Checkmarx

Definition

Checkmarx is an application security platform best known for its static application security testing (SAST) engine, which scans source code for vulnerabilities without executing the application, alongside software composition analysis and API security tooling.

Overview

Checkmarx's core product, CxSAST (now part of its unified Checkmarx One platform), scans an application's source code directly, tracing data flow through the codebase to identify vulnerabilities like SQL Injection and Cross-Site Scripting (XSS) before the application is ever run. Because it analyzes source rather than a running application, SAST can be integrated very early in development, often directly in the IDE or at commit time. The Checkmarx One platform has broadened over time to include software composition analysis for open-source dependency scanning (competing with tools like Snyk and Veracode), API security testing, and infrastructure-as-code scanning, aiming to give application security teams a single consolidated view across these different testing types. Checkmarx is widely used in enterprise application security programs, particularly where teams want deep, language-specific static analysis across a broad set of supported programming languages and frameworks, often as part of a broader secure software development lifecycle (SSDLC) alongside training covered in courses like DevSecOps.

Key Features

• Deep static application security testing (SAST) with data-flow analysis
• Broad programming language and framework support
• Software Composition Analysis (SCA) for open-source dependency risk
• API security testing capabilities
• Infrastructure-as-code scanning
• IDE and CI/CD pipeline integration for early developer feedback
• Unified Checkmarx One platform consolidating multiple scan types

Use Cases

Frequently Asked Questions

Related in Cybersecurity