Checkmarx One
Application Security Posture Management platform bundling SAST, SCA, IaC, container, API, secret, and DAST scanners under one risk model.
Deployment
Cloud · Self-Hosted (partial)
Languages
29+
Pricing model
Quote-based
Free plan
Partial
Partial means the documentation covers only part of a capability, a related capability, or a beta. The description next to it says what is covered.
Workflow coverage
Where in the development lifecycle Checkmarx One operates.
6 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| Real-Time IDE Feedback | Yes | VS Code, JetBrains, Visual Studio, Eclipse plugins; free KICS and SCA realtime scanners; ASCA as-you-type checks. |
| AI Agent Guardrails | Yes | Checkmarx Developer Assist is an agentic MCP-server-based assistant giving realtime prevention and remediation in the IDE. |
| Local Analysis (Pre-Commit) | Yes | Checkmarx One CLI ('cx') plus VS Code extension pre-commit scans; SCA Resolver runs resolution on-prem. |
| Inline PR Comments | Yes | Decorates PRs/MRs with a summary comment of new and fixed vulnerabilities and policy violations. |
| Quality Gates (Merge Blocking) | Yes | Policies can 'Break the Build' on violation; Protected Branches patterns govern which branches trigger scans and gates. |
| Full Repo Scan | Yes | Repository or zip scans up to 22M LOC; SAST and API Security also support incremental delta scans. |
| Scheduled Rescans | Partial | Scans fire on push and pull/merge-request webhooks, plus Risk Recalculation; no scheduled or cron rescan documented. |
| Runtime Monitoring | No | Cloud Insights correlates deployed images with source via third-party CNAPPs (Wiz, AWS, Sysdig), feeding runtime exposure into risk scores. |
Security scanning
11 yes 1 partial 1 no
| Feature | Availability | Description |
|---|---|---|
| SAST | Yes | Graph-based SAST needing no compilation; hundreds of queries per language, Best Fix Location, visual Attack Vector. |
| Taint Analysis (Data-Flow) | Yes | Attack Vector shows source-to-sink tainted data flow; Best Fix Location is chosen within that data-flow graph. |
| Secrets Detection | Yes | Open-source 2ms engine scans working tree plus optional git commit history; also Slack, Discord, Confluence, Paligo. |
| Secrets Validation | Partial | Live Secrets Validation automatically determines if discovered secrets are still valid and exploitable; uses high-entropy analysis, contextual flagging, and structural pattern recognition. No provider-level verification; customers must rotate via issuing services. |
| SCA | Yes | File analysis, package-manager or lock-file resolution, and evidence analysis against Checkmarx vulnerability databases. |
| Reachability Analysis | Yes | Exploitable Path reuses SAST to trace the call path to the vulnerable method; Python, Java, JavaScript, C# only. |
| Malicious Package Detection | Yes | Suspected Malware taxonomy: typosquatting, StarJacking, ChainJacking, repojacking, account takeover, data exfiltration, crypto mining. |
| License Compliance | Yes | Effective License designation, Full/Partial/No copyleft classification, license severity, and source-path evidence. |
| SBOM Generation | Yes | CycloneDX (v1.3–v1.7 depending on surface) and SPDX v2.3, XML or JSON; can also scan an existing SBOM. |
| IaC Scanning | Yes | KICS engine across Ansible, CloudFormation, Dockerfile, Kubernetes, Terraform, Docker Compose, Crossplane, Pulumi, NifCloud. |
| Container Scanning | Yes | Dedicated Container Security scanner for Dockerfiles and named images, plus private registry auth for DockerHub, ECR, GCR, GAR. |
| CSPM | No | Cloud posture and runtime data come from third-party CNAPPs (Wiz, AWS, Sysdig) via Cloud Insights, not a native CSPM engine. |
| DAST | Yes | DAST is a platform engine and links to API Security, but requires separate DAST and API Security licenses. |
Code quality
3 partial 6 no
| Feature | Availability | Description |
|---|---|---|
| Code Smell Detection | Partial | Custom SAST queries can target QA and business-logic purposes; no dedicated maintainability or code-smell engine. |
| Complexity Metrics | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Duplication Detection | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Dead Code Detection | Partial | Enabling Exploitable Path surfaces genuinely unused dependencies; dead source-code detection not documented. |
| Test Coverage Tracking | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Diff Coverage (New Code) | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Architecture Governance | No | Not documented anywhere in the module catalog, docs, or release notes; no module-boundary governance capability exists. |
