APIDynamics vs Checkmarx API Security
APIDynamics
apidynamics.comCheckmarx API Security
checkmarx.comSide by side
| Figure | APIDynamics | Checkmarx API Security |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | — | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 0 | 6 |
| Spec score · API Security Software | 7.9 (#10) | 8.3 (#6) |
| API discovery | The platform discovers APIs across clouds, gateways, proxies, and ingress points, classifies their sensitivity and risk, and tracks undocumented endpoints. | Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs. |
| Compliance | The product page describes exportable logs for SOC 2, HIPAA, PCI, and ISO 27001 compliance. | The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment. |
| Deployment | The maker says APIDynamics can operate as a reverse proxy or plugin in a gateway or service mesh, with requests passed, challenged, or blocked by real-time policy. | Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments. |
| Integrations | Named gateway and mesh integrations include Envoy, Istio, Kong, Apigee, NGINX, AWS API Gateway, and Azure API Management. | Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools. |
| Support | The contact page says a security expert will contact people who complete its form. | The API Security product page says an AppSec expert will respond to inquiries within one business day. |
| Trial | The maker offers a link labeled “Start Free Trial,” but does not state a trial duration on the pages reviewed. | Checkmarx says it does not offer a self-serve free trial and offers a personalized demo instead. |
Plans
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
In their own words
APIDynamics
APIDynamics is a unified API and AI security platform built around Zero Trust. It discovers APIs across clouds, gateways, proxies, and ingress points, including undocumented endpoints, and classifies them by sensitivity and risk. Runtime protection is designed to block OWASP Top 10 API threats and detect bots through behavior-based anomaly detection. Adaptive MFA evaluates signals such as behavior, IP reputation, geography, agent headers, and anomaly patterns, then can challenge risky calls using TOTP, token headers, or HMAC authentication.
The platform can run as a reverse proxy or as a gateway or service-mesh plugin, applying real-time policies to pass, challenge, or block requests. Integrations include Envoy, Istio, Kong, Apigee, NGINX, AWS API Gateway, and Azure API Management. It also names cloud, AI, and SaaS integrations, and can stream logs, transaction IDs, anomalies, and risk scores to observability tools. SDKs support Python, Java, Node, and other languages. Pricing is available on request; the site offers a free trial but does not state its duration.
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.