Checkmarx is the world's leading application security testing platform, providing SAST, SCA, DAST and AI-enhanced security code detection and remediation recommendations.

Checkmarx: Enterprise-level application security testing platform in the AI era

Checkmarx is a long-time leader in the global application security testing (AST) market, built on the high detection rates and multi-language coverage of its SAST engine. In 2025-2026, by acquiring the AI ​​security agency Tromzo, launching AI Agents such as Developer Assist/Triage Assist, and releasing MCP Server and AI-BOM, Checkmarx is transforming from a traditional SAST tool to an Agentic application security platform covering "code → supply chain → AI components → runtime". The following is an in-depth breakdown of its capabilities, cost structure, technical roadmap and implementation boundaries.

Checkmarx’s core parameters and statistics

Projects	Data
Product Positioning	Agentic Application Security Testing (AST) Platform
Core Competencies	NG SAST, SCA, Secrets Detection, IaC Security, API Security, DAST, Malicious Package Protection
AI capabilities	Developer Assist (IDE real-time security assistant), Triage Assist (AI prioritization), Remediation Assist (automatically generate repair code), MCP Server, AI-BOM
Covered languages	20+ programming languages and frameworks
Scan scale	800 billion lines of code analyzed monthly
Enterprise coverage	1,800+ enterprise customers, including 40%+ Fortune 500
Detection accuracy	F1 score 2.5 times higher than average SAST tool, 60% fewer false positives
Compliance Certification	SOC 2 Type II, ISO 27001, FedRAMP Moderate
Place of affiliation	Atlanta, USA (the core of R&D is in Israel)
Established	2006
Latest version	2025.2 (AI-Augmented SAST)

The core barrier of Checkmarx is the integration of deterministic rule engine and AI reasoning engine in a hybrid architecture. The deterministic engine ensures a baseline detection rate of known vulnerability types (100+ categories such as SQL injection, XSS, command injection, etc.); the AI ​​engine covers new attack modes, reduces false positives, and automatically generates repair codes. Officials say this combination pushes its F1 score to an industry-high 2.5x that of the average SAST tool.

Checkmarx’s users and market recognition

Market Position: Checkmarx has been named a 2026 Magic Quadrant Leader for Software Supply Chain Security by Gartner and a Forrester Wave Leader. Ranked in the first echelon of application security testing for many years in a row.

Enterprise-level customers: The product page shows 1,800+ enterprise customers, covering more than 40% of the Fortune 500, including finance, medical, technology, government and other strong compliance industries. Typical customers include the world's top banks, insurance companies and cloud vendors.

Scanning scale: Officially disclosed that more than 800 billion lines of code are analyzed every month. This volume ranks among the top in the SAST market, indicating that its engine has been verified in ultra-large-scale continuous production environments.

Industry Recognition: FedRAMP Moderate certification qualifies it for admission to U.S. federal government programs, which is rare among application security testing tools. SOC 2 Type II and ISO 27001 further reduce compliance review friction for enterprise procurement.

Analyst Status: Gartner ranks Checkmarx as a representative vendor in the application security testing market in 2025, with continued high scores in the SAST execution capability dimension.

Checkmarx’s cost advantage: looking at input-output from a three-layer perspective

C-side/Individual developer layer

Checkmarx does not offer a free or community version directly to individual developers. Developers can use Developer Assist (IDE plug-in), trigger scans in CI/CD, and more with an enterprise subscription. The only path to personal evaluation is to apply for a trial or participate in an official PoC project.

• Explicit Cost: No independent individual pricing, must rely on enterprise license.
• Cost of alternatives: For personal learning or open source projects, you can consider Semgrep (community edition free), SonarQube (community edition free), CodeQL (GitHub free tier), but the coverage and detection depth are different from Checkmarx.
• Deduction conclusion: The threshold for individual developers to use Checkmarx is relatively high. It is recommended to first use open source alternatives to become familiar with SAST concepts, and then evaluate Checkmarx in an enterprise environment.

API/Developer Integration Layer

Checkmarx provides three integration methods: Checkmarx One API, CLI, and MCP Server for enterprises to invoke scanning capabilities in their internal tool chains. The pricing page clearly adopts the "modular bundling" model - SAST is the core required module, and the rest (Secrets Detection, IaC Security, SCA, DAST, etc.) are optional additional modules.