| Technical Debt Quantification | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
| Behavioral Code Analysis | Partial | Analytics tracks vulnerability trends, remediation status, and metrics by team, project, and environment; no code-behavioral analytics. |
AI review & fixes
3 yes 2 partial
| Feature | Availability | Description |
|---|---|---|
| AI Logic Bug Detection | Partial | SAST queries cover business-logic flaws; AI is used for triage and remediation, not for logic-bug discovery. |
| PR Summaries & Walkthroughs | Partial | PR comment summarizes new and fixed vulnerabilities and policy violations; no change-by-change walkthrough. |
| Autofix Suggestions | Yes | AI Security Champion gives confidence score, explanation, and proposed remediation; KICS and IDE auto-remediation. |
| Autofix Pull Requests | Yes | SCA Auto Pull Request opens a manifest version-bump PR (default Off); transitive remediation is beta, npm only. |
| AI Triage (False-Positive Filtering) | Yes | Per-project 'AI Triage & Remediation' auto-analyzes eligible new vulnerabilities during PR scans; triage predicates persist across scans. |
Rules & repo support
1 yes 1 no
| Feature | Availability | Description |
|---|---|---|
| Custom Rule Authoring | Yes | SAST Query Editor/Auditor writes and edits queries with an AI Query Builder GPT; custom presets for SAST and IaC. |
| Monorepo Support | No | Not offered in vendor documentation reviewed as of 2026-09-05. |
AI capabilities
3 yes 2 partial 2 no
| Feature | Availability | Description |
|---|---|---|
| AI Code Review | Yes | AI Security Champion explains and fixes scanner findings; AI Triage analyzes new pull-request vulnerabilities. |
| Bring Your Own Model | Partial | Azure AI selectable at tenant level and Developer Assist switchable between GitHub Copilot and Claude; no customer-key BYOK. |
| MCP Server | Yes | Checkmarx Developer Assist is delivered as an agentic MCP server for IDE-based AI assistants. |
| AI Code Governance | No | No AI-generated-code governance; AI Supply Chain Inventory covers AI components and dependencies instead. |
| Conversational Review | Yes | AI Security Champion is chat-based inside scan-result panels; Assistant SAST/Query Builder GPT is a chat query editor. |
| Learning From Feedback | Partial | Triage state and comments persist across scans on recurring instances; no documented model learning from feedback. |
| Code Excluded From Training | No | Trust Center's AI Governance section describes a Responsible AI Framework with no explicit training-data exclusion commitment. |
Models used
OpenAI (default for AI Security Champion)Azure AI (account/tenant-level alternative for AI Security Champion)GitHub Copilot (default for Checkmarx Developer Assist)Claude (alternative for Checkmarx Developer Assist)
Compliance & governance
4 yes
| Feature | Availability | Description |
|---|---|---|
| Audit Logs | Yes | Audit Trail API/UI logs user management, SAST triage, and reporting events; 365-day default retention. |
| SSO (SAML) | Yes | IAM console supports platform-level SAML v2.0 (Okta, Azure AD, generic), OpenID Connect, and LDAP login. |
| Role-Based Access Control | Yes | Predefined roles (Admin, Access Control Manager, User Manager, SCA Manager, SCA Scanner, SCA Viewer, External Platform User), custom roles, Teams, project scoping. |
| Compliance Reporting & Exports | Yes | Scan summaries (HTML, JSON, console, Markdown), full reports (JSON, SARIF, SonarQube), PDF with email delivery, SBOMs, CSV exports. |
Certifications
ISO/IEC 27001:2022SOC 2 Type IINIST SSDF
Standards mapping
OWASP Top 10 (2013)OWASP Top 10 (2017)OWASP API Top 10PCI DSS v3.2FISMA 2014NIST SP 800-53HIPAACWECVSSUS Executive Order 14028 (cited for SBOM transparency)
Integrations
9 yes 1 partial
| Git provider | Availability |
|---|---|
| GitHub | Yes |
| GitHub Enterprise Server | Yes |
| GitLab | Yes |
| GitLab Self-Managed | Yes |
| Bitbucket | Yes |
| Bitbucket Data Center | Yes |
| Azure DevOps | Yes |
| API & CLI | Availability |
|---|---|
| REST API | Yes |
| CLI | Yes |
| Webhooks | Partial |
CI/CD systems
JenkinsGitHub ActionsGitLab CI/CD (v1 and v2 pipeline templates)BambooTeamCityAzure DevOpsMavenAny other CI/CD via the Checkmarx One CLI Tool (cx)
IDEs
Visual Studio CodeJetBrains (IntelliJ)Visual StudioEclipseCursor (VS Code extension validated)Windsurf (VS Code extension validated)Kiro (VS Code extension validated)
Issue trackers
JiraGitHub IssuesAzure BoardsServiceNow
Chat & notifications
SlackMicrosoft TeamsEmail
Languages
Languages and frameworks named in Checkmarx One's documentation.
