Checkmarx Reviews

Pros

The best part is how clearly it shows the path a vulnerability takes through the code. Watching untrusted input move into a vulnerable function helps us confirm issues faster, explain the real risk to developers and quickly identify exactly where the fix needs to land. It also handled the initial setup really well, getting started didn't take much effort.

Cons

Even with that, I still have to manually validate certain findings to make sure they're not false positives. Improvements like faster incremental scans, more concrete fix examples customized to specific frameworks and rule tuning that's simpler, with reusable false-positive suppressions, would cut down the time spent reviewing the same type of repeat findings.

Pros

I use this for SAST code reviews and it's been really helpful for catching security issues early in the development lifecycle. By flagging problems at the level of each commit, it reduces the chances of expensive fixes later on. The vulnerability identification stands out especially when it knocks out common OWASP Top 10 risks like SQL injection and Cross-Site Scripting. It also goes beyond typical tech vulnerabilities and can find business logic problems, like missing or weak authorization/access control, earlier than you'd normally expect. It even reports IDOR-style vulnerabilities from the OWASP Top 10 list which is a nice bonus. Setup was simple and I moved over from Fortify mainly because it generates less noise from false positives while still covering the OWASP Top 10 more deeply.

Cons

Every now and then, the false positives can still be frustrating.

Pros

It is a pretty reliable application security platform that focuses on finding vulnerabilities across the entire software development lifecycle, including through its AI-powered capabilities. One standout benefit is that it alerts developers to potential application flaws before anything reaches production. The interface is easy to work with, it responds quickly and it supports integration with multiple repositories as well as CI/CD pipelines. Even though the pricing is a little on the higher side, it still feels like it's justified by the value it brings. Customer support is also decent and gets the job done.

Cons

A common annoyance is the amount of noise it produces, items that are minor or not truly significant can still show up as flagged issues. Scan times also run a bit slower than some competing tools although the tool does deliver the expected results once the scans complete. Pricing continues to feel somewhat steep compared with alternatives.

Pros

Provision to automate scan runs is now available which makes scheduling and repeat testing much simpler. The scan results come back in a well-structured format and the comments are clearly documented so developers can quickly understand what needs fixing. Reporting can also be tied into stakeholder reports and the UI feels solid. Support has been good as well.

Cons

One downside is that scan results shown in the Salesforce security portal don't match what appears in the portal and that mismatch can cause headaches during Salesforce package submission.

Pros

This feels like a centralized security platform that gives clear, end-to-end visibility into source code security issues and vulnerabilities. It doesn't just point out problems, it also ties those risks back to the code so we can prioritize what needs attention and work through remediation faster. On top of that SCA scans show vulnerabilities in the open-source libraries and packages used in our codebase which has been really helpful for risk management. The standout for us is the CI/CD integration. We've been able to plug it directly into our DevSecOps pipeline and developers can review scan insights straight in the pipeline output. That means they don't have to switch contexts or log into the UI separately just to understand what the scan found.

Cons

It still needs to better match how modern software teams evolve their projects especially around full support for scanning all relevant file extensions. During our migration from Node.js to TypeScript, we moved our JavaScript files over to the .mjs extension but this still won't scan .mjs files. We reported this roughly a year ago and it's still not supported. Their recommended workaround is to rename .mjs files back to .js when uploading for scans but that's not workable for our setup since it would force us into unnecessary file changes just to get accurate results.

Pros

Using Checkmarx in our application security workflow has been a really positive experience. The biggest win is that it flags security vulnerabilities early in the development lifecycle which gives our teams a chance to fix issues before they ever make it to production. Once you spend a little time getting used to the interface, it feels pretty user-friendly and the scan reports include enough context for both developers and the security team to pinpoint the root cause and follow clear remediation guidance.

Cons

There's definitely a learning curve with the initial setup and policy configuration particularly if a team is new to application security testing. Also, when we run full scans on larger or more complex projects, they can take quite a while and sometimes slow down our development pipelines.

Pros

For our team, the biggest win is how many integrations this tool offers. The price can be a bit steep for a startup like ours in LatAm but the integration coverage has been worth it. Support has also been solid whenever we've needed help and the UI/UX feels well designed, performance and usability are both on point.

Cons

During the pilot it worked correctly so the tool itself isn't the problem. We're mainly still assessing the pricing since our location/geography affects how feasible it is for us.

Pros

One of the strongest parts of it is how it plugs security right into the software development life cycle. Instead of treating security as a separate step at the end, it helps keep security checks woven into the way teams build and ship code.

Cons

On the flip side, when you go for more thorough security analysis, it can end up taking longer and extending scan times at times.

Pros

It pushes security thinking earlier in the development lifecycle, instead of waiting until problems show up later, when they're usually harder and more expensive to fix. It also makes the day-to-day conversations between the security and engineering teams a lot more productive and efficient since everyone is working from the same type of findings.

Cons

What could be better is the effort required sometimes to review and prioritize findings particularly when you're dealing with bigger codebases. Even though the data is valuable, it can take additional time to figure out which issues deserve attention first.

Pros

This is delivering what we needed for application security, it covers the full scope of appsec scanning, keeps vulnerability detection reliable and then helps us focus through risk-based prioritization. What really stands out is that findings come with actionable, clear remediation guidance so teams know what to fix without hunting through documentation.

Cons

The main thing to watch is that scans can produce a decent number of false positives. That means more time spent validating results and doing triage especially when teams are juggling multiple projects. Also, on bigger codebases, scan runtimes can stretch longer than expected so planning the scan windows matters.

Pros

Having CI/CD pipeline support is a big plus because the moment a build starts, static code analysis and open-source library scanning happen right during build time.

Cons

My only complaint is that a few languages we use still aren't supported, such as ColdFusion and R-Code.