Global Tool Radar

Security & Privacy / Application Security Testing Software

Checkmarx One Review, Pricing, Pros & Cons

Checkmarx One is an enterprise application security platform that combines configurable SAST, SCA, API security, DAST, IaC, container, supply-chain, runtime, ASPM, and AI-assisted remediation capabilities in shared developer and governance workflows.

Research by Global Tool Radar Research SystemEvidence checked: Aug 10, 2026AI-assisted · No Global Tool Radar hands-on testView research methodology
Visit product websiteChoose similar tools to compare

Buying snapshot

Quick buying snapshot

A compact view of who this tool fits, what it costs, and what to confirm before choosing it.

Best for
  • The AppSec program wants one risk and governance layer across multiple testing engines: Checkmarx One correlates proprietary and imported findings in ASPM, applies business, exploitability, reachability, exposure, and runtime context, and supports policy-driven remediation workflows.
  • Security needs to be embedded in developer repositories, pull requests, IDEs, and CI/CD: The platform provides repository webhooks, dedicated CI/CD and IDE plugins, CLI access, pull-request decoration, policy gates, and feedback integrations.
More buying conditions
  • Deployment must accommodate SaaS, dedicated, self-hosted, on-premises, or air-gapped requirements: Checkmarx publishes SaaS and self-hosted or on-premises deployment support and explicitly includes air-gapped and regulatory requirements in quote scoping.
Not for
  • The buyer needs public list prices or a self-service platform evaluation: All three core plans require custom quotes, and Checkmarx explicitly says it does not offer a self-serve Checkmarx One platform trial.
  • The team expects every scanner and AI agent in the base plan: Capabilities vary across the three plans, the custom builder treats many scanners as add-on modules, and the Assist agents are separately described as optional add-ons.
More buying conditions
  • Repositories exceed published scan-size limits without a validated segmentation strategy: Checkmarx documents 22 million lines of code for repository or ZIP scans and 5.5 million lines of code for IaC Security.
Pricing
  • Three custom-quoted core packages with final price based on selected modules, deployment model, and developers in scope
  • Essentials · Requires quote · custom quote
Free or trial access
  • No permanent free Checkmarx One plan and no self-serve Checkmarx One platform trial are published. A personalized demo is available; the separate one-month Developer Assist trial is excluded from the core plan ladder.

Product scope

Product functionality and purchase scope

The review covers the current Checkmarx One core plan ladder, shared ASPM and developer workflows, included and plan-dependent scanners, configurable deployment, and optional modules that materially affect the buying decision.

Product checked: Aug 10, 2026

Functionality reviewed
  • Essentials, Professional, and Enterprise core plans
  • SAST, SCA, API Security, DAST, IaC Security, Container Security, Supply Chain Security, Runtime Protection, and ASPM when included in a core plan
  • Secrets Detection and Checkmarx One Assist only as optional Checkmarx One capabilities
  • SaaS, self-hosted, on-premises, and air-gapped Checkmarx One deployment options
  • AWS Marketplace only as an alternative procurement route
Non-target functionality excluded from scoring
  • Custom Package Builder and By Security Area configurations as plan names
  • Developer Assist standalone plan and one-month trial
  • Checkmarx Zero Malicious Package Intelligence API standalone solution
  • Legacy Checkmarx SAST on-premises product and migration tooling
  • Codebashing secure-code training, Premium Support, professional services, and managed services
  • IAST, manual penetration testing, and human finding-validation services not stated as Checkmarx One testing modalities
Purchase paths

Pricing checked: Aug 10, 2026

  • Checkmarx One Custom Package Builder: A configurable direct-sales route that starts with the Checkmarx One platform and required SAST, then adds selected scanners, agents, and governance scope. It is not a fourth plan.
  • AWS Marketplace: An alternative procurement route for Checkmarx One through AWS Marketplace; no route-specific public numeric offer is retained.