JavaC#VB.NETASPVB6CC++PHPApexRubyJavaScriptTypeScriptVBScriptPerlKotlinObjective-CSwiftHTML5PL/SQLSQLPythonGroovyScalaGoCobolRPGDartLuaRust
Pricing & plans
Trial: No trial for the core AppSec platform (quote-only). Self-serve free trial for Developer Assist (IDE assistant) via dev.checkmarx.com; AI Triage & Remediation offers a sales-assisted free trial via a Checkmarx sales rep.
Checkmarx One (modular bundle)Not published — custom quote via online bundle builderNo tier or company-size positioning documented — packaging is by module selection, not named tiers
- Checkmarx One platform (unified dashboard, data model, API) always included as the foundation
- SAST is core/included; Secrets Detection, IaC Security, API Security, SCA, Malicious Package Protection, MPI API, Container Scanning, AI Supply Chain Security, and DAST are separately selected add-on modules
- No named tiers (Essential/Professional/Enterprise no longer appear on the live pricing page as of 19 Aug 2026)
- No published per-module or per-seat price; quote generated after module selection
- No minimum seat count documented
Legacy CxSAST / CxSCA / CxOSA (self-hosted product line)Contact for pricingOrganizations requiring fully self-hosted or on-premises deployment
- Centralized, Distributed, and High Availability architectures
- Dynamic on-demand Engine allocation via Kubernetes or Docker
- Checkmarx describes it as a legacy product line alongside the Checkmarx One platform
- No pricing, sizing requirements, or feature parity statement versus Checkmarx One documented
Who it's for
Best for enterprises and regulated organizations that want many scan types from one vendor, in one risk view.
A good fit if
- You want SAST, SCA, IaC, container, API, secrets and DAST scanning from a single vendor
- You need supply-chain policies that cover typosquatting, account takeover and similar attacks
- You want to block builds on policy conditions such as EPSS score, malware or license
Consider alternatives if
- You want published, self-serve pricing
- You need reachability analysis for languages beyond Python, Java, JavaScript and C#
Similar tools
Other Code Security Platform tools in the directory.
AikidoApplication security platform spanning code, cloud, container and runtime scanning with AI triage, autofix and automated pentesting.CorgeaAI-native AppSec platform (BLAST SAST) that finds business-logic vulnerabilities across code, dependencies, containers and IaC, and ships AI-generated pull-request fixes.GitHub Advanced SecurityGitHub-native AppSec sold as two add-on SKUs — Secret Protection and Code Security — with CodeQL SAST, Dependabot SCA, secret scanning.SemgrepOpen-source pattern-matching SAST engine plus a commercial AppSec Platform adding SCA, secrets detection, policy governance and AI triage.SnykDeveloper security platform covering SAST, SCA, container, IaC, secrets and DAST scanning with risk scoring and automated fix PRs.VeracodeEnterprise AppSec platform spanning SAST, SCA, DAST, container/IaC scanning, AI auto-remediation, ASPM risk management, and developer training.
FAQ
When should you choose Checkmarx One?
Checkmarx One is best for enterprises and regulated organizations that want many scan types from one vendor, in one risk view. It's a good fit if:
- You want SAST, SCA, IaC, container, API, secrets and DAST scanning from a single vendor
- You need supply-chain policies that cover typosquatting, account takeover and similar attacks
- You want to block builds on policy conditions such as EPSS score, malware or license
Consider alternatives if:
- You want published, self-serve pricing
- You need reachability analysis for languages beyond Python, Java, JavaScript and C#
What languages does Checkmarx One support?
Checkmarx One supports 29+ languages and frameworks, including Java, C#, VB.NET, ASP, VB6, C, C++, PHP, Apex, Ruby, and 19 more.
What does Checkmarx One integrate with?
Checkmarx One integrates with:
- Source control: GitHub, GitHub Enterprise Server, GitLab, GitLab Self-Managed, Bitbucket, Bitbucket Data Center and Azure DevOps
- CI systems: Jenkins, GitHub Actions, GitLab CI/CD, Bamboo, TeamCity and 2 more, plus others through its CLI or API
- IDEs: VS Code, JetBrains, Visual Studio, Eclipse, Cursor and 2 more
What tools are similar to Checkmarx One?
Other code security platforms tracked here:
What are Checkmarx One's plans and pricing?
Checkmarx One is priced by quote, with no published price list.
Opens checkmarx.com in a new tab. Review Radar is not affiliated with Checkmarx.