GitHub CodeQL vs Checkmarx One

GitHub CodeQL9.0Visit Checkmarx One8.1Visit

Higher score GitHub CodeQL #3 in SAST Tools 9.0/10 Free plan Free plan✓ 5 of 5 features Visit GitHub CodeQL

vs

Checkmarx One #10 in SAST Tools 8.1/10 Pricing on request ✓ 5 of 5 features Visit Checkmarx

• GitHub CodeQL fits best

  GitHub-centric development teams

• Checkmarx One fits best

  Enterprise security programs

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Side by side

Feature	GitHub CodeQL 9.0/10 Visit ↗	Checkmarx One 8.1/10 Visit ↗
At a glance
Editor score	9.0	8.1
Ranking	#3 in SAST Tools	#10 in SAST Tools
Best for	GitHub-centric development teams	Enterprise security programs
Pricing model	Free plan + paid	Paid
Starting price	$30/user/mo	Pricing on request
Free plan	✓ (best)	—
Free trial	—	—
Deployment	Cloud, Desktop	Cloud
Platforms	Web, Windows, macOS, Linux	Web
Support	Docs	Docs
Integrations	4 integrations	17 integrations
Built for	Small business, Mid-market, Enterprise	Enterprise
Features GitHub CodeQL 5/5 · Checkmarx One 5/5
Pull request scans	✓	✓
IDE support	✓	✓
CI/CD integration	✓	✓
Custom security rules	✓	✓
Automated fixes	✓	✓
Specs
Analysis targets	source code	source code
Languages supported	11	Not checked yet
Our review
Pros	Semantic queries detect vulnerabilities and coding errors. Pull-request, GitHub Actions, and external CI scanning. Custom queries and SARIF support for tailored analysis.	Scans source code across multiple languages and frameworks Supports pull-request, push, CI/CD, CLI, and IDE workflows Adds custom queries, centralized triage, and AI remediation guidance
Cons	Private-repository scanning requires paid GitHub Code Security. Paid pricing is based on unique active committers. The feature set is centered on source-code analysis.	Pricing requires a custom quote through contact sales Its broad AppSec scope may exceed narrow SAST needs No permanent free Checkmarx One tier
Our verdict	GitHub CodeQL is a semantic static-analysis engine for finding security vulnerabilities, coding errors, and other issues in source code. It represents code as data and queries that representation, giving development and security teams a… Read the review →	Checkmarx One is a cloud-delivered application security platform for enterprise development and security teams. Its SAST capabilities analyze source code across multiple programming languages and frameworks, while the wider platform also… Read the review →

Strengths and trade-offs

• GitHub CodeQL — where it wins

  • Semantic queries detect vulnerabilities and coding errors.
  • Pull-request, GitHub Actions, and external CI scanning.
  • Custom queries and SARIF support for tailored analysis.

  Where it doesn't

  • Private-repository scanning requires paid GitHub Code Security.
  • Paid pricing is based on unique active committers.
  • The feature set is centered on source-code analysis.

• Checkmarx One — where it wins

  • Scans source code across multiple languages and frameworks
  • Supports pull-request, push, CI/CD, CLI, and IDE workflows
  • Adds custom queries, centralized triage, and AI remediation guidance

  Where it doesn't

  • Pricing requires a custom quote through contact sales
  • Its broad AppSec scope may exceed narrow SAST needs
  • No permanent free Checkmarx One tier

• GitHub CodeQL9.0/10 · Free plan

  Deep SAST for GitHub workflows, with free public-repository scanning.

  Visit GitHub CodeQLFull verdict →
• Checkmarx One8.1/10 · Pricing on request

  Enterprise SAST with broad integrations, custom queries, centralized triage, and AI guidance.

  Visit CheckmarxFull verdict →