Checkmarx
Unified 'Checkmarx One' application security platform spanning code, software supply chain, and cloud infrastructure scanning with SecOps integrations.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Checkmarx was founded in Israel in 2006 and built its early reputation on enterprise static application security testing (SAST). It now sells as a consolidated platform, Checkmarx One, spanning code scanning, software supply chain, and cloud infrastructure, integrated with SecOps tools such as Wiz, CrowdStrike, and Sysdig.
Hellman & Friedman acquired Checkmarx from Insight Partners in 2020 for roughly $1.15-1.2 billion. In December 2025 it acquired Tromzo to add ASPM capability to the platform.
Checkmarx was named a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing for the seventh time. A published Best Buy case study credits the platform with an 80% reduction in security alert noise.
Innovation Matrix Assessment
Platform consolidation (Checkmarx One) plus the December 2025 Tromzo acquisition for ASPM shows active roadmap expansion into adjacent categories.
The Best Buy case study's reported 80% alert-noise reduction is a concrete, named operational efficiency claim, unusual for this category.
PE-owned since 2020 with a 2022 workforce reduction; still holds Gartner Leader status seven years running. Recognized in Cyber Defense Media Group's 2026 Global InfoSec Awards (1 award), independently juried industry validation of market traction. Also featured in Cyber Defense Magazine's Innovator Spotlight series, a sister editorial publication, adding real external visibility.
Platform consolidation across code/supply chain/cloud is a meaningful breadth play but not a fundamentally new delivery or business model. However, Checkmarx was acquired by Hellman & Friedman at a $1.15B valuation in 2020 (per spglobal.com), which is the scale of an established incumbent rather than an emerging category disruptor, so this dimension is scored more conservatively.
Named Best Buy case study plus sustained Gartner Peer Insights Customers' Choice recognition.
Tromzo acquisition for ASPM and continued platform breadth keep it aligned with where enterprise AppSec buying is heading.
Why CISOs Should Care
A single platform covering code, supply chain, and cloud scanning with documented alert-noise reduction helps stretched AppSec teams triage faster without adding headcount.
What Makes It Different
Built around platform consolidation and SecOps interoperability rather than being a best-of-breed point scanner.
The Matrix Verdict
70/100 — MEANINGFUL INNOVATOR
Incremental Innovator (~67/100). A mature, PE-owned Gartner Leader with credible customer evidence of operational value, but not a category disruptor.
Editorial Note: Claims vs. Verified Findings
Gartner Leader status and the Tromzo/H&F ownership history are independently reported. The 80% alert-noise-reduction figure comes from a Checkmarx-published case study.
Sources
Alternatives to Checkmarx
ThreatLocker
CISO ReviewedZero Trust endpoint protection platform that blocks unknown applications by default through allowlisting, ringfencing, and storage control.
Endor Labs
Reachability-based software composition analysis that filters open-source dependency risk down to what code paths are actually exploitable.
Socket
A software supply chain security platform that combines automated dependency analysis with human verification to catch malicious and…
JFrog
Public software supply chain security platform (Xray plus Advanced Security) that scans binaries and artifacts end-to-end from the…
Apiiro
Builds a continuous 'code risk graph' that maps code, developers, and cloud deployment to prioritize AppSec findings by…
ArmorCode
Tool-agnostic ASPM layer that correlates findings from 300+ existing security tools into one prioritized backlog, without running its…