Checkmarx Built the Scanner. Now It Wants to Kill the Security Backlog.

A security scanner can be perfectly right and still be deeply annoying. It finds a flaw. Then another. Then 4,000 more. The dashboard glows red, the development team develops selective blindness, and the supposedly urgent queue begins to resemble a municipal landfill. Checkmarx built a serious business by finding vulnerable source code before that code reached production. Its second act is harder: persuade large companies that the findings can arrive with enough context, precision and repair guidance to deserve a developer's attention.

That problem is suddenly more expensive. AI coding tools can produce changes faster than security teams can review them, while modern applications arrive as a casserole of proprietary code, open-source packages, containers, APIs, cloud configuration and now models and agents. A single scanner sees only one layer. Checkmarx's answer is Checkmarx One, a subscription platform that gathers those layers into one risk model and pushes security back into the places where software is made: the editor, pull request and CI/CD pipeline.

The first product was a microscope

Israeli security engineer Maty Siman founded Checkmarx in 2006 with Emmanuel Benzaquen, who would run the company for its first 17 years. The original wedge was static application security testing, or SAST. Instead of waiting for an attacker to poke at a running application, Checkmarx analyzed its source code and traced risky data flows. SQL injection and cross-site scripting could be spotted while a fix was still relatively cheap.

The pitch landed with enterprises because their codebases were large, old and wonderfully inconsistent. Checkmarx says it now serves more than 1,600 customers across 70-plus countries, including retailers, banks, airlines, healthcare companies and governments. Public references include Best Buy, SAP, Samsung, Salesforce, Cebu Pacific, ITV and MyHeritage. This is not primarily software for a three-person startup that can discuss every dependency over lunch. It is built for organizations where hundreds of teams ship through thousands of repositories under one CISO's policy.

What failed first: the queue

Early AppSec was organized like airport security at the gate. Developers built the application, security scanned it near release, and the finding became a late interruption. DevOps made that model buckle. Software shipped continuously, open source multiplied the components, and separate tools generated separate lists. Detection worked. Coordination did not. The first failure was the queue - too many alerts, too little context and remediation arriving at the costliest moment.

Checkmarx's own customer stories make the problem concrete. Best Buy supports more than 3,000 engineers across 300 teams and 8,000 repositories. Its environment runs nearly every language and framework. After consolidating SAST, software composition analysis and workflow automation in Checkmarx One, the retailer reported 27,000 monthly scans across 2.1 billion lines of code and an 80% cut in false positives. Cebu Pacific moved from an on-premises Checkmarx scanner to the cloud platform, expanded AppSec from roughly a dozen users to more than 100 and reduced vulnerability density from 1.58 to 0.8 per thousand lines of code.

“The winning security tool is not the one that finds the most. It is the one developers still believe on Friday afternoon.”YesPress analysis

That is what changed the product logic. A source-code scanner had to become an application-security system of record. Checkmarx added interactive developer education through Codebashing, DevSecOps consulting through Custodela and malicious-package analysis through Dustico. It built or folded in software composition analysis, API discovery, infrastructure-as-code scanning, container security, secrets detection, dynamic testing and application security posture management. Sandeep Johri, who became CEO in 2023 after scaling software-testing company Tricentis, inherited a company already moving from installed product to cloud platform.

One conveyor belt, many inspectors

The easiest way to understand Checkmarx One is to follow a change. Developer Assist watches code in tools such as Cursor, Windsurf and VS Code. SAST checks proprietary logic; secrets detection catches exposed credentials; infrastructure scanning reviews cloud definitions. At pull request, software composition analysis inspects dependencies and malicious-package protection checks whether a new library behaves suspiciously. Container and repository tools inspect the build. DAST attacks the running application. ASPM gives security leaders one portfolio view across those signals.

This breadth is the differentiation and the burden. Veracode and OpenText Fortify contest the enterprise suite. Snyk, Semgrep, GitHub Advanced Security, SonarQube and Mend compete for developer attention. Black Duck is formidable in software composition analysis. Invicti and HCL AppScan have deep dynamic-testing histories. Wiz and other cloud-security platforms are moving toward code. Checkmarx must prove that its common context reduces work, not merely that its dashboard can contain every kind of work.

Its newest answer is automation. The Assist family can triage findings, propose fixes and verify them before a human merges the change. Fusion, introduced in early access in July 2026, combines deterministic scanning engines with frontier-model reasoning. The theory is sensible: rules reliably catch known patterns; AI may reason about novel paths and explain repairs. The guardrail matters just as much. Developers review the patch, AppSec retains policy control, and the system records the decision. Autonomous security without auditability is simply a faster way to be surprised.

What it costs - and what the price reveals

Checkmarx does not publish a neat platform price. Bundles are quoted according to developer seats, applications and usage, with onboarding and a named customer-success function. Services, private deployment and implementation can expand the bill. A public Developer Assist offer has been listed at $25 per user per month, including a one-month trial. The split is revealing: an individual coding assistant can enter through a credit card; enterprise governance still enters through procurement.

The other price tag is corporate. Insight Venture Partners invested $84 million in 2015. In April 2020, Hellman & Friedman bought Checkmarx in an all-cash transaction valued at $1.15 billion, with TPG taking a minority interest and Insight remaining involved. The company had more than 1,400 customers and 700 employees then. Today it reports 900-plus employees and more than 1,600 customers, while a 2024 update said annual recurring revenue for Checkmarx One had tripled year over year. As a private company, it does not publish audited revenue; an outside estimate supplied with this profile puts annual revenue around $150 million.

The playbook worth copying

The most copyable Checkmarx move is not buying a menu of products. It is treating adjacent customer friction as product strategy. Codebashing addressed the knowledge gap. Custodela addressed implementation. Dustico addressed the behavior of third-party packages. GitLab, Sysdig, DXC and Carahsoft partnerships put the platform into pipelines, runtime context, services and government procurement. Each step moved the company closer to the actual job: operate an AppSec program, not simply run a scan.

But the conditions matter. Consolidation works when an organization has enough languages, repositories, regulations and teams to make central policy valuable. It works when developers see results inside tools they already use, when security champions tune policies, and when the rollout tracks false positives, remediation time and vulnerability density. Buying every module and assigning nobody to the workflow produces a very expensive red dashboard.

Where the next fight sits

Checkmarx now sits between classic application-security testing and the newer application-security posture market. It still sells deep scanners, but the center of gravity is orchestration: correlate signals, prioritize exploitable paths, govern policy and accelerate the fix. AI expands both sides of that equation. More code means more attack surface; better models may make triage and remediation less manual. The company has also added AI bills of materials that inventory models, agents, frameworks, APIs and MCP components - a sign that “dependency” now includes things that talk back.

The bet is not risk-free. Automated fixes can be wrong. Model reasoning consumes money. A broad platform can lag a specialist in one category. Cloud migration can strain teams attached to on-premises workflows. And custom pricing makes it harder for a smaller buyer to test the full economics without a sales process. Checkmarx wins when accuracy, context and integration remove more labor than the platform adds. It loses when the scanner becomes a faster alert factory wearing an AI badge.

Twenty years after the first microscope, the company's job is no longer to prove that vulnerable code exists. Everyone in software already knows. The useful question is whether the right flaw can reach the right developer, with the right fix, before the next machine-written commit arrives. That is a less theatrical product than a wall of critical alerts. It may also be the one enterprises are willing to keep.