Checkmarx vs Veracode: What are the differences?

Introduction:

Checkmarx and Veracode are both popular static application security testing (SAST) tools used in the software development lifecycle to identify and fix vulnerabilities in code. While they share some similarities, there are key differences between the two.

1. Deployment method: Checkmarx is an on-premises solution that requires installation and maintenance of hardware and software infrastructure. On the other hand, Veracode is a cloud-based platform that offers easy scalability and eliminates the need for local setup and maintenance.

2. Language coverage: Checkmarx supports a wide range of programming languages, including C, C++, Java, .NET, PHP, Ruby, and more. Veracode, on the other hand, has broader language coverage, supporting not only traditional languages but also newer ones like Swift, Kotlin, and others.

3. False positive rates: Checkmarx has a reputation for having a higher false positive rate compared to Veracode. False positives occur when the tool incorrectly identifies a piece of code as vulnerable when it is not. Veracode, on the other hand, uses advanced algorithms and a vast knowledge base to minimize false positives and increase accuracy.

4. Reporting and remediation: Checkmarx provides detailed reports with vulnerability information, but the responsibility for fixing identified vulnerabilities lies with the development team. Veracode, on the other hand, not only provides comprehensive reports but also offers remediation guidance and recommendations to assist developers in fixing the vulnerabilities more effectively.

5. Integration and automation: Checkmarx offers integration capabilities with popular code repositories, build tools, and issue trackers but might require additional effort for customization. Veracode, on the other hand, provides seamless integration with various development tools and automation capabilities, making it easier to incorporate security measures into the software development process.

6. Pricing model: Checkmarx generally follows a perpetual software license model, where customers pay upfront for the software and ongoing maintenance. Veracode, on the other hand, follows a subscription-based model, allowing customers to pay for the services on a recurring basis, making it more flexible for organizations with fluctuating testing needs.

In Summary, Checkmarx and Veracode differ in deployment method, language coverage, false positive rates, reporting and remediation capabilities, integration and automation options, and pricing models.