How do you or your organization use this solution?
Please share with us so that your peers can learn from your experiences.
The primary use that we have for Checkmarx is the evaluation of source code vulnerabilities. We use Git to connect to Checkmarx. We don't use GitHub. We use our own self-hosted Git. We're just using generic Git. One of the biggest thorns in our side is managing that aspect of it. It wouldn't matter if it was GitHub or Bitbucket or any of the other tools that you can use to connect Git to Checkmarx. The issue is the same. The tool is good at telling us what repository we're connected to, but it is horrible in telling us what branch we're connected to.
Our primary use case for this solution is SAST, Static Application Security Testing.
My team uses this product extensively for application vulnerability assessment. This solution is for static application security testing and is used within our software development process. As the software developers are creating solutions, they are able to identify vulnerabilities while the application is being written, rather than after the entire development is over. We were interested in having the raw source code scanned, so that was the primary requirement and that is where Checkmarx comes in. We do not need any precompiled libraries, or compiled source code, to be checked by the source code analysis solution. We have a security team that uses this product to scan source code, rather than have the developers handle it. We do not have any developer licenses (i.e. the SDLC Edition). Instead, the security team identifies the vulnerabilities and shares the report with the development team.
We use Checkmarx to review the source code for the external applications that we expose to the cloud or other servers on the internet.
Code scan. We performed periodic static code scans on copies of our Git repository to identify possible vulnerabilities.
Our primary use case solution is for code scanning.