• Billing Dimension: Comprehensive pricing based on developer seats + number of applications + usage, non-pure API call billing. Therefore, it is not suitable for the pay-by-volume scenario of pure API calls.
• Public starting price: There is no public price on the product page, and you need to obtain a customized quote through Package Builder.
• Alternative cost benchmark: The annual fee of similar SAST tools (Fortify, Veracode) is generally in the range of US$50,000-300,000; due to Checkmarx's modular design, the starting threshold can be lower than the annual full-stack solution, but after full-featured enterprise deployment, it is usually US$100,000-500,000 per year.
• Hidden costs: Scan time - A full scan of NG SAST may take 30-90 minutes in a large single warehouse, occupying the CI pipeline time window; additional incremental scan strategies need to be configured for compression.

Enterprise/Private Deployment Layer

Checkmarx supports both SaaS (Checkmarx One Cloud) and private deployment models, the latter requiring additional infrastructure resource allocation.

• Explicit costs: License subscription fee (per seat + module) + possible implementation and migration service fees. Official channels show exclusive CSM and technical support.
• Hidden costs: Private deployment requires the enterprise to build or provide Kubernetes clusters and storage resources; the SaaS model has no such cost, but data residency compliance needs to be confirmed in advance.
• Procurement Suggestion: It is recommended to start with the SAST + SCA core module, use 1-2 real projects to do PoC, verify the scanning time, false positive rate, and the adoptability rate of the AI ​​repair code, and then decide whether to expand to additional modules such as Secrets Detection and DAST.

Main functions of Checkmarx

New Generation SAST (NG SAST)

• Core capabilities: Scan the source code without running the code and detect 100+ types of vulnerabilities. NG SAST introduces AI-enhanced vulnerability coverage and automatic classifiers, adding an AI reasoning layer based on the traditional rules engine.
• Acceptance focus: When testing the project, you need to pay attention to (1) the time taken for the first full scan; (2) the response speed of the incremental scan; (3) the false positive rate of the AI ​​classifier on the target technology stack.

Developer Assist (AI Security Assistant)

• Core capabilities: Agentic security assistant running in IDEs such as VS Code, JetBrains, Cursor, Windsurf, etc. Detect vulnerabilities in the code you are writing (including AI-generated code) in real time and apply proven fixes with one click.
• Hidden linkage: Developer Assist is not just a scanner, it also calls SAST / SCA / Malicious Packages / IaC / Secrets five engines to complete cross-engine aggregation within the IDE. This means developers can get a panoramic view of code security, dependency risks, and key leaks without having to switch between different tools.

Triage Assist and Remediation Assist

• Triage Assist: Utilizes AI-driven Attackability analysis (combining reachability, exploitability, policy context) to prioritize scan results, marking which vulnerabilities really need immediate attention and which can be downgraded or ignored.
• Remediation Assist: Automatically generate merge-ready repair code and embed it directly into the Pull Request. Developers only need to review rather than write the repair from scratch.
• Hidden linkage: The two Agents form a "Sort → Repair" connection - the output of Triage Assist is directly used as the input of Remediation Assist, avoiding the intermediate problem of the security team manually analyzing and then allocating repair tasks.

Checkmarx MCP Server

• Core Capability: Through the MCP (Model Context Protocol) protocol, AI programming assistants (such as Claude, Cursor) are allowed to query Checkmarx One's scan results, vulnerability details and repair suggestions in a safe and controlled manner.
• Engineering significance: After the AI ​​coding assistant generates code, it can directly call the MCP Server to obtain the security check results and make iterative repairs without manual switching of tools. This is Checkmarx’s key layout under the Agentic development trend.

AI-BOM (AI Bill of Materials)

• Core Capabilities: Automatically generate a complete list of large model AI Agents, MCP servers, and fine-tuning data sets used in the project, mapping to NIST AI RMF, EU AI Act, and ISO 42001 compliance requirements.
• Applicable scenarios: When enterprises face AI compliance audits (NIS2, DORA, CRA), AI-BOM can provide auditable visibility of AI assets and solve the compliance blind spot of "not knowing what the AI ​​components are used for".

SCA and Malicious Package Protection

• SCA: Scan open source dependencies, identify known CVE vulnerabilities and license risks, and combine reachability analysis to determine whether the vulnerability is actually called.
• Malicious Package Protection: Based on the malicious package database of the Checkmarx Zero research team, it detects supply chain attacks such as typo-squatting, dependency confusion, and malicious implantation.
• Acceptance Concerns: SCA's database update frequency directly determines the response speed to newly discovered CVEs. It needs to be confirmed whether it covers the private package warehouse used within the enterprise.

