apPosture API Security vs Checkmarx API Security
apPosture API Security
apposture.comCheckmarx API Security
checkmarx.comSide by side
| Figure | apPosture API Security | Checkmarx API Security |
|---|---|---|
| Price from | $2.92/mo | — |
| Free plan | — | — |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | — | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 10 | 6 |
| Spec score · API Security Software | 8.7 (#5) | 8.3 (#6) |
| Compliance | API Security offers API-scoped compliance across seven frameworks and supports SARIF export. | The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment. |
| Deployment | Deployments run self-hosted through Docker Compose, in the customer’s cloud account or as a dedicated managed instance. | Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments. |
| Headquarters | Baku, Azerbaijan | Ramat Gan, Israel |
| Integrations | Supported source-control connections include GitHub, GitHub Enterprise, GitLab, GitLab self-managed, Bitbucket and Azure DevOps. | Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools. |
| License model | The terms state that apPosture is licensed rather than sold and is authorized for defensive security testing. | The 2026 license terms define Checkmarx One licensing around contributing developers and a 15-million-lines-scanned-per-license 90-day account limit. |
| Purpose | API Security inventories endpoints, scores risk on an A–F curve, surfaces toxic combinations, and compares declared API contracts with running APIs. | Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs. |
| Security controls | Listed controls include scoped RBAC, checksum-pinned CI agents, signed integrations, encrypted credentials, fail-closed gates and append-only audit logs. | Checkmarx states that customer data is encrypted at rest with AES-256, communications use HTTPS/TLS 1.2, backups run daily for seven days, and deletion follows formal requests within seven days. |
| Support | Every license includes email support, documentation, security advisories and upgrade guidance; Enterprise adds a named technical contact and custom response SLA. | The API Security product page says an AppSec expert will respond to inquiries within one business day. |
| What it does | apPosture is a self-hosted application-security posture platform that discovers applications, APIs, code, dependencies, containers, Kubernetes, cloud accounts, infrastructure-as-code, secrets and AI/ML assets, then correlates results into one posture. | Checkmarx API Security inventories APIs from source code and documentation and correlates API risks with runtime testing in Checkmarx One. |
Plans
apPosture API Security
- API Security add-on$15 a month
- Essentials$35 a year
- Essentials$35 a month
- Platform$70 a year
- Platform$70 a month
- Enterprise$90 a month
- Enterprise$90 a year
- Agentic Pentest uplift$600 a year
- DAST target URL$900 a year
- One-off engagement$900, paid once
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
In their own words
apPosture API Security
apPosture API Security inventories API endpoints, assigns risk priorities, and compares declared API contracts with running APIs. Its risk verdict combines whether an endpoint is public, handles sensitive data, and lacks provable authentication. Endpoint labels distinguish code-and-runtime provenance, source-only findings, and runtime-only observations. Discovery uses SAST attack-maps, DAST crawling, an attached OpenAPI specification, and external subdomain probing; listed coverage includes OpenAPI import, GraphQL, gRPC, HTTP/2, h2c, and REST. Teams can diff an OpenAPI specification against running endpoints to identify documented, shadow, declared-untested, and auth-drift states. Runtime correlation ingests existing access logs out of band rather than inline in the request path. The product supports API-scoped compliance across seven frameworks and SARIF export. It can run self-hosted, in a customer's cloud, or as a dedicated managed instance; self-hosted deployment uses a local LLM and needs no outbound connections after setup. The listed Essentials plan is $35 a year, billed at $35 / dev · mo annually, with a $2,000 / year minimum; API Security is an additional $15 / dev · mo. Platform is $70 a year, billed at $70 / dev · mo annually, with a $4,000 / year minimum. Enterprise is $90 a year, billed at $90 / dev · mo annually, with a $7,500 / year minimum. There is no free tier; each edition starts with the same 30-day proof of concept.
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.