Checkmarx
Agentic application security platform combining hybrid scanning, AI agents and unified risk intelligence across the SDLC.
By Checkmarx Ltd. · HQ Atlanta, US · 4.7/5 Value-Position score (estimate)
Positioning guardrails
Best for
- Enterprises with large developer fleets that need SAST, SCA, DAST and container security from one AppSec platform
- Security teams consolidating siloed AppSec point tools into unified posture management and policy orchestration
- Organizations that must inventory and govern AI-generated code, models and MCP servers in their pipeline
- Regulated buyers needing documented records of findings, decisions, exceptions and approvals for audits
- Companies wanting SaaS or self-hosted/air-gapped deployment with 50+ native tool integrations
Ideal size: 50-500+ developers people · Mid-market to enterprise with a dedicated AppSec or product security team
Not for
- Teams that want transparent list pricing or a self-serve free trial before buying
- Small engineering teams with no dedicated AppSec owner to triage and remediate findings
- Buyers looking for a low-cost standalone linter rather than an enterprise platform
Value metrics scorecard
Time-to-Value
~4 weeks to first scans
~30 days to first production value
Total Cost of Ownership
On request
Custom quote only; no public list price. Package/module mix, SaaS vs self-hosted deployment and number of developers in scope drive the price.
Implementation Friction
4/5
Engineering + admin effort required
Value-Position score
out of 5 · model estimate
Full cost breakdown
Mandatory implementation fee
None
Seat tiers
No self-serve tiers. Packages: Essentials, Professional, Enterprise, plus 'Start with SAST' / 'Start with Supply Chain' and custom builds.
Add-on costs
- Add-on modules priced separately: Fusion, DAST, Container Security, IaC Security, Secrets Detection, Malicious Package Protection, Repository Health, Checkmarx Assist, Codebashing, AI Inventory
- Premium Support with 24/7 coverage and 2-hour P1 response time is a separately priced support tier
Company & support
Who is behind Checkmarx, and how your team gets help once it is live.
Company
- Founded
- Not recorded
- Headquarters
- Atlanta, US
How you get support
- PhoneNot listed
- EmailNot listed
- Live chatNot listed
- Support portal / ticketsPlan not stated
- Community forumNot listed
- Help centre / docsPlan not stated
- Dedicated account managerPlan not stated
- In person / on-siteNot listed
- Hours
- 24/7
- Response time
- Premium Support: P1 in 2 hours, P2 in 4 hours. Standard Support: P1 in 6 hours, P2 in 12 hours.
Standard Support covers working hours on business days; Premium Support adds 24/7 coverage, an escalation manager and personalized customer success.
“Not listed” means the vendor’s public pages don’t mention that channel, not that it is unavailable. Ask about it during evaluation.
Market position
Where Checkmarx sits against its closest alternatives. Pick any two of cost, speed, friction and buyer score, and up to 9 companies to compare.
Quadrant view
Typical annual cost × Time-to-value
The lines cross at the median of the solutions shown, so about half sit on each side of each line.
Companies on the chart 6 / 10
- Checkmarx
- Shift Technology
- Cynet
- Alloy
- RegScale
- Diligent
Add or change companies
Up to 10 companies including Checkmarx. Listed closest first.
Stack fit signal
Compatibility with standard B2B ecosystems.
No supported MCP path today, so it cannot be driven from an AI client.
AI & MCP readiness
What Checkmarx ships in AI, and what it asks of your ecosystem.
AI features shipped
Assist agent family (Developer Assist, Triage Assist, Remediation Assist) plus AI supply-chain security (AI Inventory, LLM Scanner, MCP Scanner coming soon). Fusion pairs rules-based scanning with Anthropic's frontier AI.
In your ecosystem
- AI connection
- Not supported
- Model key
- Vendor's key
- AI usage audit
- Not recorded
Compliance attestations
* IAPP AIGP certifies individuals, not products. It means named staff hold the credential — not that the platform does.
Bottom line
Checkmarx is an enterprise application security platform. Covers SAST, SCA, DAST, IaC, secrets, container and API security plus AI supply-chain security. Checkmarx positions around agentic security for AI-generated code, with Assist agents for triage, merge-ready fixes and MCP access. 1,800+ enterprise customers; SOC 2 Type II and ISO 27001 certified. Pricing is custom-quoted by module, deployment model and developer count, so budget for an enterprise sales cycle and real onboarding effort.
Frequently asked questions
How is Checkmarx priced?
Checkmarx One is custom quoted. Price depends on the modules you need (SAST, SCA, DAST, API, container and more), whether you deploy SaaS or self-hosted, and the number of developers in scope. There is no public list price and no self-serve free trial; Checkmarx says most quotes come back within one business day.
What is the difference between Essentials, Professional and Enterprise?
Essentials covers SAST, SCA, API Security and ASPM. Professional adds malicious package protection, repository health, DAST and container security. Enterprise adds IaC security, secrets detection and Codebashing, aimed at the most demanding compliance requirements. Fusion, Checkmarx Assist and AI Inventory remain add-ons across packages.
Does Checkmarx support MCP and AI-generated code?
Yes. Checkmarx documents a Checkmarx MCP capability for agent and platform access, an Assist family of agents (Developer Assist, Triage Assist, Remediation Assist), and AI supply-chain security including AI Inventory and LLM scanning. MCP server scanning and skills scanning are listed as coming soon.
What support comes with a Checkmarx subscription?
Standard Support covers working hours on business days, with P1 response in 6 hours and P2 in 12 hours. Premium Support adds 24/7 coverage, P1 response within 2 hours, an escalation manager, periodic business reviews, environment reviews and personalized customer success.
Can Checkmarx be deployed self-hosted or air-gapped?
Yes. Checkmarx One runs as a cloud SaaS platform, and Checkmarx supports self-hosted and on-premises deployment for teams with data residency, air-gapped or regulatory requirements. Your deployment model is factored into the quote.