Secrets Detection / IaC Security / API Security / DAST

• Secrets Detection: Recognizes 170+ key patterns and supports real-time key validity verification.
• IaC Security: Scans 18+ IaC platforms for configuration errors such as Terraform, CloudFormation, Kubernetes, Helm, and more.
• API Security: Automatically discover and test API attack surfaces, and correlate analysis with SAST+DAST results.
• DAST: Black box security testing for running applications. The 2025 version specifically optimizes the dynamic testing capabilities of AI-generated applications.

Checkmarx model and version evolution

Mainline release

Checkmarx's version iteration is on a quarterly/semi-annual basis, and the following are the main traceable milestones:

• 2024.1 (~2024-01) - Checkmarx One v2024: Unified platform release, integrating SAST/SCA/DAST into a single console, unifying data model and API.
• 2024.3 (~2024-09) - AI Enhanced Preview: Introducing AI false positive filtering and repair suggestion preview capabilities, and begins embedding AI classification in SAST results.
• 2025.1 (~2025-01) - AI-Augmented SAST Beta: AI fix recommendations moved from preview to GA, supporting automatic generation of safe code snippets.
• 2025.2 (~2025-04)—— AI-Augmented SAST GA: Official latest version. AI-enhanced bug fix recommendations are generally available, with industry-leading F1 scores.
• 2025.12 (2025-12) - Acquisition of Tromzo: Acquisition of AI-native security agency Tromzo, whose cognitive inference engine will be deeply integrated into Checkmarx One.
• 2026.1 (~2026-03) - Agentic security release: Launched two autonomous security agents, Triage Assist and Remediation Assist, based on Tromzo technology; released Developer Assist independent IDE security assistant.
• 2026.2 (~2026-06) - MCP Server + AI-BOM: Launched Checkmarx MCP Server and AI-BOM functions to begin covering the AI ​​supply chain security category.

Interpretation of version strategy

Checkmarx’s release cadence reflects a clear transformation path: from SAST Tools → Unified AST Platform → Agentic Security Platform. The focus in 2025-2026 is on upgrading AI from assistive functionality (remediation suggestions) to autonomous agents (Triage/Remediation Assist) and embedding security context into AI programming workflows through the MCP protocol. This route closely aligns with the shift-left trend of DevSecOps and the security needs brought about by the proliferation of AI-generated code.

Checkmarx’s technical advantages

Hybrid Scan Engine: Deterministic + AI Inference

The core technology of Checkmarx is hybrid scanning architecture rather than a pure AI replacement rule engine:

• Deterministic Engine: A rule engine based on code structure analysis (AST, control flow, data flow), providing high-precision detection of known vulnerability patterns (OWASP Top 10, CWE Top 25). This part is not affected by model illusion and is the compliance basis for security audits.
• AI Inference Engine: Provides in-depth understanding of code semantics based on the encoder model, covering logical loopholes, business logic flaws and new attack variants that cannot be captured by the rule engine.

Effect: Officials say this combination reduces the false alarm rate by 60% and increases the F1 score to an average of 2.5 times. The mechanism behind it is that the AI ​​engine performs secondary verification (false-positive elimination) on the alarms of the rule engine instead of independently generating alarms.

Security protection of AI repair code

Checkmarx's remediation feature uses the Safe Refactor principle when generating code, ensuring that the generated patches do not introduce new vulnerabilities or break the build. The repair code is embedded in the PR in the form of a suggestion, which is reviewed by the developer before being merged, and manual confirmation is maintained.

Attack prioritization (Attackability)

Traditional SAST sorts by CVSS score, ignoring whether the vulnerability is actually reachable. Checkmarx’s Attackability analysis combines reachability, exploitability and business policy context for prioritization, outputting actionable risk levels rather than static scores. This sequencing directly drives Triage Assist’s decision-making logic.

MCP Server: Security context embedded in AI programming

The architectural design of MCP Server allows AI programming assistants to query security data within a controlled scope. The model obtains scan results and repair suggestions through the MCP protocol, but cannot trigger scan configuration changes or delete results. This read-only access mode is an engineering-level security governance strategy that prevents models from performing irreversible operations.

AI-BOM and compliance mapping

The AI-BOM feature scans the AI ​​components (LLM, Agent, MCP Server, Dataset) in the project, automatically generates a bill of materials and maps it to the compliance terms of NIST AI RMF, EU AI Act, ISO 42001. This solves the compliance blind spot where traditional SBOM cannot cover AI dependencies, and is Checkmarx’s differentiated capability compared to traditional SAST vendors.

