Checkmarx

Founded by Emanuel Tzur in 2006

Scan code for security vulnerabilities across every stage of development

Cost

Demo

Rating

★ People love it

Time to value

Requires Expertise

You can use Checkmarx to find and fix security vulnerabilities in your code before they reach production. It scans source code (SAST), software dependencies (SCA), infrastructure-as-code, containers, APIs, and AI components. It flags malicious packages, detects leaked secrets, and tests running applications with DAST. AI-powered agents help developers triage findings and generate fix suggestions directly in the IDE or pull request, covering both traditional and AI-generated code.

What Checkmarx does

Run static code analysis (SAST) on every pull request automaticallyDetect and block hard-coded secrets at the Git commit stageGenerate AI-assisted fix suggestions with code diffs ready to mergeInventory all AI components and dependencies in an AI-BOM reportCorrelate findings from multiple scanners into a single prioritized risk listScan third-party packages and containers for malicious code or known vulnerabilitiesSimulate attacks against running APIs to validate exploitability with DASTProduce compliance audit logs showing every security finding and its resolutionHybrid scanning engine combining rules-based static analysis with AI reasoning for fewer false positivesAI-generated, merge-ready fix suggestions surfaced directly in the IDE and pull requestsAI Bill of Materials (AI-BOM) that inventories every AI model, MCP server, agent, and SDK in your codebaseMalicious package detection backed by the industry's largest threat databaseASPM dashboard that correlates findings across all scanners into one risk viewDAST module that simulates real attacker behavior against live applications and APIsSecrets detection that blocks credentials from entering Git at commit timeMCP server scanning and agentic control plane for governing AI-driven development workflows