Skip to content
Z Zendikt
C
Code Quality and Static Analysis · Rank #6 of 10

Checkmarx review and pricing

Legacy enterprise SAST plus SCA plus IaC under PE control.

By Checkmarx (Hellman & Friedman) · Founded 2006 · Tel Aviv, Israel · pe backed

Checkmarx is the legacy enterprise application-security platform, founded 2006 in Tel Aviv. Hellman & Friedman took Checkmarx private in 2020 for $1.15B (reported), and the company has since operated under PE ownership with rotating CEO leadership. The product covers SAST, SCA, IaC scanning, supply-chain security (Checkmarx One platform launched 2023), and API security. Strengths: deep SAST analysis on Java, .NET, and JavaScript, strong fit for security-led organizations with existing Checkmarx footprint, and broad compliance reporting. Trade-offs: post-PE product investment has been uneven, scan times remain long, false-positive rates draw consistent complaints (20 to 30 percent in buyer reports), the Checkmarx One platform migration from CxSAST through 2023-2024 was rocky, and pricing is opaque and quote-only.

Visit Checkmarx Vendor pricing Compare to Veracode
Best for

Security-led enterprise organizations with existing Checkmarx footprint, particularly Java-anchored or .NET-anchored stacks. Strong for regulated industries where Checkmarx is already in procurement and SAST plus SCA plus IaC consolidation is the goal.

Worst for

Greenfield SAST decisions (SonarQube, Snyk Code, CodeQL better), modern engineering-led teams (developer experience lags), or buyers wanting transparent pricing (Codacy, DeepSource, SonarCloud better).

Vendor Trust Score

Is Checkmarx a trustworthy vendor?

6.0/10
Mixed
Pricing transparency
Published rates; no hidden fees
5.0
Contract fairness
Reasonable terms; no auto-renew traps
6.0
Incident response
How they handle outages and breaches
7.0
Post-acquisition behavior
Customer treatment after M&A or PE
5.5
Executive stability
Leadership churn over 24 months
6.0
Roadmap honesty
Public commitments held
6.5
Trust signal log
  • 2020-04-15
    Hellman & Friedman take-private deal at $1.15B (reported)
    PE acquisition raised post-PE product-investment questions; pattern consistent with broader PE dev-tools playbook.
  • 2023-05-22
    Checkmarx One platform launched
    Consolidated SAST plus SCA plus IaC plus API security; migration from legacy CxSAST through 2023-2024 was rocky for some customers.
  • 2024-04-15
    Rotating CEO leadership 2023-2025
    Multiple CEO transitions raised executive-stability concerns through 2023-2025.
Vendor Trust is scored independently of product quality. A great product from an unfair vendor still earns a low trust score.
Review Intelligence

What 420 reviews actually say

Synthesized from G2, Capterra, Reddit, Trustpilot. Patterns >15% prevalence shown.

Last synthesized
2026-04-29

Praise patterns

  • Deep SAST analysis on Java, .NET, JavaScript
    78% →
  • Checkmarx One platform consolidation
    64% →
  • Custom rules via CxQL for security teams
    51% →
  • Broad compliance reporting
    47% →

Complaint patterns

  • Post-PE product investment uneven
    51% ↑
  • Long scan times at enterprise scale
    47% →
  • False-positive rates 20 to 30 percent
    41% →
  • Checkmarx One migration rocky for some customers
    38% ↓
Sentiment trend (6 months)
66/100 0 pts
12
01
02
03
04
05
Patterns are extracted from review corpus and human-verified. We surface trends, not anecdotes.
Verified Pricing

What buyers actually pay

164 anonymized deal disclosures · last updated 2026-05-01

Contribute your deal price
Company size Median annual
Mid-market (10 to 50 apps) $96,000
Enterprise (50 to 500 apps) $420,000
Large enterprise (500+ apps) $1,500,000
Verified pricing is crowdsourced from buyers under anonymity guarantees. Vendor-listed prices are validated against actual deals quarterly.
Compliance & Security

Auto-verified certifications

Verified 2026-05-01
SOC 2 Type II
ISO 27001
HIPAA
GDPR
CCPA
PCI DSS
◐ FedRAMP In-Process

Editorial: Strengths

  • Deep SAST analysis on Java, .NET, JavaScript
  • Checkmarx One platform consolidation (SAST plus SCA plus IaC plus API)
  • Strong fit for security-led organizations with existing Checkmarx footprint
  • Broad compliance reporting (OWASP, CWE, PCI, SOC 2)
  • IDE plugins for IntelliJ, Visual Studio, Eclipse
  • Custom rules via Checkmarx Query Language (CxQL)

Editorial: Weaknesses

  • Post-Hellman-Friedman product investment has been uneven
  • Scan times remain long at enterprise scale
  • False-positive rates 20 to 30 percent in buyer reports
  • Checkmarx One migration from CxSAST through 2023-2024 was rocky
  • Pricing opaque and quote-only; no published rate card
  • Rotating CEO leadership through 2023-2025 raised executive-stability concerns

Key features & integrations

  • +SAST across 35+ languages
  • +SCA for open-source composition
  • +IaC security (Terraform, Kubernetes, CloudFormation)
  • +API security scanning
  • +Checkmarx One platform consolidation
  • +Custom rules via Checkmarx Query Language (CxQL)
  • +IDE plugins for IntelliJ, Visual Studio, Eclipse
  • +OWASP Top 10, CWE Top 25, PCI compliance reporting
  • +SAML SSO, SCIM, audit logging
  • +REST API plus CLI
120+ integrations
GitHubGitLabBitbucketAzure DevOpsJenkinsJiraServiceNowSplunkAWSAzure
Geography supported
Global; strongest in US, UK, EU, Israel
Best fit
500 to 100,000+ employees · Security-led enterprises with existing Checkmarx footprint
Editorial deep-dive

Read our full ranking of Code Quality and Static Analysis

Checkmarx ranks #6 in our editorial review of 10 code quality and static analysis platforms. The deep-dive covers methodology, comparison tables, decision matrix, migration scoring, and FAQs.

Read the full ranking

Closest alternatives in Code Quality and Static Analysis

#5
Veracode
Legacy enterprise SAST plus DAST plus SCA, now under Thoma Bravo.
★ 4.2 opaque
#7
Semgrep
Open-source-first code-quality and security with readable rules.
★ 4.6 partial
#4
DeepSource
Modern zero-config code-quality automation.
★ 4.5 public
Help the next buyer

Contribute your verified deal price

Pricing in B2B software is opaque because vendors want it that way. Verified buyer prices fix that, anonymously. Share what you actually paid for Checkmarx; we’ll add it to the verified pricing dataset on this page (with company size band only, no identifying details).

Submit anonymously