We performed a comparison between Checkmarx One and Sucuri based on real PeerSpot user reviews.
Find out in this report how the two Application Security Tools solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI."The solution has good performance, it is able to compute in 10 to 15 minutes."
"From my point of view, it is the best product on the market."
"The main advantage of this solution is its centralized reporting functionality, which lets us track issues, then see and report on the priorities via a web portal."
"The product's most valuable feature is static code and supply chain effect analysis. It provides a lot of visibility."
"It allows for SAST scanning of uncompiled code. Further, it natively integrates with all key repos formats (Git, TFS, SVN, Perforce, etc)."
"Overall, the ability to find vulnerabilities in the code is better than the tool that we were using before."
"Most valuable features include: ease of use, dashboard. interface and the ability to report."
"The most valuable features of Checkmarx are the SCA module and the code-checking module. Additionally, the solutions are explanatory and helpful."
"The most valuable part is the analytics and visualization."
"It significantly eases the workload and streamlines the initial setup required to protect a website."
"The initial setup was straightforward. Straight forward because the plugin can simply be installed and then it does its job. It's not complex, there is no learning curve. The online scan is simple, you put in the website address and the scan gives us a report on the browser itself. It's simple to use."
"I use it as a WAF, which is basically a web firewall to monitor and block traffic to our web server."
"Domain name scanning since it allows us to scan all our domain names and determine whether it has malware or if is reported as phishing."
"The initial setup was very easy."
"It is an expensive solution."
"I think the CxAudit tool has room for improvement. At the beginning you can choose a scan of a project, but in any event the project must be scanned again (wasting time)."
"We are trying to find out if there is a way to identify the run-time null values. I am analyzing different tools to check if there is any tool that supports run-time null value identification, but I don't think any of the tools in the market currently supports this feature. It would be helpful if Checkmarx can identify and throw an exception for a null value at the run time. It would make things a lot easier if there is a way for Checkmarx to identify nullable fields or hard-coded values in the code. The accessibility for customized Checkmarx rules is currently limited and should be improved. In addition, it would be great if Checkmarx can do static code and dynamic code validation. It does a lot of security-related scanning, and it should also do static code and dynamic code validation. Currently, for security-related validation, we are using Checkmarx, and for static code and dynamic code validation, we are using some other tools. We are spending money on different tools. We can pay a little extra money and use Checkmarx for everything."
"They should make it more container-friendly and optimized for the CI pipeline. They should make it a little less heavy. Right now, it requires a SQL database, and the way the tool works is that it has an engine and then it has an analysis database in which it stores the information. So, it is pretty heavy from that perspective because you have to have a full SQL Server. They're working on something called Checkmarx Light, which is a slim-down version. They haven't released it yet, but that's what we need. There should be something a little more slimmed down that can just run the analysis and output the results in a format that's readable as opposed to having a full, really big, and thick deployment with a full database server."
"Checkmarx could improve the REST APIs by including automation."
"The statistics module has a function that allows you to show some statistics, but I think it's limited. Maybe it needs more information."
"C, C++, VB and T-SQL are not supported by this product. Although, C and C++ were advertised as being supported."
"The product's reporting feature could be better. The feature works well for developers, but reports generated to be shared with external parties are poor, it lacks the details one gets when viewing the results directly from the Checkmarx One platform."
"Sucuri could provide help for specific security alerts in-line instead of requiring users to search for it in the help section."
"Confident score: Currently it does not have one and there are cases that most websites flagged are false-positives."
"I would rate this solution an eight out of ten. The reason is that we have found sometimes customers or Google saying that there is something wrong with the website but Sucuri says that the site is clean so we do have to look at the site manually which means that the Sucuri scan does not pick up anything and everything."
"The main improvement I would like to see is support for .NET applications. If they could include this feature, I would include more sites in the protection."
"In terms of improvement, the cost factor is always there."
"It would greatly benefit customers if they implemented an online chat or messaging system for quicker assistance."
Checkmarx One is ranked 3rd in Application Security Tools with 67 reviews while Sucuri is ranked 12th in Domain Name System (DNS) Security with 6 reviews. Checkmarx One is rated 7.6, while Sucuri is rated 8.4. The top reviewer of Checkmarx One writes "The report function is a great, configurable asset but sometimes yields false positives". On the other hand, the top reviewer of Sucuri writes "Simple solution and good WAF". Checkmarx One is most compared with SonarQube, Veracode, Fortify on Demand, Snyk and Coverity, whereas Sucuri is most compared with Cloudflare, AWS WAF, SiteLock, Comodo cWatch and StackPath WAF. See our Checkmarx One vs. Sucuri report.
We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