How to use Checkmarx

Entry method comparison

Entrance	Applicable scenarios	Startup path
Checkmarx One Web Console	Security team views scan results, configure policies, and manage projects	https://checkmarx.com Register/Login
IDE plug-in (Developer Assist)	Real-time security detection for developers during the coding phase	VS Code extension market search Checkmarx
CI/CD integration	Automated pipeline security access control	Jenkins, GitHub Actions, GitLab CI plug-in configuration
CLI tools	Scripted, batch scan	npm install -g @checkmarx/cli or official binaries
MCP Server	AI Programming Assistant Security Context Query	Configure mcpServers of claude_desktop_config.json
Checkmarx One API	Custom integration and data pulling	REST API, requires API Key authentication

CI/CD integration typical process

1. Developers submit code to the Git repository.
2. CI triggers (such as GitHub Actions) call Checkmarx CLI or plugins.
3. Checkmarx performs incremental scanning (SAST + SCA + Secrets Detection).
4. Results are transmitted back to the Checkmarx One console and Triage Assist automatically sorts them.
5. Remediation Assist generates remediation code and embeds PR comments.
6. Developers review, fix, merge or reject.

MCP Server Quick Configuration

Checkmarx MCP Server can be configured in claude_desktop_config.json:

{
  "mcpServers": {
    "checkmarx": {
      "command": "npx",
      "args": [
        "@checkmarx/mcp-server"
      ],
      "env": {
        "CHECKMARX_API_KEY": "<YOUR_API_KEY>",
        "CHECKMARX_TENANT": "<YOUR_TENANT>"
      }
    }
  }
}

After configuration, the AI assistant can perform operations such as get_scan_results, get_vulnerability_details, get_remediation_guidance and other operations. The specific Tool list is subject to the official npm package README.

Checkmarx Product Pricing

Checkmarx does not disclose standard list prices, all pricing requires custom quotes via Package Builder. The following is a verifiable pricing structure:

Modular pricing model

Tiers	Included Modules	Pricing Model
Code Security Core	NG SAST (required)	By developer seats + number of applications
Add-on Modules - Supply Chain	SCA, Malicious Package Protection, Container Security	Pricing per module
Add-on modules - Security and Operations	Secrets Detection, IaC Security, API Security	Price increase by module
Add-on modules - AI Security	AI Supply Chain Security (including AI-BOM)	New modules, pricing undisclosed
Add-ons - Runtime	DAST	By scan count or duration
AI Agent capabilities	Developer Assist, Triage Assist, Remediation Assist	Usually included in Professional and above subscriptions

Cost deduction

• Starting threshold: Only SAST module, small team (10-25 developers), annual fee is estimated to be in the range of US$30,000-80,000.
• Standard Deployment: SAST + SCA + Secrets Detection, 50-200 developers, annual fee of US$100,000-300,000.
• Full stack enterprise deployment: including DAST, IaC, API Security, container security, 300+ developers, annual fee of US$300,000-800,000.
• Hidden costs: Private deployment requires additional infrastructure investment; large-scale full scanning may require dedicated scanning nodes.

The above deduction is based on industry benchmarking and official Package Builder module list, unofficial quotation. The actual price is subject to the official quotation from the Checkmarx business team.

Checkmarx application scenarios

• Security access control for DevSecOps pipeline: Embed Checkmarx in CI/CD, automatically perform SAST + SCA + Secrets scanning every time the code is submitted, and vulnerability blocking goes online. Acceptance concerns: Incremental scans need to be completed within 5 minutes to avoid blocking the pipeline, and full scans can be scheduled at night or during off-peak periods.
• Financial Industry Code Compliance Audit: Banks and payment institutions need to meet PCI DSS, SOX, and NIS2 compliance requirements. Checkmarx’s scan results can be used as part of the security audit evidence chain, and the AI-BOM further covers the AI ​​asset compliance requirements of the EU AI Act.
• AI-generated code security review: After the team uses AI coding tools such as Cursor and GitHub Copilot, Checkmarx Developer Assist detects the security of the AI-generated code in real time within the IDE, and MCP Server allows the AI ​​assistant to directly obtain the security check results and iterate on its own.
• Supply Chain Security Governance: SCA + Malicious Package Protection covers open source component vulnerabilities, malicious package poisoning, and license compliance risks. Suitable for enterprises that need to quickly locate affected assets when receiving Log4j level emergency notifications.
• Outsourcing/third-party code security acceptance: After receiving the code delivered by the external team, use Checkmarx batch scanning to ensure that no supply chain security risks are introduced. Combined with Attackability ranking, security teams can prioritize high-reachability vulnerabilities.

