Checkmarx SAST
Checkmarx SAST: Broad source analysis with custom queries and remediation guidance for enterprise teams. Ranked #1 of 25 in Static Application Security Testing Sast by our editors (9.3/10); pricing: Pricing on request; best for enterprise teams needing broad SAST coverage.
At a glance
- Editor score9.3 / 10
- PricingPricing on request
- Best forEnterprise teams needing broad SAST coverage
- Facts checked22 Sep 2026
Where it wins
- Analyzes source code and data flows without requiring compilation
- Supports custom security queries, vulnerability triage, and fix guidance
- Connects with major CI/CD services and IDEs, including GitHub and VS Code
Where it doesn't
- Pricing requires a custom sales quote
- Static analysis does not include software composition analysis
- Hybrid deployment and query customization may exceed smaller teams' needs
Our verdict on Checkmarx SAST
Checkmarx SAST analyzes application source code for security vulnerabilities, compliance issues, and business-logic flaws. It is aimed at enterprise and mid-market teams that need security analysis in development workflows, including teams that want to tailor checks to their own requirements. Analysis does not require compilation: the product builds a logical view of code elements and data flows, then presents findings in reports or an interactive interface.
Its core strength is configurable analysis and follow-through. Teams can use preconfigured security queries or author and edit custom queries, then track and triage vulnerabilities. Remediation guidance includes best-fix-location analysis, while custom reports and security insights support review. Scheduled and incremental scans are available. The product is offered on-premises as CxSAST and through the cloud-native Checkmarx One platform, giving organizations cloud and self-hosted deployment options. This breadth is relevant for teams that need to fit SAST into established environments, but query customization and deployment choices may be more than a small team seeking simple code checks needs.
Workflow coverage includes integrations with GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, TeamCity, GitHub Actions, CircleCI, AWS CodeBuild, SonarQube, VS Code, and JetBrains. CI/CD and IDE integrations are central to its fit for teams embedding scans in development and delivery processes. According to the vendor's pricing page, access is quote-based rather than publicly priced, so buyers should expect to discuss requirements with sales. SAST does not include software composition analysis; organizations needing dependency analysis alongside source-code scanning should assess a separate product or a broader alternative. Checkmarx SAST suits larger teams prioritizing configurable source analysis and workflow integration, less so buyers seeking public, straightforward pricing or bundled SCA.
Your product? Our editors can test Checkmarx SAST in depth and publish a review, labelled as paid · from $149/mo →
Checkmarx SAST pricing
Checkmarx SAST fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Not verified |
| Languages supported | Not verified |
| IDE integration | Not verified |
| CI/CD integration | Not verified |
| Deployment | Not verified |
| Custom rules | Not verified |
| Pull request scanning | Not verified |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Windows, Linux |
| Compliance & security | SOC 2 |
| Support | Docs, Tickets |
| Built for | Enterprise, Mid-market (editorial estimate) |
| Integrations | 40+ integrations: GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, TeamCity … See all → |
| Pricing | Pricing on request (source) |
| Website | checkmarx.com |
| Facts checked | 22 Sep 2026 |
Checkmarx SAST integrations
Checkmarx SAST lists 40+ integrations on its own site — the 20 named here are the ones its pages call out.
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Jenkins
- TeamCity
- GitHub Actions
- Maven
- CircleCI
- GitLab CI
- Bamboo
- AWS CodeBuild
- SonarQube
- VS Code
- JetBrains
- IntelliJ
- Visual Studio
- Eclipse
- Jira
- GitHub Issues
See all Checkmarx SAST integrations →
Alternatives to Checkmarx SAST
- Snyk CodeSource-code scanning across IDEs, pull requests and CI/CD, with a free entry tier.9.1
- OpenText Fortify SASTBroad SAST coverage with pull-request scans, custom rules, and AI-assisted fixes.8.9
- CodeSonarWhole-program code and binary analysis for teams with complex, high-integrity software.8.8
See all Checkmarx SAST alternatives →
Checkmarx SAST vs the competition
- Checkmarx SAST vs Snyk Code
- Checkmarx SAST vs OpenText Fortify SAST
- Checkmarx SAST vs CodeSonar
- Checkmarx SAST vs Klocwork
- Checkmarx SAST vs GitHub CodeQL
- Checkmarx SAST vs Semgrep Code
Compare Checkmarx SAST with any tool side by side →
Also Ranked In
Checkmarx SAST is ranked in 2 of our directories.
Used Checkmarx SAST? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used Checkmarx SAST for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
Checkmarx SAST is listed in our Static Application Security Testing Sast directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/checkmarx-sast/"><img src="https://www.itechguides.com/best/badge/checkmarx-sast.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update