Checkmarx

Enterprise application security testing platform

Checkmarx is an enterprise application security testing platform providing SAST, SCA, DAST, API security, IaC scanning, and container security in a unified solution. Features AI-powered vulnerability detection, automated remediation guidance, and correlation across scan types to prioritize the most critical risks. Supports 30+ programming languages with deep framework-specific rules. Integrates with all major IDEs, Git platforms, and CI/CD pipelines. Used by Fortune 500 companies globally.

Rate

Website

Is this your product? →

About Checkmarx

Checkmarx provides comprehensive enterprise application security with SAST, SCA, DAST, API security, IaC scanning, and container security in one platform. Correlation across scan types identifies the most critical compound risks.

AI-powered detection goes beyond pattern matching to understand code semantics and identify complex vulnerabilities. Automated remediation guidance provides specific fix recommendations with code examples.

30+ language support with deep framework-specific rules for Spring, .NET, React, Angular, and more. Integrations span VS Code, JetBrains, GitHub, GitLab, Azure DevOps, Jenkins, and all major CI/CD platforms.

Enterprise features include policy management, compliance reporting, developer training modules, and API-first architecture for custom workflows. Used by Fortune 500 companies for application security at scale.

Pricing & Platform Specs

Pricing Summary

Enterprise commercial quote-based licensing calculated by the number of Contributing Developers (active committers over 90 days) and chosen security modules (SAST, SCA, DAST, API Security, Container/IaC). Offers customized SaaS and self-hosted deployments with dedicated SLAs and guided enterprise proof-of-concept (PoC) trials.

full pricing breakdown →

Supported Platforms

Cloud, On-premises, IDE, CI/CD

Explore categories, tags & use cases

Use Cases

Security Auditing Code Review

Alternatives

All Checkmarx alternatives →

Shannon

Autonomous AI pentester for web apps and APIs

Shannon is an autonomous white-box AI pentesting tool for web applications and APIs. It analyzes authorized source code, identifies attack vectors, attempts proof-by-exploitation, and produces remediation-ready reports. Shannon Lite is AGPL-3.0 for local use, while Shannon Pro is the commercial Keygraph platform for continuous security testing.

freemiumOpen Source

DeepTeam

Open-source LLM red-teaming framework with 40+ attack types

DeepTeam is an open-source red-teaming framework for systematically testing LLM applications against 40+ adversarial attack types. It covers OWASP Top 10 for LLMs including jailbreaks, prompt injection, PII leakage, and hallucination attacks. Built as the sister project of DeepEval for security testing alongside evaluation. Apache-2.0 licensed.

freemiumOpen Source

MCP-Scan

Security scanner for MCP servers against tool poisoning attacks

MCP-Scan is a security tool that scans MCP servers for vulnerabilities including tool poisoning, prompt injection, cross-origin escalation, and rug pull attacks. Acquired by Snyk in 2026, it is the first dedicated security scanner for the MCP ecosystem. It analyzes tool descriptions, permissions, and behavior patterns to detect malicious or compromised MCP servers before they can exploit AI agents.

Open Source

Discover more tools in this category

Related Tools

computed discovery: shared active categories

OpenLIT

OpenTelemetry-native observability for LLM applications with evals and GPU monitoring

OpenLIT is an open-source AI engineering platform that provides OpenTelemetry-native observability for LLM applications. It combines distributed tracing, evaluation, prompt management, a secrets vault, and GPU telemetry in a single self-hostable stack. With 50+ integrations across LLM providers and frameworks, it lets teams monitor AI applications using their existing observability backends like Grafana, Datadog, or Jaeger.

Open Source

Cilium

eBPF-based networking, security, and observability for Kubernetes

Cilium is a CNCF Graduated, Apache-2.0 project for Kubernetes networking, security, and observability using eBPF. It can replace kube-proxy, enforce identity-aware L3-L7 network policies, and add Hubble flow observability plus Tetragon runtime-security signals. Current source checks support GKE Dataplane V2 using Cilium/eBPF and Azure CNI Powered by Cilium for AKS.

Open Source

Pangolin

Identity-aware VPN and reverse proxy for zero-trust remote access

Identity-based remote access platform built on WireGuard that combines reverse proxy and VPN capabilities. Pangolin supports clientless browser access for web apps and client-based private-resource access across macOS, iOS, Windows, Linux, and Android, with zero-trust rules, peer-to-peer tunnels, automatic SSL, SSO/OIDC options, and cloud or self-hosted deployment.

freemium

Semgrep

Fast open-source SAST with custom rules

Semgrep is an AppSec platform with a widely used open-source engine for readable code rules plus commercial SAST, supply-chain and secrets workflows. Current product positioning emphasizes AI-assisted detection, triage and remediation, CI/pull-request integration and managed governance for security teams.

freemiumOpen Source

SonarQube

Code quality and security analysis platform

SonarQube is an open-source code quality and security platform with 10K+ GitHub stars that inspects code for bugs, vulnerabilities, code smells, and security hotspots. It enforces quality gates in CI/CD pipelines, supports 30+ languages in Team plans and 40+ in Enterprise, and remains the industry standard for static code quality management.

freemiumOpen Source

Aikido Security

Unified code-to-cloud security platform for developers

Aikido Security is an all-in-one AppSec platform unifying SAST, DAST, SCA, CSPM, secrets detection, container scanning, IaC analysis, and runtime protection in a single developer-friendly dashboard. Cuts false positive noise by 95% through reachability analysis that evaluates vulnerabilities in actual deployment context. Features AI AutoFix for one-click remediation, CI/CD gating, and AI-powered pentesting agents. Trusted by 50,000+ organizations. Supports 50+ programming languages.

freemium

Side-by-Side Comparisons

ZeroThreat

Fluid Attacks

Checkmarx

ZeroThreat vs Fluid Attacks vs Checkmarx — DAST & Pentesting Comparison

Dynamic application security testing and penetration testing tools span from affordable AI-powered scanners to enterprise-grade platforms. ZeroThreat offers AI-driven DAST with automated pentesting starting at $25 per scan, claiming 98.9% detection accuracy. Fluid Attacks combines automated scanning with manual ethical hacking for comprehensive vulnerability assessment. Checkmarx is the enterprise AppSec leader covering SAST, DAST, SCA, and API security in a unified platform.

ZeroThreat Fluid AttacksCheckmarx

Community experience

Sources & verification

Checkmarx Official Documentation & Repository

Sources checked: September 5, 2026
Content verified: September 6, 2026

Verification dates are editorial checks. Routine CMS saves and automatic updatedAt timestamps do not advance them.

FAQ

What is Checkmarx?

Is Checkmarx free?

No — Checkmarx is a paid tool. Enterprise commercial quote-based licensing calculated by the number of Contributing Developers (active committers over 90 days) and chosen security modules (SAST, SCA, DAST, API Security, Container/IaC). Offers customized SaaS and self-hosted deployments with dedicated SLAs and guided enterprise proof-of-concept (PoC) trials.

Is Checkmarx still maintained?

Yes — Checkmarx is active. Its listing was last verified on September 6, 2026.

What are the best Checkmarx alternatives?

The first editor-selected Checkmarx alternatives are Shannon, DeepTeam, MCP-Scan.

Checkmarx

About Checkmarx

Pricing & Platform Specs

Pricing Summary

Supported Platforms

Categories

Tags

Use Cases

Alternatives

Shannon

DeepTeam