Static Code Analysis

Pick the first of two products.

Open a name for its full profile

Aikido SAST
Scored
Aikido Security · Freemium · 5 capabilities in this domain · 4.22 / 5
Select
Snyk Code
Scored
Snyk · Freemium · 5 capabilities in this domain · 4.07 / 5
Select
GitHub Code Security
Scored
GitHub · Freemium · 4 capabilities in this domain · 4.05 / 5
Select
Semgrep Code
Scored
Semgrep · Freemium · 5 capabilities in this domain · 3.95 / 5
Select
Veracode Static Analysis
Scored
Veracode · Commercial · 6 capabilities in this domain · 3.90 / 5
Select
SonarQube
Scored
SonarSource · Freemium · 3 capabilities in this domain · 3.89 / 5
Select
Checkmarx One SAST
Scored
Checkmarx · Commercial · 6 capabilities in this domain · 3.88 / 5
Select
OpenText Fortify Static Code Analyzer
Scored
OpenText · Commercial · 3 capabilities in this domain · 3.69 / 5
Select
Coverity
Scored
Black Duck Software · Commercial · 2 capabilities in this domain · 3.56 / 5
Select
Klocwork
Scored
Perforce · Commercial · 2 capabilities in this domain · 3.48 / 5
Select
HCL AppScan Source
Scored
HCL Software · Commercial · 2 capabilities in this domain · 3.34 / 5
Select
Opengrep
Scored
Opengrep Project · Open Source · 2 capabilities in this domain · 3.06 / 5
Select
Semgrep Community Edition
Scored
Semgrep · Open Source · 2 capabilities in this domain · 2.96 / 5
Select
Brakeman
Scored
Brakeman Project · Free · 1 capabilities in this domain · 2.85 / 5
Select
Find Security Bugs
Scored
SpotBugs Community · Open Source · 2 capabilities in this domain · 2.66 / 5
Select
gosec
Scored
securego · Open Source · 1 capabilities in this domain · 2.66 / 5
Select
Bandit
Scored
Python Code Quality Authority (PyCQA) · Open Source · 1 capabilities in this domain · 2.59 / 5
Select
GitHub Advanced Security for Azure DevOps
Capabilities only
Microsoft · Commercial · 1 capabilities in this domain
Select
Mobile Security Framework (MobSF)
Capabilities only
MobSF Project · Open Source · 1 capabilities in this domain
Select
NowSecure Platform
Capabilities only
NowSecure · Commercial · 1 capabilities in this domain
Select

In Static Code Analysis

Checkmarx One SAST

Checkmarx · Static Code Analysis

CommercialCompany3.88 / 5

Checkmarx SAST scans uncompiled source with a query language for customization and integrates with the platform's SCA, API, DAST and IaC results for correlated risk.

Website ↗

What it does10 capabilities · 8 at full coverage

8 of 10 at full coverage, 6 through a named feature.

Automated Remediation Pull RequestsPartialDEVSEC · via a feature · level 2 · 12 providers
IDE Security Linting★FullDEVSEC · via a feature · level 1 · 8 providers
Secure Coding Training★PartialDEVSEC · via a feature · level 1 · 5 providers
Contextual Remediation GuidanceFullEVM · via a feature · level 3 · 5 providers
Custom Security Rule AuthoringFullSAST · via a feature · level 3 · 8 providers
Finding Triage & False-Positive SuppressionFullSAST · level 3 · 7 providers
Incremental Diff ScanningFullSAST · via a feature · level 2 · 8 providers
Mobile Application Security TestingFullSAST · level 3 · 4 providers
Static Application Security TestingFullSAST · level 2 · 21 providers
Taint & Data-Flow AnalysisFullSAST · level 3 · 10 providers

What it proves39 controls across 13 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.19 / 42PO.2.2 PW.5.1 PW.7.1 PW.7.2 PW.8.2 RV.1.2 RV.2.1 RV.2.2 RV.3.3
SAMM 2.08 / 90G-EG-1-A G-EG-2-A G-EG-3-A I-DM-2-A I-SB-1-A V-ST-1-A V-ST-2-A V-ST-3-A
CSF 2.04 / 106ID.RA-01 PR.AT-01 PR.AT-02 PR.PS-06
DSOMM4 / 19CO-Education-and-Guidance IM-Application-Hardening TV-Consolidation TV-Static-Depth-Applications
ASVS 5.03 / 17V1 V15 V5
CIS Controls2 / 18CIS 14 CIS 16
CRA2 / 41Annex I Part II (2) Annex I Part II (3)
OWASP Top 102 / 10A01:2025 A05:2025
AICM1 / 18HRS
CNAS Top 101 / 10CNAS-2
S2C2F1 / 25UPD-2
SP 800-204D1 / 11204D-CI-COMMIT
Scorecard1 / 20SAST

What it stops3 techniques · 1 risk

3 techniques countered, 3 of them common

Exploit Public-Facing ApplicationT1190Very Common
Injection ExploitationVery Common
SSRF to Cloud Metadata Credential TheftCommon

1 risks reduced

Exploitable flaw in first-party application codeHigh

Where it runs5 phases · 5 ways to deploy

Capabilities per lifecycle phase

Plan1
Code9
Build3
Test1
Monitor2

How it is delivered

CI/CD integrationCLI toolIDE pluginSaaSSelf-hosted

What it unlocks10 activities · reaches level 5

Program activities its capabilities support, reaching level 5. Supporting an activity is not completing it.

