Checkmarx

Pros

The best part is how clearly it shows the path a vulnerability takes through the code. Watching untrusted input move into a vulnerable function helps us confirm issues faster, explain the real risk to developers and quickly identify exactly where the fix needs to land. It also handled the initial setup really well, getting started didn't take much effort.

Cons

Even with that, I still have to manually validate certain findings to make sure they're not false positives. Improvements like faster incremental scans, more concrete fix examples customized to specific frameworks and rule tuning that's simpler, with reusable false-positive suppressions, would cut down the time spent reviewing the same type of repeat findings.

Pros

I use this for SAST code reviews and it's been really helpful for catching security issues early in the development lifecycle. By flagging problems at the level of each commit, it reduces the chances of expensive fixes later on. The vulnerability identification stands out especially when it knocks out common OWASP Top 10 risks like SQL injection and Cross-Site Scripting. It also goes beyond typical tech vulnerabilities and can find business logic problems, like missing or weak authorization/access control, earlier than you'd normally expect. It even reports IDOR-style vulnerabilities from the OWASP Top 10 list which is a nice bonus. Setup was simple and I moved over from Fortify mainly because it generates less noise from false positives while still covering the OWASP Top 10 more deeply.

Cons

Every now and then, the false positives can still be frustrating.

Pros

It is a pretty reliable application security platform that focuses on finding vulnerabilities across the entire software development lifecycle, including through its AI-powered capabilities. One standout benefit is that it alerts developers to potential application flaws before anything reaches production. The interface is easy to work with, it responds quickly and it supports integration with multiple repositories as well as CI/CD pipelines. Even though the pricing is a little on the higher side, it still feels like it's justified by the value it brings. Customer support is also decent and gets the job done.

Cons

A common annoyance is the amount of noise it produces, items that are minor or not truly significant can still show up as flagged issues. Scan times also run a bit slower than some competing tools although the tool does deliver the expected results once the scans complete. Pricing continues to feel somewhat steep compared with alternatives.