Software Development Platforms

Checkmarx One

Application security testing for code, supply chain, and runtime risk.

Overview

Checkmarx One secures software from code creation to runtime by combining deterministic scanning with AI reasoning to detect vulnerabilities, prioritize risks, and automate remediation across code, supply chain, and runtime environments.

Updated Oct 26, 2026

6 things

What Checkmarx One has

For developers

Run the software on your own servers instead of the vendor's cloud. One of 10 Software Development platforms you can self-host.

Hosting and storage

Run software in an environment isolated from external networks.

Support

Real people you can contact when you need help with the tool. One of 20 Software Development platforms with human support.
Guided setup and training to help new users get started with the tool.
Expert services that help organizations plan, implement, or improve their work processes. One of 4 Software Development platforms with professional services.

Pricing

A product demonstration available to prospective customers who want to evaluate the tool. One of 14 Software Development platforms with public demo.

9 features

Key Features

Application security
AI generates code faster than it can be secured. Checkmarx governs the risk, from code to runtime with agentic AI application security.
Secret detection
Secrets Detection blocks credentials before they enter Git.
Triage and remediation
Triage Assist surfaces what matters; Remediation Assist proposes the fix.
Dependency security
SCA and Malicious Package Protection flag risky dependencies before merge.
Security coverage
Most tools secure in silos. Checkmarx covers code creation, CI/CD, AI supply chain, and runtime — with MCP, IDE, and PR hooks that enforce security at every agentic control point.
Finding prioritization
Raw findings aren’t actionable. Checkmarx combines deterministic precision with AI analysis to surface true positives, ranked by reachability, exploitability, and business context.
AI-generated fixes
Discovery without fixing just grows the backlog. Checkmarx delivers AI-generated, merge-ready fixes at the point of code creation for 50% faster MTTR, 30–50% fewer duplicate fixes, and zero AppSec headcount increase.
Fix proposals
When tools create friction, developers route around them. Checkmarx surfaces findings with fix proposals already attached — no context-switching, no investigation.
Audit records
Knowing what was found isn’t enough. Checkmarx maintains documented records of every finding, decision, exception, and approval to ensure human oversight is built into the process, not bolted on after.

Pros and cons

Pros

Comprehensive coverage across code, supply chain, AI components, and runtime environments.
AI-powered agents enhance detection accuracy and automate remediation to speed up developer workflows.
Unified risk view prioritizes vulnerabilities by exploitability and business context, reducing noise.
Integrates seamlessly into existing development and security toolchains without disrupting workflows.
Maintains audit-ready records for compliance and governance.

Cons

Pricing details are not publicly disclosed; requires contact with sales for quotes.
Complex platform may require training and onboarding for effective use.
Some advanced AI scanning features are upcoming and not yet available.
May be resource-intensive for smaller teams or organizations without dedicated AppSec staff.

As of October 2026

Pricing

Start with SAST
Custom
on request
Start with Supply Chain
Custom
on request
Essentials
Custom
on request
Professional
Custom
on request
Enterprise
Custom
on request

Developer features

Code scanning
NG SAST and IaC scanning catch issues as code is written, in the IDE.
Runtime testing
DAST validates exploitability against running applications and APIs.
AI supply chain inventory
Traditional AppSec wasn’t built to detect AI. Checkmarx inventories and governs every model, MCP server, agent, SDK, dataset, prompt, and AI dependency in your pipeline — before it becomes a blind spot.

You?

Be the first to rate Checkmarx One

Your review helps others make better decisions. No account needed. Takes about 10 seconds.

Featured Video

See Checkmarx One at work before you try it.

Watch on YouTube

0 questions

Frequently Asked Questions

No reviews yet

Community reviews

Sort:Write a review

No written reviews yet. Be the first to share your experience.

Tried this tool? Share your experience.

Write a review

No reviews yet

Community reviews

Sort:Write a review

No written reviews yet. Be the first to share your experience.

Tried this tool? Share your experience.

Write a review

6 things

What Checkmarx One has

For developers

Run the software on your own servers instead of the vendor's cloud. One of 10 Software Development platforms you can self-host.

Hosting and storage

Run software in an environment isolated from external networks.

