Checkmarx
How does Fluid Attacks' solution compare to Checkmarx's? The following comparison table enables you to
discern the performance of both providers across various attributes essential for meeting your company’s
cybersecurity needs. To better understand each attribute, read their descriptions in the dedicated page.
Organization
|
Attribute
|
Essential
|
Advanced
|
Checkmarx
|
|
Focus
|
|||
|
Extras
|
None
|
None
|
None
|
|
Headcount
|
|||
|
Headcount distribution
|
|||
|
Headcount growth
|
+5%, +10%, +8% | ||
|
Headquarters
|
|||
|
Countries
|
IL, IN, PT and US | ||
|
Reputation
|
Same
|
||
|
Followers
|
Same
|
||
|
Research firms
|
None
|
None
|
|
|
Founded
|
2001 | ||
|
Funding
|
Bootstrapped
|
Same
|
$92M USD in 4
rounds from 6 investors
|
|
Acquisitions
|
None
|
None
|
Acquired 0 times and made 3 acquisitions
|
|
Revenue
|
|||
|
CVE
|
10 CVEs reported to
MITRE
|
||
|
Compliance
|
|||
|
Bug bounty
|
No
|
||
|
Visits
|
|||
|
Authority
|
|||
|
Vulnerability database
|
|||
|
Content
|
|||
|
Knowledge base
|
13 KB
sections, 7 in common and 6 additional
|
8 KB sections, 7 in common and 1 additional | |
|
Community
|
Forum | ||
|
Sync training
|
1 workshop
|
2 live security education courses
(subscription-based)
|
|
|
Async training
|
3 product use courses, all free
|
Security education platform
(subscription-based)
|
|
|
Distribution
|
Same
|
||
| Marketplaces | AWS | ||
|
Freemium
|
No
|
No
|
No
|
|
Free trial
|
|||
|
Demo
|
|||
|
Open Demo
|
No
|
No
|
No
|
|
Pricing
|
|||
|
Pricing tiers
|
1 plan
|
1 plan
|
5 plans (SAST, SSCS, essentials, professional, enterprise). None
transparent
|
|
Minimum term
|
|||
|
Minimum payment period
|
|||
|
Minimum capabilities
|
|||
|
Minimum scope
|
1 author
|
||
|
Pricing drivers
|
|||
|
Minimum monthly payment
|
|||
|
Free implementation
|
|||
|
Free support
|
Service
|
Attribute
|
Essential
|
Advanced
|
Checkmarx
|
|
PTaaS
|
No
|
No
|
|
|
Reverse engineering
|
No
|
No | |
|
Secure code review
|
No
|
No
|
|
|
Pivoting
|
No
|
No
|
|
|
Exploitation
|
No
|
No
|
|
|
Manual reattacks
|
Not applicable
|
Not applicable
|
|
|
Zero-day
vulnerabilities
|
None
|
Continuous zero-day vulnerability research
|
|
|
SLA
|
Availability and response | ||
|
Min availability
|
>=99.95% per minute LTM
|
>=99.5% per period
|
|
|
After-sale guarantees
|
No
|
Yes
|
No |
|
Accreditations
|
|||
|
Hacker certifications
|
Not
applicable
|
Not
applicable
|
|
|
Type of contract
|
Employee
|
Same
|
|
|
Endpoint control
|
Not applicable
|
Total
|
Not applicable
|
|
Channel control
|
Not applicable
|
Total
|
Not applicable
|
|
Standards
|
Some requirements from 67 standards,
18 in common and 49 additional
|
||
|
Detection method
|
|||
|
False positives
|
3.87 times better
|
6.66 times better
|
12% F0.5 score per quantity
|
|
False negatives
|
5.6 times better
|
17.98 times better
|
4% F2.0 score per severity
|
|
Remediation
|
5, 3 in common and 2 additional
|
Same, plus 1
|
4, 3 in common and 1 additional
|
|
Outputs
|
5,
4 in common and 1 additional
|
Same, plus 2
|
6, 4
in common and 2 additional
|
Product
|
Attribute
|
Essential |
Advanced
|
Checkmarx
|
|
ASPM
|
|||
|
API
|
|||
|
IDE
|
Same, plus 1 functionality
|
||
|
CLI
|
|||
|
CI/CD
|
|||
|
Vulnerability sources
|
4 sources, 1 in common and 3 additional
|
6 sources, 1 in common and 5 additional
|
|
|
Threat model alignment
|
|||
|
Priority criteria
|
|||
|
Custom prioritization
|
|||
|
Scanner origin
|
|||
|
SCA
|
23 package
managers, 14 in common and 9 additional
|
||
|
AI security
|
No
|
No | |
|
Reachability
|
12 languages
|
Yes. No information available
|
|
|
Reachability type
|
|||
|
SBOM
|
|||
|
Malware detection
|
Yes
|
Yes
|
|
|
Autofix on components
|
No
|
No
|
|
|
Containers
|
|||
|
Source SAST
(languages)
|
12,
11 in common and 1 additional
|
36, 11 in
common and 25 additional
|
|
|
Source
SAST
(frameworks)
|
22,
10 in common and 12 additional
|
52, 10 in common and 42 additional |
|
|
Custom rules
|
No
|
No
|
|
|
IaC
|
6, 5 in common and 1 additional
|
4, all in common
|
12, 9 in common and 3 additional |
|
Binary SAST
|
No
|
||
|
DAST
|
7 attack
surface types, 2 in common and 5 additional
|
3 attack surface types, 2 in common and 5 additional |
|
|
API security testing
|
No
|
4 types of APIs, 3 in common and 1
additional
|
3 types of APIs, all in common |
|
IAST
|
No
|
No
|
No
|
|
CSPM
|
Yes |
No
|
|
|
ASM
|
No
|
No
|
No
|
|
Secrets
|
Same, plus
verify other attack vectors and secrets exploitability
|
||
|
AI
|
3 functions, 2 in
common and 1 additional
|
||
|
MCP
|
|||
|
Open-source
|
Not
applicable
|
Apache License version 2, partially equivalent to the paid version
|
|
|
Provisioning as Code
|
|||
|
Deployment
|
|||
| Regions | |||
|
Status
|
|||
|
Incidents
|
Integrations
|
Attribute
|
Essential
|
Advanced
|
Checkmarx
|
|
SCM
|
6,
3 in common and 3 additional
|
4, 3 in common and 1
additional
|
|
|
Binary repositories
|
None
|
None
|
|
|
Ticketing
|
3, all in
common
|
5, 3 in common and 2 additional |
|
|
ChatOps
|
None |
None
|
|
|
IDE
|
3,
2 in common and 1 additional
|
4, 2 in common and 2 additional |
|
|
CI/CD
|
21,
10 in common and 11 additional
|
17, 10
in common and 7 additional
|
|
|
SCA
|
|||
|
Container
|
|||
|
SAST
|
|||
|
DAST
|
Native powered by ZAP |
||
|
IAST
|
None |
None
|
None
|
|
Cloud
|
3, all
in common
|
||
|
CSPM
|
None | ||
|
Secrets
|
|||
|
Remediation
|
None
|
None
|
|
|
Bug bounty
|
None
|
None
|
None |
|
Vulnerability management
|
None
|
None
|
|
|
Compliance
|
None
|
None
|
None
|
References were last checked on Nov 19, 2025.
More like Checkmarx
Free trial
Search for vulnerabilities in your apps for free with Fluid
Attacks' automated security testing! Start your 21-day free
trial and discover the benefits of the Continuous Hacking Essential plan. If you prefer the
Advanced plan, which includes the expertise of Fluid Attacks' hacking team, fill out this contact form.