Compare Checkmarx vs. Veracode
Sponsored
Use Accurics? Share your opinion.
 | Anonymous User Solution Manager at a computer software company |
| Anonymous User R&D Director at a computer software company |
Find out what your peers are saying about Checkmarx vs. Veracode and other solutions. Updated: January 2021.
465,058 professionals have used our research since 2012.
Quotes From Members
We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
Information Not Available
"We have a subscription license that is on a yearly basis, and it's a pretty competitive solution."
"This solution is expensive. The customized package allows you to buy additional users at any time."
"It's relatively expensive."
"The interface used to create custom rules comes at an additional cost."
"The number of users and coverage for languages will have an impact on the cost of the license."
"They just changed their pricing model two weeks ago. They went from a per-app license to a per-megabyte license. I know that the dynamic scan was $500 per app. Static analysis was about $4500 yearly. The license is only for the number of users, it doesn't matter what data you put in there. That was the old model. I do not know how the new model works."
"They have just streamlined the licensing and they have a number of flexible options available, so overall it is quite good, albeit pricey."
"For the value we get out of it, coupled with the live defect review sessions, we find it an effective value for the money. We are a larger organization."
"I don't really know about the pricing, but I'd say it's worth whatever Veracode is charging, because the solution is that good."
"Veracode's price is high. I would like them to better optimize their pricing."
"If I compare the pricing with other software tools, then it is quite competitive. Whatever the price is, they have always given us a good discount."
"Veracode is expensive. Some of its products are expensive. I don't think it's way more expensive than its competitors. The dynamic is definitely worth it, as I think it's cheaper than the competitors. The static scan is a little bit more expensive, around 20 percent more expensive. The manual pen test is more expensive, but it is an expensive service because it's a manual pen test and we also do retests. I don't think it is way more expensive than the competitors, but it's about 15 to 20 percent more expensive."
"We use this product per project rather than per developer... Your development model will really determine what the best fit is for you in terms of licensing, because of the project-based licensing. If you do a few projects, that's more attractive. If you have a large number of developers, that would also make the product a little more attractive."
Use our free recommendation engine to learn which Application Security solutions are best for your needs.
465,058 professionals have used our research since 2012.
| William Hayes User at Securities America |
See all 3 answers »
Ask a question
Earn 20 points
Top Answer: I would like to recommend Checkmarx. With Checkmarx, you are able to have an all in one solution for SAST and SCA as… more »
Top Answer: Veracode has offered a dynamic analysis testing solution for several years, having launched our first offering in 2015… more »
Top Answer: I’ve always viewed sonarqube as a code quality tool that compliments many code security tools like a checkmarx.
Compared 100% of the time.
Compared 44% of the time.
Compared 9% of the time.
Compared 3% of the time.
Compared 2% of the time.
Compared 2% of the time.
Compared 50% of the time.
Compared 6% of the time.
Compared 4% of the time.
Compared 3% of the time.
Compared 3% of the time.
At Accurics™, we envision a world where organizations can innovate in the cloud with confidence. Our mission is to enable cyber resilience through self-healing as organizations embrace cloud native infrastructure. The Accurics platform self-heals cloud native infrastructure by codifying security throughout the development lifecycle. It programmatically detects and resolves risks across Infrastructure as Code before infrastructure is provisioned, and maintains the secure posture in runtime by programmatically mitigating risks from changes. Accurics enables organizations of all sizes to achieve cloud cyber resilience through free cloud-based and open source tools such as Terrascan™.
Checkmarx CxSAST is a highly accurate and flexible Static Code Analysis product that allows organizations to automatically scan un-compiled / un-built code and identify hundreds of security vulnerabilities in all major coding languages. CxSAST is available as a standalone product and can be effectively integrated into the Software Development Lifecycle (SDLC) to streamline detection and remediation. CxSAST can be deployed on-premise in a private data center or hosted via a public cloud.
Veracode covers all your Application Security needs in one solution through a combination of five analysis types; static analysis, dynamic analysis, software composition analysis, interactive application security testing, and penetration testing. Unlike on-premise solutions that are hard to scale and focused on finding rather than fixing, Veracode comprises a unique combination of SaaS technology and on-demand expertise that enables DevSecOps through integration with your pipeline, and empowers developers to find and fix security defects.