Applicable groups of Checkmarx

• Security Engineer (AppSec Team): Use the Checkmarx One console to configure scanning policies, manage vulnerability lifecycle, and generate compliance reports. Triage Assist can compress daily triage workload from 3.5 hours to 20 minutes (official data). Misfit Boundary: If the security team lacks basic SAST false positive analysis capabilities, the output of the AI ​​classifier may not be effectively verified.
• Developer: Use Developer Assist in your IDE (VS Code, Cursor, JetBrains) to detect and fix security vulnerabilities in real time without switching context. Remediation Assist's PR embedding function can simplify the remediation process from "security team assignment → developer understanding → writing remediation → submitting PR" to "direct review of AI-generated remediation". Not suitable for boundaries: Developers who don’t pay attention to security at all may feel that IDE detection interrupts the coding rhythm and is suitable for promotion after the team’s security culture matures.
• Security Director/CISO: Use Checkmarx to build a unified view of risk from code to supply chain to runtime, outputting management-level risk trend reports and proof of compliance coverage. Not suitable for the boundary: If the enterprise is still in the initial stage of "no SAST tools", the cost and complexity of directly introducing full-stack Checkmarx are too high. It is recommended to start with open source tools (Semgrep, SonarQube) or a single SAST module.
• Compliance & Audit Team: Leverage AI-BOM and SCA’s SBOM export capabilities to meet asset inventory and risk visibility requirements for regulatory compliance such as NIS2, DORA, PCI DSS, EU AI Act, and more. Non-fit boundary: For scenarios that require only simple SBOM generation (non-AST requirements), specialized SBOM tools (such as Syft, Trivy) are cheaper.

Checkmarx Summary and Outlook

Checkmarx's core competitiveness lies in the Hybrid Engine Architecture - combining the high-precision baseline capabilities of the deterministic rules engine with the semantic understanding capabilities of the AI ​​inference engine, allowing F1 scores to reach the highest level in the industry. The two autonomous agents, Triage Assist and Remediation Assist, launched after the acquisition of Tromzo, mark its transformation from "a tool for reporting vulnerabilities" to "an agent for autonomous security repairs." MCP Server and AI-BOM are in advance of the two explosive tracks of AI programming and AI supply chain security.

Current Limitations and Uncertainties:

• The time-consuming SAST full scan may still become a CI bottleneck in very large single warehouses, and it needs to be used in conjunction with an incremental scan strategy.
• The AI ​​repair code is not as accurate as conventional injection vulnerabilities in complex business logic vulnerabilities (such as permission bypass, business rule conflicts), and developers still need to review them carefully.
• Pricing is opaque and the threshold is high, making it difficult for small teams (<10 people) to purchase independently; the absence of community/free versions limits adoption by individual developers and open source projects.
• MCP Server and AI-BOM are newer features (released in 2026 H1), and long-term stability and the breadth of third-party ecological integration still need to be observed.
• The GitHub Actions credential leak incident (TeamPCP attack) in March 2026 showed that Checkmarx’s own supply chain security governance is also facing challenges, and enterprises should be required to provide more transparent descriptions of supply chain security practices when purchasing.

Procurement/Adoption Risk Assessment: Checkmarx is a dual Gartner and Forrester leader with high technology maturity, especially suitable for large enterprises and strong compliance industries with existing DevSecOps processes. It is recommended to enter the PoC method of "SAST + SCA core module + 1 real project", focusing on verifying the adoptability rate of AI repair suggestions in terms of scan time and the actual efficiency improvement of the Agent function. If your business has a limited budget, a small team, or a very monolithic technology stack, start by evaluating alternatives like Semgrep, SonarQube, or Snyk. The procurement contract should pay attention to where the data resides (SaaS model), whether AI functions require additional payment, and pricing lock-in terms after commercialized module upgrades.

Related tools: , google-workspace

Version Info

• Checkmarx AI-Augmented SAST ：Introducing AI-enhanced vulnerability remediation recommendations and automatically generated secure code snippets. There is no official precise date yet. （~2025-04）
• Checkmarx One v2024 ：Unified platform Checkmarx One is released, integrating SAST/SCA/DAST. There is no official precise date yet. （~2024-01）