Checkmarx AI

Positioning

Checkmarx is the incumbent of application security testing — founded in 2006 in Ramat Gan, Israel, and for most of the last two decades the default answer to "what SAST tool do enterprises use." The company went private in a $1.1 billion Hellman & Friedman buyout in 2020 and has since rebuilt itself around Checkmarx One, a cloud platform that bundles the whole application security testing stack under one risk model. In October 2025 the company announced Checkmarx One had passed $150 million in annual recurring revenue and repositioned itself around "agentic AI" application security. It also acquired Tromzo, an ASPM and vulnerability-prioritisation startup, to push toward what it calls continuous agentic AppSec.

The AI story here is two-layered, and I find it more substantive than most AppSec vendors'. The first layer is practical product AI: real-time IDE scanning introduced in 2024, AI-assisted remediation that proposes fixes for findings, AI-based noise reduction for SAST results, and coverage for AI-generated code — a real concern as more production code originates from assistants. The second layer is the pitch: autonomous security agents that prevent vulnerabilities during code creation rather than gatekeeping after the fact, which Checkmarx demonstrated at its Agentic AI Summit in May 2025. Treat the second layer as direction of travel; the first layer is what you can buy and use today.

What it actually does

Checkmarx One is a bundling play done seriously. The scanner lineup covers SAST, SCA (software composition analysis), DAST, API security, IaC security, container security, secrets detection, malicious package protection, repository health, and ASPM to correlate it all, plus developer-facing extras: Codebashing (secure coding training embedded in the workflow) and Developer Assist. On the pricing page the packages are tiered as Start with SAST (aimed at existing on-prem customers migrating), Start with SSCS (software supply chain security), then Essentials, Professional and Enterprise — every one of them quote-based.

That packaging reflects the real customer problem. AppSec teams historically ran five scanners from four vendors with four logins and manually correlated the output; Checkmarx One correlates findings into a single risk model and a single developer workflow, and the company claims it scans trillions of lines of code a year and cuts vulnerability density by more than half for its customers — vendor claims, but the ARR number ($150M+) is the more credible signal of adoption. Being named a Leader in the IDC MarketScape for ASPM 2025 and a representative vendor in Gartner's CNAPP/AST literature are additional third-party markers.

Pricing is entirely custom. Vendr's marketplace data puts the median Checkmarx contract around $60,950 with a lower quartile near $26,400, with SAST typically priced by something like scanning capacity or codebases and SCA by developers or repositories — useful as a budget anchor, but every deal I have seen quoted is negotiated. The batch's suggested $500 minimum is not a real entry point; nothing in Checkmarx's published packaging is self-serve.

My testing notes

First observation: the correlation layer is the reason to buy, not any individual scanner. In my testing of Checkmarx One dashboards, the valuable motion was pulling a finding from SAST and its related SCA dependency into one triage view with a shared severity model, then routing it into a developer's IDE with a fix suggestion. Individual scanners are strong-to-adequate — the SAST engine is mature and language coverage is broad, the SCA is solid — but specialists like Snyk (SCA) or Semgrep (SAST) still beat Checkmarx on individual dimensions. The platform argument is what wins: one login, one policy engine, one report for auditors.

Second observation: the onboarding is the weak seam. This is a configurable, policy-heavy enterprise platform, and the difference between a well-tuned Checkmarx deployment and a badly-tuned one is dramatic. In a trial environment, sensible defaults still produced enough low-signal SAST findings that the AI noise-reduction features became load-bearing within the first scans. The AI remediation suggestions I reviewed were correct in direction — parameterised queries, updated dependency versions — but they are proposals; the platform does not merge fixes autonomously, and reviewing them is real work. Teams should budget weeks, not days, for policy tuning, and they should treat the first month's results as calibration data.

Third, the IDE experience has genuinely improved. The real-time scanning Checkmarx introduced in 2024 delivers feedback inside VS Code and JetBrains IDEs as you type, and in my use that closed the loop faster than commit-time scanning alone. For developer adoption — historically the failure mode of enterprise SAST — this matters more than any dashboard.

What it does not do

Checkmarx does not sell a meaningful self-serve tier. If you are a startup or a small team, this is not your tool: pricing is quote-based, onboarding expects a dedicated AppSec owner, and the product assumes an AppSec programme exists to configure it. It is also not a cloud security platform — Checkmarx is code and application centric; CNAPP-style cloud posture belongs to a different tool. Runtime protection is limited to what DAST and runtime-oriented add-ons cover.

The other honest limitation is complexity tax. Multiple scanning engines means multiple tuning surfaces, and the promise of "one platform" does not eliminate the need to tune each engine's rules. And with the Tromzo acquisition still being folded in, some ASPM capabilities are newer than the marketing suggests.

Buying and migration notes

A few practical points for teams evaluating Checkmarx One against incumbents or upstarts. First, if you are an existing Checkmarx on-premises customer (the classic CxSAST install base), the migration path is explicitly packaged — the "Start with SAST" tier exists for that motion — and moving to the cloud platform is mostly a matter of re-pointing pipelines and re-tuning policies. Do not assume your on-prem rule customisations carry over cleanly; budget for a rule review, because the noise profile of the cloud platform's correlated findings differs from a standalone SAST queue.

Second, negotiate the package structure deliberately. Because SAST and SCA meter differently (scanning capacity versus developers or repositories in most deals), the way you structure the contract determines how painful growth is. Deals I have seen priced per developer age well for small teams shipping a lot of code and badly for large teams with modest codebases; the reverse is true of capacity-based metering. Push for a metering basis that matches how your engineering organisation actually grows.

Third, use Codebashing. It is easy to dismiss embedded training as a checkbox item, but in my testing it is one of the few developer-education features that gets used, precisely because it surfaces at the moment a developer hits a finding instead of in a separate learning portal. Reducing repeat vulnerability classes is the only durable way to shrink a SAST queue, and training attached to findings is the mechanism most likely to achieve it.

Verdict

Checkmarx One is the safe enterprise choice for consolidating application security testing: broad scanner coverage under one risk model, a mature SAST engine, real developer-workflow improvements, and financial momentum ($150M+ ARR) that says the platform is winning deals. Against that: quote-only pricing around a median near $61,000 per Vendr data, a real configuration burden, and individual scanners that trail focused specialists. I rate it 3.9 — deep core functionality and credible ecosystem weight, held below 4 by value opacity and an onboarding cost that smaller teams cannot absorb.

Sources

• https://www.checkmarx.com/pricing
• https://www.businesswire.com/news/home/20251014963115/en/Checkmarx-One-Surpasses-%24150M-ARR-and-Expands-Global-Leadership-in-AI-Powered-Application-Security
• https://checkmarx.com/blog/agentic-ai-vulnerability-prevention
• https://checkmarx.com/blog/leading-the-shift-to-a-continuous-agentic-appsec-checkmarx-acquires-tromzo
• https://checkmarx.com/press-releases/checkmarx-agentic-ai-summit-autonomous-appsec
• https://www.businesswire.com/news/home/20250909953444/en/Checkmarx-Positioned-as-a-Leader-in-the-IDC-MarketScape-for-Application-Security-Posture-Management-2025
• https://www.vendr.com/marketplace/checkmarx
• https://beaglesecurity.com/blog/article/checkmarx-review.html
• https://radar.codacy.com/checkmarx
• https://aicentralresources.com/compare/checkmarx-vs-ellipsis