Checkmarx One

Checkmarx One is an application security platform with SAST, SCA, IaC and container scanning for enterprise AppSec teams, sold by custom quote.

Checkmarx One finds security flaws in the code a team writes, the open-source packages it depends on and the configuration it deploys. The problem it targets is speed: AI assistants now write code faster than people can review it. Without an independent check, vulnerable code can reach production. Checkmarx, an application security company founded in Israel in 2006, builds the platform and runs every scanner into one view of risk. Static Application Security Testing (SAST) reads source code for vulnerabilities early in development. Software Composition Analysis (SCA) matches open-source components against known vulnerabilities and license conflicts. API Security, DAST and Container Security carry the checks past source code, while IaC Security covers Terraform, Helm and Kubernetes files. Secrets Detection flags exposed credentials, tokens and keys, and Malicious Package Protection and Repository Health complete the scanner set. Application Security Posture Management (ASPM) correlates all of it with third-party findings and weighs exploitability, reachability and exposure. On top sit the AI layers: Checkmarx Fusion adds frontier-model reasoning to rules-based analysis, and Triage Assist and Remediation Assist classify findings and propose review-ready fixes. The platform is built for security-conscious enterprises, from large multinationals to fast-growing technology companies, banks, hospitals and government bodies. AppSec teams responsible for many repositories work from a single source of truth instead of a console per scanner. Engineering organisations adopting AI coding assistants get an independent security check on human and AI-written changes alike. Teams facing NIS2 and DORA can rely on the posture monitoring and audit-ready reporting in ASPM. In the delivery pipeline, scans run from Jenkins or Maven, and code repository integrations cover GitHub, GitLab, Bitbucket and Azure DevOps. Secrets Detection can block a pull request and break the build when a credential appears. Remediation Assist opens fix pull requests on supported GitHub projects for a reviewer to merge. Plugins for Eclipse, IntelliJ and Visual Studio and a VS Code extension bring findings into the editor, where Developer Assist verifies a fix before it becomes downstream rework. Security leads then work the ASPM risk view to send the most exploitable findings to developers first.