Pricing plans

Checkmarx One pricing table

Pricing checked: Aug 10, 2026

Official factConfidence 99%2 linked sources

Essentials, Professional, and Enterprise are sales-quoted. Essentials provides the core SAST, SCA, API Security, ASPM visibility, and reporting foundation; Professional adds deeper dynamic, IaC, AI, ASPM, and pull-request coverage; Enterprise adds supply-chain, container, runtime, custom-policy, and executive-reporting scope. Final coverage remains tailored, and optional modules, deployment, developer count, apps, and usage can affect the quote.

Official pricing page
PlanPriceBest for
EssentialsCheckmarx One Essentials
  • Requires quote · custom quote
Organizations establishing a centralized AppSec foundation across proprietary code, open-source dependencies, APIs, risk visibility, and core reporting.
ProfessionalCheckmarx One Professional
  • Requires quote · custom quote
Scaling AppSec programs that need the Essentials foundation plus dynamic testing, IaC coverage, AI-assisted security, advanced ASPM, and pull-request feedback.
EnterpriseCheckmarx One Enterprise
  • Requires quote · custom quote
Large or regulated organizations requiring the broadest published testing coverage, runtime and supply-chain context, custom policies, and executive reporting.

Plan upgrade triggers

Verified plan boundaries that can change the required edition.

Essentials Professional

The program wants DAST, IaC Security, AI Security, advanced ASPM, and pull-request decorations included together rather than tailoring the Essentials quote with selected add-ons.

Supporting pricing evidence
Professional Enterprise

The organization wants Supply Chain Security, Container Security, Runtime Protection, custom policies, and executive reporting included together rather than tailoring Professional with selected add-ons.

Supporting pricing evidence
What is included, connected, or sold separately

Product scope

What is included, connected, or sold separately

Material capabilities are separated by their verified relationship to the target product.

AI Security included from Professional with an Essentials add-on routeRelationship not verified

The core ladder includes a broad AI Security label in Professional and Enterprise and shows an Essentials add-on state. It does not establish that every separately priced Assist agent is included.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx AI Security
Official source
Container Security included in Enterprise with lower-plan add-on routesRelationship not verified

Enterprise explicitly includes Container Security. The pricing FAQ says packages can add Container Security, so lower plans are optional rather than unavailable.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx Container Security
Official source
DAST included from Professional with an Essentials add-on routeRelationship not verified

The core plan ladder includes DAST in Professional and Enterprise. The pricing FAQ says packages can add DAST as a module, so Essentials is optional rather than unavailable.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx DAST
Official source
Developer, Triage, Remediation, and MCP Assist agentsRelationship not verified

The current packaging page states that all agents are optional add-ons; the broad Professional AI Security label is not used to infer each agent's inclusion.

Checkmarx One Assist
Official source
IaC Security included from Professional with an Essentials add-on routeRelationship not verified

The core plan card includes IaC Security in Professional and Enterprise; the comparison and custom configuration route identify lower-package add-on availability.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx IaC Security
Official source
Premium Support, professional services, and managed servicesRelationship not verified

These are separate support and service purchases rather than Checkmarx One testing plans or included platform capabilities.

Checkmarx Premium Support and Services
Official source
Runtime Protection in EnterpriseRelationship not verified

Enterprise explicitly includes Runtime Protection. The public core-plan evidence does not establish a lower-plan add-on state, and the exact runtime components and usage terms remain quote-dependent.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx Runtime Protection
Official source
SAST, SCA, and API Security across all three core plansRelationship not verified

Essentials lists all three capabilities, and Professional and Enterprise explicitly inherit the lower plan.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verified
Official source
Secrets Detection as a configurable add-on moduleRelationship not verified

The current custom builder calls Secrets Detection an add-on module, but the named core plan cards do not map it by plan.

Checkmarx Secrets Detection
Official source
Supply Chain Security included in Enterprise with lower-plan add-on routesRelationship not verified

Enterprise explicitly includes Supply Chain Security. The pricing FAQ says packages can add Software Supply Chain Security, so lower plans are optional rather than unavailable.

