Skip to content
SPECIFICTION
Get listed

Checkmarx API Security

checkmarx.com

WebWindowsmacOSLinuxAPISelf-hosted
Visit checkmarx.com
Spec score 8.3 #6 of 30 in API Security Software

What it is

Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.

Spec sheet

What it does
Checkmarx API Security inventories APIs from source code and documentation and correlates API risks with runtime testing in Checkmarx One.Read 21 Oct 2026 · checkmarx.com
Purpose
Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs.Read 3 Oct 2026 · checkmarx.com
Audience
Checkmarx describes Essentials as core application security for teams building their program, Professional as a scaling package, and Enterprise as coverage for organizations with demanding security requirements.Read 3 Oct 2026 · checkmarx.com
Deployment
Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments.Read 21 Oct 2026 · checkmarx.com
Trial
Checkmarx says it does not offer a self-serve free trial and offers a personalized demo instead.Read 3 Oct 2026 · checkmarx.com
Integrations
Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools.Read 21 Oct 2026 · checkmarx.com
Security
Checkmarx says customer data is encrypted at rest using protocols such as AES-256, and service communications use HTTPS with TLS 1.2 for data to and from Amazon S3.Read 3 Oct 2026 · checkmarx.com
Compliance
The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment.Read 21 Oct 2026 · checkmarx.com
Support
The API Security product page says an AppSec expert will respond to inquiries within one business day.Read 3 Oct 2026 · checkmarx.com
Headquarters
Ramat Gan, IsraelRead 28 Sep 2026 · checkmarx.com
Founded
2006Read 28 Sep 2026 · checkmarx.com
API change history
The API change log records endpoint history, commits, developers, and prior API states to help trace how risk was introduced.Read 21 Oct 2026 · checkmarx.com
API discovery
Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs.Read 21 Oct 2026 · docs.checkmarx.com
Change history
The API Change Log shows API history, including the commit and developer associated with a change that introduced a vulnerability.Read 3 Oct 2026 · checkmarx.com
CI/CD and IDE plugins
Documented plugins include GitHub Actions, Jenkins, TeamCity, Azure DevOps, Maven, VS Code, Visual Studio, JetBrains, and Eclipse.Read 21 Oct 2026 · docs.checkmarx.com
CLI
The standalone CLI mirrors REST API functionality for project management, scan control, and result display.Read 21 Oct 2026 · docs.checkmarx.com
CLI operating systems
Tested CLI environments include Windows 10/11 and Windows Server, Red Hat, Amazon Linux, Fedora, Ubuntu, CentOS, and macOS Sequoia.Read 21 Oct 2026 · docs.checkmarx.com
Company facts
LinkedIn lists Checkmarx as privately held, founded in 2006, headquartered in Paramus, New Jersey, with 501–1,000 employees.Read 21 Oct 2026 · linkedin.com
Company legal name
Crunchbase identifies the legal entity as Checkmarx Ltd.Read 21 Oct 2026 · crunchbase.com
DAST correlation
Native Checkmarx DAST integration combines static and dynamic findings in one API inventory and raises priority when runtime exploitation is confirmed.Read 21 Oct 2026 · checkmarx.com
DAST limitation
DAST runs from Checkmarx One have a two-hour-45-minute timeout and uploaded result archives are limited to 150 MB.Read 21 Oct 2026 · docs.checkmarx.com
DAST requirements
DAST CLI guidance specifies 8–16 GB RAM, 3 GB RAM and 2 CPUs per worker, and Docker-capable Windows, macOS, or Linux.Read 21 Oct 2026 · docs.checkmarx.com
Documentation scanning
OpenAPI, Swagger, and Postman documentation can be scanned and compared with the discovered API inventory to expose discrepancies.Read 21 Oct 2026 · checkmarx.com
Global API inventory
The product maintains an inventory of APIs and detected vulnerabilities so teams can prioritize remediation by business risk.Read 21 Oct 2026 · checkmarx.com
Inventory
It provides a global API inventory with detected vulnerabilities and supports prioritizing remediation by business risk.Read 3 Oct 2026 · checkmarx.com
License model
The 2026 license terms define Checkmarx One licensing around contributing developers and a 15-million-lines-scanned-per-license 90-day account limit.Read 21 Oct 2026 · checkmarx.com
Limit: Capterra reviewers
Capterra reviewers mention false positives, slow scans, difficult configuration, limited user-friendliness, and unsupported languages such as ColdFusion and R.Read 21 Oct 2026 · capterra.com
Limit: G2 false positives
G2 summarizes recurring complaints about many false positives complicating analysis, plus individual complaints about slow scans, confusing setup, and high cost.Read 21 Oct 2026 · g2.com
Limit: GetApp reviewers
GetApp review data shows value-for-money scoring of 3.0/5 and complaints about expense, slowness, messy reporting, installation difficulty, and downtime delays.Read 21 Oct 2026 · getapp.com
Notable incident
Checkmarx reported that a March 2026 Trivy-related supply-chain incident enabled unauthorized GitHub access and publication of malicious VS Code, GitHub Actions, and Jenkins artifacts; data was later published on the dark web.Read 21 Oct 2026 · checkmarx.com
Notable news: acquisition
Checkmarx announced its acquisition of Tromzo on December 8, 2025 to add AI-native autonomous security-agent technology.Read 21 Oct 2026 · checkmarx.com
Owner
Crunchbase states that Checkmarx was acquired by Hellman & Friedman.Read 21 Oct 2026 · crunchbase.com
Praise: G2 users
G2 summarizes repeated praise for ease of use, comprehensive reporting, CI/CD integration, and help identifying and fixing code vulnerabilities.Read 21 Oct 2026 · g2.com
Praise: GetApp reviewers
GetApp reviewers describe broad vulnerability scanning, strong reporting, integrations, and responsive support as benefits.Read 21 Oct 2026 · getapp.com
Pricing
Checkmarx says pricing is custom quoted based on modules, deployment model, and number of developers in scope.Read 3 Oct 2026 · checkmarx.com
Prioritized remediation
API findings are prioritized using real impact and risk rather than only generic severity scores.Read 21 Oct 2026 · docs.checkmarx.com
Public API
Checkmarx One exposes REST APIs for project and application CRUD, scans, results, vulnerability management, and webhooks.Read 21 Oct 2026 · docs.checkmarx.com
Rating on Capterra
3.9 out of 5 from 7 reviewsRead 21 Oct 2026 · capterra.com
Rating on G2
4.2 out of 5 from 49 reviewsRead 21 Oct 2026 · g2.com
Rating on Gartner Peer Insights
4.4 out of 5 from 93 ratings for Checkmarx OneRead 21 Oct 2026 · gartner.com
Rating on GetApp
3.9 out of 5 from 7 reviewsRead 21 Oct 2026 · getapp.com
Rating on TrustRadius
8.5 out of 10 from 22 reviewsRead 21 Oct 2026 · trustradius.com
Repository integrations
GitHub, GitLab, Bitbucket, and Azure DevOps integrations can trigger scans on pushes and pull requests, including self-hosted repositories.Read 21 Oct 2026 · docs.checkmarx.com
Security controls
Checkmarx states that customer data is encrypted at rest with AES-256, communications use HTTPS/TLS 1.2, backups run daily for seven days, and deletion follows formal requests within seven days.Read 21 Oct 2026 · checkmarx.com
Supported API frameworks
The documentation lists Python Flask and Django, Java Spring, Node.js Express, and C# ASP.NET Web API support.Read 21 Oct 2026 · docs.checkmarx.com
Supported frameworks
The API Security scanner currently supports Java Spring, ASP.NET Web API, and Python Flask.Read 3 Oct 2026 · docs.checkmarx.com
Web system requirement
The Checkmarx One web platform requires Chrome 103 or newer and is not supported on Linux.Read 21 Oct 2026 · docs.checkmarx.com