Learn more about Accurics
Learn more about Checkmarx
Learn more about Veracode
Automation Anywhere, NBA, GroundTruth, ServiceMax, Navis, Edcast
YIT, Salesforce, Coca-Cola, SAP, U.S. Army, Liveperson, Playtech
Case Study: Liveperson Implements Innovative Secure SDLC
State of Missouri, Rekner
Computer Software Company28%
Comms Service Provider15%
Financial Services Firm14%
Energy/Utilities Company6%
Computer Software Company40%
Financial Services Firm27%
Engineering Company7%
Comms Service Provider7%
Computer Software Company34%
Comms Service Provider14%
Financial Services Firm14%
Insurance Company5%
Financial Services Firm32%
Insurance Company11%
Computer Software Company8%
Engineering Company5%
Computer Software Company34%
Comms Service Provider16%
Financial Services Firm9%
Manufacturing Company6%
No Data Available
Small Business30%
Midsize Enterprise20%
Large Enterprise50%
Small Business13%
Midsize Enterprise29%
Large Enterprise57%
Small Business22%
Midsize Enterprise25%
Large Enterprise53%
Small Business21%
Midsize Enterprise27%
Large Enterprise52%
Find out what your peers are saying about Checkmarx vs. Veracode and other solutions. Updated: January 2021.
465,058 professionals have used our research since 2012.
Checkmarx is ranked 4th in Application Security with 17 reviews while Veracode is ranked 2nd in Application Security with 21 reviews. Checkmarx is rated 8.2, while Veracode is rated 8.0. The top reviewer of Checkmarx writes "Works well with Windows servers but no Linux support and takes too long to scan files". On the other hand, the top reviewer of Veracode writes "Prevents vulnerable code from going into production, but the user interface is dated and needs considerable work". Checkmarx is most compared with SonarQube, Micro Focus Fortify on Demand, Coverity, Snyk and HCL AppScan, whereas Veracode is most compared with SonarQube, Micro Focus Fortify on Demand, Coverity, Klocwork and OWASP Zap. See our Checkmarx vs. Veracode report.
See our list of best Application Security vendors and best Application Security Testing (AST) vendors.
We monitor all Application Security reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
SonarQube depends on completely what you configure the Rules. You will have the option of the Profile creation and can be assigned to the Projects. If you configure the project --> under them services configuration it is good to go. Proper configuration is important in the Sonat Qube. Yes, Sonarqube allows developers to delint their code before SAST.
Veracode recently introduced it. But this integration at developer Machine integration available for only JAVA coded Projets.
About the Vulnerability coverage, both are the same. OWASP TOP 10 is equal to Sans 25. sans25 is categorized with one category number and describes under that subsection. Refer to this. https://www.templarbit.com/blog/2018/02/08/owasp-top-10-vs-sans-cwe-25/
SonarQube can be used for SAST. However, based on our internal analysis, our team feel CheckMarx is better suited for Security compared to SonarQube. SoanrQube is used in day to day developer code scan and Checkmarx is used during code movement to staging or during release.
My opinions are my own and do not represent any other entities that I may be or have been affiliated with.
On this topic I think it is important to acknowledge that no matter which solution you go for you will have false positives. I don't think there will be any solution that properly solves this anytime soon.
As for Checkmarx vs SonarQube...
Checkmarx may cover more rules over a wider landscape, however I personally found this extra breadth covered outlyer rules and mostly lower priority issues. Both Checkmarx and SonarQube cover the OWASP top 10 and Sans25.
Both tools can be tuned to help reduce false positives, for both you will need to analyse your tuning to ensure you are not introducing false negatives. Any tools that provide you customisation come with the risk that you could make things worse.
SonarQube has very good integration into most development IDEs empowering the engineers to run scans against the company rules on their local machine before submitting your source control and further tooling. In some it will even check the code automatically while you type it.
I see you also included Veracode in here. In my opinion that is a far superior tool to Checkmarx, this is down to their more modern approach to this problem. They also allow local developer integration to self lint code before submission.
In a perfect world, I would use Sonar for development bugs, test coverage and technical debt measurements. Then veracode to handle the SAST side for me. In short I would not duplicate the security scans in Sonar and Veracode.
Hope that helps