Plan: Essentials: Not verified · Professional: Not verified · Enterprise: Not verifiedCheckmarx Supply Chain Security
Official source
How the score is calculated

Scoring method

How the score is calculated

The score uses the category-specific buying dimensions below and their displayed weights.

This page is based on public product information, official sources, structured feature data, and multi-model AI evaluation. It is not a hands-on lab test unless explicitly stated. Confidence percentages describe our research indicators, not the probability that a claim is true or a measured accuracy rate.

Evidence confidence
76%
AI claim confidence
99%
Required-field evidence status
100%
Evidence freshness
54%
Field traceability
100%
Model agreement
95%
Why this confidence level
  • Evidence confidence uses source level and claim-to-source support; AI claim confidence is shown separately.
  • Required-field evidence status measures whether weighted required claims have evidence links; it does not mean every product behavior was independently verified.
  • 8 of 8 weighted claims have evidence links.
  • 0 A1 documentary official sources and 21 A2 official product sources are linked.
  • 1 independent review sources are retained, including 0 professional sources with an explicit hands-on method.
  • 4 weighted claims are past the review window.
  • No blocking evidence conflict was identified.
Accuracy and validation18%
72

The facts support prioritization context and AI-assisted triage, but they do not establish manual validation, IAST, or other explicit verification workflows as verified testing modalities.

Testing scope and depth18%
85

Broad coverage options span proprietary and open-source ecosystems, but the specific operational scope must be reconciled during procurement based on plan boundaries.

Developer workflow15%
81

Repository, IDE, pull-request, CI/CD, CLI, and feedback integrations let AST findings reach developers in their working tools, although the exact experience can vary by module and deployment.

Remediation quality14%
74

AI-assisted triage and review-ready remediation pull requests where supported indicate remediation help, but the supplied facts do not show that every finding gets automated fix generation or the same remediation depth.

Risk prioritization13%
82

ASPM capabilities leverage multi-layered context, including runtime and exposure data, to establish risk importance, though access to this contextual metadata varies by purchased tier.

Governance and integrations12%
81

Strong foundational governance is enabled through SBOM generation, incident reports, and policy gates, but custom policy enforcement is unavailable below the Enterprise edition.

Support and total cost10%
53

All core plans require custom quotes with price driven by modules, deployment, developers, apps, and usage, and Premium Support plus professional or managed services sit as separate commercial decisions, leaving total cost opaque before negotiation.

Public review signals

Checkmarx One has favorable exact-product enterprise review coverage

The exact Checkmarx One Gartner profile is favorable. Review material commonly values broad AppSec operations, repository and CI/CD integration, ASPM visibility, remediation guidance, customizable queries, onboarding, and account support. Recurring cautions include interface complexity, setup and policy learning, finding triage, scan duration on large codebases, and pricing transparency or affordability.

Public review signals updated: Aug 10, 2026

Commonly reported strengths

  • Broad AppSec testing and centralized risk visibility
  • Repository, IDE, pull-request, and CI/CD workflow integration
  • Actionable remediation guidance, query customization, and responsive account support

Commonly reported concerns

  • Interface and configuration learning curve
  • Finding noise or triage effort in some workloads
  • Longer scans on large codebases and limited public pricing
Gartner Peer Insights4.4/5
Rating count
93 ratings
Source context
Checkmarx One in Application Security Testing on Gartner Peer InsightsExact product
View sourceHistory baseline established: Aug 10, 2026

Marketplace app signals

Marketplace app signals

These source-reported ratings describe a specific marketplace listing, integration, mobile app, or add-on. They do not automatically represent the complete software product.

