Suggestions appear as you type. Use the up and down arrows to choose one and Enter to open it.

This page's audience our own tag's counts — open to see them
–Visits
–Page views
–Clicks to vendors
–Time on page
–Reading now
Clicks to vendors, by tool
  • –
Top countries
  • –
Devices
  • –

– · visits, page views and clicks counted by our own tag, which counts more than our checked analytics; every figure rounded down · how we count

Checkmarx SAST review

#1 of 25 in Static Application Security Testing SastStatic Application Security Testing Software

Broad source analysis with custom queries and remediation guidance for enterprise teams.

9.3/10Editor score
Visit Checkmarx
Checkmarx SAST9.3 Visit Checkmarx

Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026

Checkmarx SAST analyzes application source code for security vulnerabilities, compliance issues, and business-logic flaws. It is aimed at enterprise and mid-market teams that need security analysis in development workflows, including teams that want to tailor checks to their own requirements. Analysis does not require compilation: the product builds a logical view of code elements and data flows, then presents findings in reports or an interactive interface.

Its core strength is configurable analysis and follow-through. Teams can use preconfigured security queries or author and edit custom queries, then track and triage vulnerabilities. Remediation guidance includes best-fix-location analysis, while custom reports and security insights support review. Scheduled and incremental scans are available. The product is offered on-premises as CxSAST and through the cloud-native Checkmarx One platform, giving organizations cloud and self-hosted deployment options. This breadth is relevant for teams that need to fit SAST into established environments, but query customization and deployment choices may be more than a small team seeking simple code checks needs.

Workflow coverage includes integrations with GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, TeamCity, GitHub Actions, CircleCI, AWS CodeBuild, SonarQube, VS Code, and JetBrains. CI/CD and IDE integrations are central to its fit for teams embedding scans in development and delivery processes. According to the vendor's pricing page, access is quote-based rather than publicly priced, so buyers should expect to discuss requirements with sales. SAST does not include software composition analysis; organizations needing dependency analysis alongside source-code scanning should assess a separate product or a broader alternative. Checkmarx SAST suits larger teams prioritizing configurable source analysis and workflow integration, less so buyers seeking public, straightforward pricing or bundled SCA.

Checkmarx SAST pros and cons

  • Where it wins
    • Analyzes source code and data flows without requiring compilation
    • Supports custom security queries, vulnerability triage, and fix guidance
    • Connects with major CI/CD services and IDEs, including GitHub and VS Code
  • Where it doesn't
    • Pricing requires a custom sales quote
    • Static analysis does not include software composition analysis
    • Hybrid deployment and query customization may exceed smaller teams' needs

Checkmarx SAST fact sheet, pricing and score →

Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.

Last updated · How we research and update