Plans and prices

Checkmarx One bundle Priced on request Pricing is based on developers, apps, and usage. Custom quote · Pricing based on developers, apps and usage Read 20 Sep 2026 · checkmarx.com
Enterprise Priced on request Essentials and Professional plus IaC Security · secrets detection · Codebashing Read 21 Oct 2026 · checkmarx.com
Essentials Priced on request SAST · SCA · API Security · ASPM Read 21 Oct 2026 · checkmarx.com
Professional Priced on request Essentials plus malicious package protection · repository health · DAST · container security Read 21 Oct 2026 · checkmarx.com
Start with SAST Priced on request SAST · optional API Security · IaC Security · secrets detection · Checkmarx Assist · Codebashing · AI Inventory Read 21 Oct 2026 · checkmarx.com
Start with Supply Chain Priced on request SCA · malicious package protection · repository health · container security Read 21 Oct 2026 · checkmarx.com

Every Checkmarx API Security plan and price →

Strong points and limits

Strong points

  • Finds shadow and zombie APIs
  • Compares API documentation with inventory
  • Tracks vulnerability-introducing changes
  • Correlates DAST and SAST findings
  • Integrates with code and workflow tools

Limits

  • No free plan or self-serve trial
  • Pricing requires a custom quote
  • Runtime protection is not provided
  • Supported frameworks are limited to three

Who it suits

It suits application-security teams that need API discovery, documentation governance and inventory-based remediation. Organizations can select Essentials, Professional or Enterprise packages, with additional modules available.

Verdict

Checkmarx API Security focuses on discovering, documenting and prioritizing API risks across development workflows. Its package structure and custom pricing require organizations to match modules and deployment choices to their scope.

Where Specifiction places it

Alternatives to Checkmarx API SecurityAll alternatives →