AWS Marketplace4.2/5
Rating count
68 ratings
Evaluated scope
Full product listing
Storefront
AWS Marketplace
View source
Score76
Pricing modelThree custom-quoted core packages with final price based on selected modules, deployment model, and developers in scope
Use casetest, prioritize, remediate, and govern application risk across proprietary code, open-source dependencies, APIs, infrastructure definitions, containers, software supply chains, and running applications
Company sizeEnterprise, Mid-market
Structured tags

Checkmarx One tag profile

Company size
  • Enterprise
  • Mid-market
Key features

Checkmarx One core capabilities

  • Three-tier AppSec platform spanning SAST, SCA, API Security, DAST, IaC, supply-chain, container, and runtime coverage by plan
  • ASPM correlation with exploitability, reachability, exposure, runtime, and business-criticality context
  • Repository, IDE, pull-request, CI/CD, CLI, feedback, and cloud integrations
  • Policy gates, custom policies, incident reports, SBOM output, audit reporting, and executive reporting
  • AI-assisted triage and review-ready remediation pull requests where supported
  • SaaS, single-tenant, self-hosted, on-premises, and air-gapped deployment options
Detailed strengths and purchase cautions
Pros

Why it is worth considering

  • Plan ladder covers proprietary code, open-source dependencies, and APIs on Essentials, then adds dynamic testing, IaC, AI-assisted security, advanced ASPM, and pull-request feedback on Professional, with supply-chain, container, runtime, custom-policy, and executive-reporting scope on Enterprise.
  • ASPM correlation can combine exploitability, reachability, exposure, runtime, and business-criticality context so security and engineering teams can rank findings beyond raw severity.
  • Repository, IDE, pull-request, CI/CD, CLI, feedback, and cloud integrations support embedding scans and results into existing developer delivery paths.
  • Policy gates, SBOM output, incident and audit reporting, plus Enterprise custom policies and executive reporting, support release controls and evidence needs in regulated programs.
Cons

What to confirm before buying

  • No public numeric price, minimum purchase, payment schedule, commitment term, renewal rule, or implementation amount is published, so total cost and commercial terms stay unknown until quote negotiation.
  • Final coverage is tailored, so buyers must reconcile the plan card with the order form and any optional modules rather than treating the named edition alone as the entitlement boundary.
  • The Professional AI Security label does not publicly prove inclusion of every separately described Checkmarx One Assist agent, which can remain optional add-ons.
  • Repository or ZIP scans and IaC Security carry published 22 million and 5.5 million line-of-code limits respectively, which can constrain very large monorepos or IaC estates.
Cross-model buying perspectives

Multi-AI review

Cross-model buying perspectives

Multiple AI models assess this tool against the same buying criteria, so you can compare scores, confidence, fit, cautions, and final views.

AI assessment updated: Sep 22, 2026

Score comparisonGeminiGPTxAIRange
Accuracy and validation78696810
Testing scope and depth8587834
Developer workflow8281811
Remediation quality7574741
Risk prioritization8379845
Governance and integrations8084795
Support and total cost58485210
appsec testing coverage depth8588844
appsec finding accuracy prioritization8077783
appsec developer workflow fit8280822
appsec policy release governance7883805
appsec program visibility8082766
Where models differ
  • Accuracy and validation: 68–78 (10-point range)
  • Support and total cost: 48–58 (10-point range)
  • appsec program visibility: 76–82 (6-point range)
GeminiAI-assisted buyer perspective79

Checkmarx One offers a multi-tier enterprise application security testing platform spanning static, dynamic, open-source, API, and runtime security, but buyers must manage custom-quoted pricing structures, plan-specific functional boundaries, and strict scan line-of-code limits.

Review confidence
79/100
Model details
Strengths
  • The platform provides tiered security coverage spanning SAST, SCA, and API Security in the base Essentials tier, with options to scale to IaC, DAST, supply-chain, container, and runtime security on higher tiers.
  • It supports diverse hosting models including SaaS, single-tenant, self-hosted, on-premises, and air-gapped environments to accommodate restrictive data security guidelines.
  • ASPM correlation integrates vulnerability findings with exploitability, reachability, exposure, runtime data, and business-criticality context to streamline triage.
Cautions
  • The complete lack of public pricing transparency, permanent free platform plans, or self-serve platform trials requires direct coordination with sales for custom quoting.
  • Scans are subject to strict limits, capping repository or ZIP scans at 22 million lines of code and IaC Security at 5.5 million lines of code.
  • Key capabilities require plan upgrades or separate commercial commitments, including custom policies and executive reporting restricted to Enterprise, and AI Assist agents sold as optional add-ons.
GPTAI-assisted buyer perspective78

Checkmarx One fits organizations that want one quoted AppSec platform to combine testing, risk context, governance, and developer integrations across multiple deployment models. It is a weaker fit for buyers who need transparent self-serve pricing, a permanent free platform plan, or an unquoted buying path.