Support

Real people you can contact when you need help with the tool. One of 20 Software Development platforms with human support.
Guided setup and training to help new users get started with the tool.
Expert services that help organizations plan, implement, or improve their work processes. One of 4 Software Development platforms with professional services.

Pricing

A product demonstration available to prospective customers who want to evaluate the tool. One of 14 Software Development platforms with public demo.

9 features

Key Features

Application security
AI generates code faster than it can be secured. Checkmarx governs the risk, from code to runtime with agentic AI application security.
Secret detection
Secrets Detection blocks credentials before they enter Git.
Triage and remediation
Triage Assist surfaces what matters; Remediation Assist proposes the fix.
Dependency security
SCA and Malicious Package Protection flag risky dependencies before merge.
Security coverage
Most tools secure in silos. Checkmarx covers code creation, CI/CD, AI supply chain, and runtime — with MCP, IDE, and PR hooks that enforce security at every agentic control point.
Finding prioritization
Raw findings aren’t actionable. Checkmarx combines deterministic precision with AI analysis to surface true positives, ranked by reachability, exploitability, and business context.
AI-generated fixes
Discovery without fixing just grows the backlog. Checkmarx delivers AI-generated, merge-ready fixes at the point of code creation for 50% faster MTTR, 30–50% fewer duplicate fixes, and zero AppSec headcount increase.
Fix proposals
When tools create friction, developers route around them. Checkmarx surfaces findings with fix proposals already attached — no context-switching, no investigation.
Audit records
Knowing what was found isn’t enough. Checkmarx maintains documented records of every finding, decision, exception, and approval to ensure human oversight is built into the process, not bolted on after.

Pros and cons

Pros

Comprehensive coverage across code, supply chain, AI components, and runtime environments.
AI-powered agents enhance detection accuracy and automate remediation to speed up developer workflows.
Unified risk view prioritizes vulnerabilities by exploitability and business context, reducing noise.
Integrates seamlessly into existing development and security toolchains without disrupting workflows.
Maintains audit-ready records for compliance and governance.

Cons

Pricing details are not publicly disclosed; requires contact with sales for quotes.
Complex platform may require training and onboarding for effective use.
Some advanced AI scanning features are upcoming and not yet available.
May be resource-intensive for smaller teams or organizations without dedicated AppSec staff.

As of October 2026

Pricing

Start with SAST
Custom
on request
Start with Supply Chain
Custom
on request
Essentials
Custom
on request
Professional
Custom
on request
Enterprise
Custom
on request

Developer features

Code scanning
NG SAST and IaC scanning catch issues as code is written, in the IDE.
Runtime testing
DAST validates exploitability against running applications and APIs.
AI supply chain inventory
Traditional AppSec wasn’t built to detect AI. Checkmarx inventories and governs every model, MCP server, agent, SDK, dataset, prompt, and AI dependency in your pipeline — before it becomes a blind spot.

You?

Be the first to rate Checkmarx One

Your review helps others make better decisions. No account needed. Takes about 10 seconds.

Featured Video

See Checkmarx One at work before you try it.

Watch on YouTube

0 questions

Checkmarx One

Overview

What Checkmarx One has

For developers

Hosting and storage

Support

Pricing

Key Features

Application security

Secret detection

Triage and remediation

Dependency security

Security coverage

Finding prioritization

AI-generated fixes

Fix proposals

Audit records

Pros and cons

Pros

Cons

Pricing

Checkmarx One pricing plans

Start with SAST

Start with Supply Chain

Essentials

Professional

Enterprise

Developer features

Code scanning

Runtime testing

AI supply chain inventory

Be the first to rate Checkmarx One

Featured Video

Frequently Asked Questions

What Checkmarx One has

For developers

Hosting and storage

Support

Pricing

Key Features

Application security

Secret detection

Triage and remediation

Dependency security

Security coverage

Finding prioritization

AI-generated fixes

Fix proposals

Audit records

Pros and cons

Pros

Cons

Pricing

Checkmarx One pricing plans

Start with SAST

Start with Supply Chain

Essentials

Professional

Enterprise

Developer features

Code scanning

Runtime testing

AI supply chain inventory

Be the first to rate Checkmarx One

Featured Video

Frequently Asked Questions

More in Software Development Platforms

More in Software Development Platforms