behavioural analytics.

SAST queries cover business-logic flaws; AI is used for triage and remediation, not for logic-bug discovery.

PR comment summarises new and fixed vulnerabilities and policy violations; no change-by-change walkthrough.

SAST Query Editor/Auditor writes and edits queries with an AI Query Builder GPT; custom presets for SAST and IaC.

AI Security Champion gives confidence score, explanation, and proposed remediation; KICS and IDE auto-remediation.

SCA Auto Pull Request opens a manifest version-bump PR (default Off); transitive remediation is beta, npm only.

Per-project 'AI Triage & Remediation' auto-analyses eligible new vulnerabilities during PR scans; triage predicates persist across scans.

Not offered in vendor documentation reviewed as of 2026-09-05.

AI Security Champion explains and fixes scanner findings; AI Triage analyses new pull-request vulnerabilities.

Azure AI selectable at tenant level and Developer Assist switchable between GitHub Copilot and Claude; no customer-key BYOK.

Checkmarx Developer Assist is delivered as an agentic MCP server for IDE-based AI assistants.

No AI-generated-code governance; AI Supply Chain Inventory covers AI components and dependencies instead.

AI Security Champion is chat-based inside scan-result panels; Assistant SAST/Query Builder GPT is a chat query editor.

Triage state and comments persist across scans on recurring instances; no documented model learning from feedback.

Trust Center's AI Governance section describes a Responsible AI Framework with no explicit training-data exclusion commitment.

Audit Trail API/UI logs user management, SAST triage, and reporting events; 365-day default retention.

IAM console supports platform-level SAML v2.0 (Okta, Azure AD, generic), OpenID Connect, and LDAP login.

Predefined roles (Admin, Access Control Manager, User Manager, SCA Manager, SCA Scanner, SCA Viewer, External Platform User), custom roles, Teams, project scoping.

Scan summaries (HTML, JSON, console, Markdown), full reports (JSON, SARIF, SonarQube), PDF with email delivery, SBOMs, CSV exports.