Review confidence
78/100
Model details
Strengths
  • It supports a broad AppSec program by spanning SAST, SCA, API Security, DAST, IaC, supply-chain, container, and runtime coverage across the plan ladder.
  • It adds governance-oriented controls such as policy gates, custom policies, incident reports, SBOM output, audit reporting, and executive reporting for teams that need evidence and oversight.
  • It includes developer workflow touchpoints through repository, IDE, pull-request, CI/CD, CLI, feedback, and cloud integrations for programs that want security feedback inside delivery tools.
  • It supports SaaS, single-tenant, self-hosted, on-premises, and air-gapped deployment options for buyers with hosting or data-residency requirements.
Cautions
  • All core plans are custom quoted, so buyers do not get published numeric pricing, a minimum purchase, a payment schedule, or a commitment term from the supplied facts.
  • The published package coverage is tailored during consultation, so the final entitlement set needs to be reconciled against the order form and any optional modules.
  • The public sources do not establish a permanent free platform plan or a self-serve Checkmarx One trial.
  • The Professional AI Security label does not publicly prove inclusion of every separately described Checkmarx One Assist agent.
xAIAI-assisted buyer perspective77

Checkmarx One fits mid-market and enterprise buyers consolidating multi-modal AppSec testing and governance when they can complete a tailored quote that maps Essentials, Professional, or Enterprise module scope, deployment model, and developer count to the order form.

Review confidence
77/100
Model details
Strengths
  • Plan ladder covers proprietary code, open-source dependencies, and APIs on Essentials, then adds dynamic testing, IaC, AI-assisted security, advanced ASPM, and pull-request feedback on Professional, with supply-chain, container, runtime, custom-policy, and executive-reporting scope on Enterprise.
  • ASPM correlation can combine exploitability, reachability, exposure, runtime, and business-criticality context so security and engineering teams can rank findings beyond raw severity.
  • Repository, IDE, pull-request, CI/CD, CLI, feedback, and cloud integrations support embedding scans and results into existing developer delivery paths.
  • Policy gates, SBOM output, incident and audit reporting, plus Enterprise custom policies and executive reporting, support release controls and evidence needs in regulated programs.
Cautions
  • No public numeric price, minimum purchase, payment schedule, commitment term, renewal rule, or implementation amount is published, so total cost and commercial terms stay unknown until quote negotiation.
  • Final coverage is tailored, so buyers must reconcile the plan card with the order form and any optional modules rather than treating the named edition alone as the entitlement boundary.
  • The Professional AI Security label does not publicly prove inclusion of every separately described Checkmarx One Assist agent, which can remain optional add-ons.
  • Repository or ZIP scans and IaC Security carry published 22 million and 5.5 million line-of-code limits respectively, which can constrain very large monorepos or IaC estates.

Research transparency

How this page was researched

A compact record of the evidence used, what was not tested, and which conclusions still need verification.

Official sources
21
Broad product review sources
1
Marketplace and app-store sources
1
Editorial sources
0
Latest evidence check
Aug 10, 2026
Research basis

Global Tool Radar generated this assessment from structured facts linked to public sources. No Global Tool Radar hands-on test is recorded in this page's research data. Any external hands-on assessment is identified separately and does not affect the Global Tool Radar score.

Conflict handling

No unresolved evidence conflict is currently recorded.

