Static Code Analysis

Now pick what to compare Checkmarx One SAST against.

Checkmarx One SAST clear

Open a name for its full profile

Aikido SAST
Scored
Aikido Security · Freemium · 5 capabilities in this domain · 4.22 / 5
Compare →
Snyk Code
Scored
Snyk · Freemium · 5 capabilities in this domain · 4.07 / 5
Compare →
GitHub Code Security
Scored
GitHub · Freemium · 4 capabilities in this domain · 4.05 / 5
Compare →
Semgrep Code
Scored
Semgrep · Freemium · 5 capabilities in this domain · 3.95 / 5
Compare →
Veracode Static Analysis
Scored
Veracode · Commercial · 6 capabilities in this domain · 3.90 / 5
Compare →
SonarQube
Scored
SonarSource · Freemium · 3 capabilities in this domain · 3.89 / 5
Compare →
Checkmarx One SAST
Scored
Checkmarx · Commercial · 6 capabilities in this domain · 3.88 / 5
selected
OpenText Fortify Static Code Analyzer
Scored
OpenText · Commercial · 3 capabilities in this domain · 3.69 / 5
Compare →
Coverity
Scored
Black Duck Software · Commercial · 2 capabilities in this domain · 3.56 / 5
Compare →
Klocwork
Scored
Perforce · Commercial · 2 capabilities in this domain · 3.48 / 5
Compare →
HCL AppScan Source
Scored
HCL Software · Commercial · 2 capabilities in this domain · 3.34 / 5
Compare →
Opengrep
Scored
Opengrep Project · Open Source · 2 capabilities in this domain · 3.06 / 5
Compare →
Semgrep Community Edition
Scored
Semgrep · Open Source · 2 capabilities in this domain · 2.96 / 5
Compare →
Brakeman
Scored
Brakeman Project · Free · 1 capabilities in this domain · 2.85 / 5
Compare →
Find Security Bugs
Scored
SpotBugs Community · Open Source · 2 capabilities in this domain · 2.66 / 5
Compare →
gosec
Scored
securego · Open Source · 1 capabilities in this domain · 2.66 / 5
Compare →
Bandit
Scored
Python Code Quality Authority (PyCQA) · Open Source · 1 capabilities in this domain · 2.59 / 5
Compare →
GitHub Advanced Security for Azure DevOps
Capabilities only
Microsoft · Commercial · 1 capabilities in this domain
Compare →
Mobile Security Framework (MobSF)
Capabilities only
MobSF Project · Open Source · 1 capabilities in this domain
Compare →
NowSecure Platform
Capabilities only
NowSecure · Commercial · 1 capabilities in this domain
Compare →

In Static Code Analysis

Klocwork

Perforce · Static Code Analysis

Close ×

CommercialCompany3.48 / 5

Klocwork supports differential analysis and standards such as MISRA, AUTOSAR and CWE for embedded and large codebases.

What it does2 capabilities · 2 at full coverage

2 of 2 at full coverage.

Incremental Diff ScanningFullSAST · level 2 · 8 providers
Static Application Security TestingFullSAST · level 2 · 21 providers

What it proves16 controls across 11 frameworks

Satisfied through its capabilities, not claimed by the vendor.

SSDF 1.13 / 42PW.7.1 PW.7.2 RV.1.2
ASVS 5.02 / 17V1 V5
CSF 2.02 / 106ID.RA-01 PR.PS-06
SAMM 2.02 / 90V-ST-1-A V-ST-2-A
CIS Controls1 / 18CIS 16
CNAS Top 101 / 10CNAS-2
CRA1 / 41Annex I Part II (3)
DSOMM1 / 19TV-Static-Depth-Applications
OWASP Top 101 / 10A05:2025
SP 800-204D1 / 11204D-CI-COMMIT
Scorecard1 / 20SAST

What it stops2 techniques · 1 risk

2 techniques countered, 2 of them common

Exploit Public-Facing ApplicationT1190Very Common
Injection ExploitationVery Common

1 risks reduced

Exploitable flaw in first-party application codeHigh

Where it runs2 phases · 2 ways to deploy

Capabilities per lifecycle phase

Code2
Build1

How it is delivered

CI/CD integrationSelf-hosted

What it unlocks2 activities · reaches level 2

Program activities its capabilities support, reaching level 2. Supporting an activity is not completing it.

Level 1

Run SAST on critical repositoriesLow effort

Level 2

Scan every pull request and block new high-confidence issuesLow effort

How it holds up11 criteria scored · 3 strengths · 4 limitations

Scored 0 to 5 against the evaluation criteria

Coverage from pre-commit to runtime3.4
Language, framework and ecosystem breadth3.4
Context-driven prioritization3.2
CI/CD and developer workflow integration3.6
APIs and extensibility3.9
Actionable remediation guidance3.5
Accuracy and noise4.3
Governance and compliance reporting4.2
AI capability maturity and AI security coverage2.8
Total cost and licensing fit2.9
Operational effort and skills required3.1

Strengths

Differential analysis on the developer desktop catches a defect before the commit rather than after the build
Strong C and C++ depth with MISRA AUTOSAR and CERT enforcement built for certification
Scales to very large codebases without a full reanalysis each run

Limitations

Six languages covered which is narrow outside its embedded niche
Self-hosted and CI only with no software-as-a-service option modeled
Little AI capability relative to the rest of the field
Quote-only pricing

Best for

Embedded C and C++ teams under functional safety standards
Very large codebases needing incremental analysis

Differentiators

Desktop differential analysis
Certification-grade standards enforcement

Organization size it suits

Embedded and systems engineering organizations with certification obligations

What it costs2 tiers · Platform enterprise agreement

LicensingPlatform enterprise agreement

Priced perannual contract

BillingSubscription

Scales withNegotiated scope (developers, assets, modules)

EnterpriseContact salesAnnual
Planning estimateestimate$850contributing developer/year · Annual

Total cost

Opaque list pricing; benchmark with peers and require clear overage terms.

What it takes to runStaffing, standing it up, and what it promises

Compliance reporting

MISRAAUTOSARCERTISO 26262CWE

What it works with6 languages

Languages

C and C++C# and .NETJavaJavaScript and TypeScriptKotlinPython

What else to look at

No alternative, competitor or family sibling is modeled for it.

What backs this up

No measurement, incident or pipeline using it.

Gantry 7.1.0 · OFF.12 · OFF.13