Level 1

Run SAST on critical repositoriesLow effort
Train developers in secure codingLow effort

Level 2

Scan every pull request and block new high-confidence issuesLow effort
Security feedback in the IDE and pre-commitLow effort

Level 3

Practice test-driven security with security unit testsMedium effort
Prioritize by exploitabilityMedium effort
Tune rules and automate triageMedium effort

Level 4

Custom rules from incidents and pentestsMedium effort

Level 5

Eliminate vulnerability classesHigh effort
Findings-driven learning loopMedium effort

How it holds up11 criteria scored · 4 strengths · 4 limitations

Scored 0 to 5 against the evaluation criteria

Coverage from pre-commit to runtime4.0
Language, framework and ecosystem breadth4.6
Context-driven prioritization4.0
CI/CD and developer workflow integration3.8
APIs and extensibility4.3
Actionable remediation guidance3.8
Accuracy and noise3.6
Governance and compliance reporting4.3
AI capability maturity and AI security coverage3.7
Total cost and licensing fit3.3
Operational effort and skills required3.3

Strengths

Broadest language and framework coverage of the three
Scans without building code
CxQL lets AppSec teams write and tune their own detections
Correlates findings with SCA API and IaC results in one platform

Limitations

Tuning required to control false positives
Higher operating effort than developer-first tools
Platform pricing favors buying the full Checkmarx One suite
Developer experience lags Snyk in the IDE

Best for

Enterprises with polyglot estates and legacy languages
Teams with AppSec engineers who will own query tuning
Programs that want one AppSec platform

Differentiators

Widest language coverage
Deep query customization with CxQL
Unified risk view across SAST SCA API DAST and IaC

How the analysis works

Source-level analysis of uncompiled code with data-flow tracing and the CxQL query language for custom detections; scans without a build

Organization size it suits

Large enterprises with many languages and dedicated application security staff

What it costs2 tiers · Platform enterprise agreement · licensing notes

LicensingPlatform enterprise agreement

Priced perannual contract

BillingSubscription

Scales withNegotiated scope (developers, assets, modules)

EnterpriseContact salesAnnual
Planning estimateestimate$800contributing developer/year · Annual

Licensing in practice

Quoted per contributing developer as part of a Checkmarx One platform agreement.

Total cost

Opaque list pricing; benchmark with peers and require clear overage terms.

What it takes to run2.5 FTE at peak · 4–10 weeks to stand up · 2 roles

Peak staffing2.5 FTE

Typical team1-2 AppSec FTE per 250 developers

Time to stand up4–10 weeks

APIAvailable

Roles it needs

Application Security Engineer1–2 FTE
DevSecOps Engineer0.25–0.5 FTE

Attestations held

SOC 2 Type II

Automation

REST APICLICI pluginsIDE pluginsWebhooks

Compliance reporting

OWASP Top 10CWE Top 25PCI DSSNIST SP 800-53ASD STIGSARIF export

Deployment

Checkmarx One is SaaS; a self-hosted option exists for regulated environments. Plan for a tuning phase before gating pull requests.

What it works with12 languages · 2 standards · 5 features

Named features

Checkmarx AI Security ChampionAICheckmarx AI Security Champion in Checkmarx One SAST.
Checkmarx One IDE pluginsCheckmarx One IDE plugins in Checkmarx One SAST.
CodebashingCodebashing in Checkmarx One SAST.
CxQL custom queriesCxQL custom queries in Checkmarx One SAST.
Incremental scanningIncremental scanning in Checkmarx One SAST.

Languages

C and C++C# and .NETGoJavaJavaScript and TypeScriptKotlinPHPPythonRubyRustScalaSwift

Standards and formats

Common Weakness EnumerationStatic Analysis Results Interchange Format

Integrates with

Bitbucket CloudGitHub Enterprise CloudGitLab UltimateServiceNow Integrated Risk ManagementStatic Analysis Results Interchange Format

AI features

Checkmarx AI Security Champion

What else to look at5 competing · 5 comparable head to head · 1 sibling

Comparable head to head

Competes with

Aikido SASTFreemium · 4.22
OpenText Fortify Static Code AnalyzerCommercial · 3.69
Semgrep CodeFreemium · 3.95
Snyk CodeFreemium · 4.07
Veracode Static AnalysisCommercial · 3.90

Same family

Checkmarx One SCACommercial

What backs this up3 measurements

Measured, with how much to trust it

False Positive Rate20%Planning assumption before query tuning; typically halves after a tuning phaseRockPoint Cyber Estimate · 2026-01-01
Pull Request Finding Fix Rate40%Share of incremental scan findings fixed before merge after tuningRockPoint Cyber Estimate · 2026-01-01
Security Build Time Overhead10 minTypical incremental scan on a mid-size serviceRockPoint Cyber Estimate · 2026-01-01

Gantry 7.1.0 · OFF.12 · OFF.13