View research methodology
Verified findingsNo permanent free Checkmarx One plan and no self-serve Checkmarx One platform trial are published. A personalized demo is available; the separate one-month Developer Assist trial is excluded from the core plan ladder.
  • Three custom-quoted core packages with final price based on selected modules, deployment model, and developers in scope
  • Three-tier AppSec platform spanning SAST, SCA, API Security, DAST, IaC, supply-chain, container, and runtime coverage by plan ASPM correlation with exploitability, reachability, exposure, runtime, and business-criticality context Repository, IDE, pull-request, CI/CD, CLI, feedback, and cloud integrations Policy gates, custom policies, incident reports, SBOM output, audit reporting, and executive reporting AI-assisted triage and review-ready remediation pull requests where supported SaaS, single-tenant, self-hosted, on-premises, and air-gapped deployment options
  • Requires quote
  • Essentials, Professional, and Enterprise are sales-quoted. Essentials provides the core SAST, SCA, API Security, ASPM visibility, and reporting foundation; Professional adds deeper dynamic, IaC, AI, ASPM, and pull-request coverage; Enterprise adds supply-chain, container, runtime, custom-policy, and executive-reporting scope. Final coverage remains tailored, and optional modules, deployment, developer count, apps, and usage can affect the quote.
Verification notes and unresolved itemsThe current exact-product pricing page establishes Essentials, Professional, and Enterprise as the core plan ladder.
  • The separate packaging page is retained as a custom configuration route because it starts with the Checkmarx One foundation and required SAST, then marks scanners and agents as optional modules.
  • It is not treated as another plan, and its module labels are not used to override the named core plan cards.
  • The public pages do not establish numeric price, currency, priced unit, payment timing, minimum commitment, renewal terms, cancellation terms, minimum purchase, implementation amount, or route-specific AWS price for any core plan.
  • The Professional AI Security label is not assumed to include every Assist agent because the packaging page identifies all agents as optional add-ons.
Sources checked

Sources checked

Checkmarx One source links

Checkmarx SCA FAQCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Checkmarx One SBOM ReportsCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Single Tenant FlowCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
AI Triage and RemediationCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Cloud InsightsCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
API Security Scanner Supported Languages and FrameworksCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026
Checkmarx OneAmazon Web Services and CheckmarxLevel A2Linked to 4 scored claimsChecked Aug 10, 2026
Checkmarx and AWSCheckmarxLevel A2Linked to 0 scored claimsChecked Aug 10, 2026

FAQ

Checkmarx One FAQ

What are the current Checkmarx One core plans?

Essentials, Professional, and Enterprise. All are custom-quoted; the Custom Package Builder and security-area configurations are buying routes rather than additional core plans.

Does Checkmarx One publish numeric pricing?

No. Checkmarx says price depends on selected modules, deployment model, and developers in scope; the custom builder also identifies apps and usage as pricing inputs.

Is there a free Checkmarx One plan or self-serve trial?

No permanent free platform plan or self-serve Checkmarx One trial is published. Checkmarx offers a personalized demo. The separate Developer Assist product has a one-month trial and is not a core platform plan.

Which testing capabilities are included in Essentials?

The current plan card lists SAST, SCA, API Security, ASPM visibility, and core reporting. Final coverage is tailored during consultation.

Can Checkmarx One run outside a shared SaaS environment?

Yes. The current pricing FAQ states that Checkmarx supports SaaS, self-hosted, on-premises, and air-gapped requirements, with deployment factored into the quote.

Are the Checkmarx One Assist agents included with Professional AI Security?

The public core plan page lists AI Security in Professional, while the custom packaging page separately calls all Assist agents optional add-ons. The public sources do not bind every Assist agent to the Professional entitlement.

Popular comparisons

Common Checkmarx One comparisons

Only high-scoring and nearby tools from the same subcategory are shown, avoiding comparisons between unrelated use cases.

VS #1
Checkmarx OnevsBlack Duck Polaris Platform
76Gap 379

Enterprise / Mid-market

VS #2
Checkmarx OnevsVeracode Application Risk Management Platform
76Gap 480

Enterprise / Mid-market

VS #3
Checkmarx OnevsInvicti Platform
76Gap 581

Enterprise / Mid-market