Checkmarx API Security vs Radware API Security Service
Checkmarx API Security
checkmarx.comRadware API Security Service
radware.comSide by side
| Figure | Checkmarx API Security | Radware API Security Service |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 1 |
| Spec score · API Security Software | 8.3 (#6) | 7.3 (#16) |
| API discovery | Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs. | It discovers APIs across environments, including third-party, outdated, shadow, and deprecated APIs. |
| Founded | 2006 | 1996 |
| Headquarters | Ramat Gan, Israel | Tel Aviv, Israel; corporate headquarters also in the United States |
| Pricing | Checkmarx says pricing is custom quoted based on modules, deployment model, and number of developers in scope. | The product page directs visitors to contact Radware and does not show a price. |
| Purpose | Checkmarx API Security discovers APIs in application code and documentation, including undocumented shadow APIs and abandoned zombie APIs. | The service provides full-lifecycle API security based on runtime traffic, from discovery and posture management to runtime protection. |
| Security controls | Checkmarx states that customer data is encrypted at rest with AES-256, communications use HTTPS/TLS 1.2, backups run daily for seven days, and deletion follows formal requests within seven days. | Radware lists ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, PCI, HIPAA, and SOC 2 Type II reports among its company certifications and reports. |
| Support | The API Security product page says an AppSec expert will respond to inquiries within one business day. | The product page describes 24/7 managed services as part of its operational efficiency offering. |
| Trial | Checkmarx says it does not offer a self-serve free trial and offers a personalized demo instead. | Radware invites prospective customers to contact it for a demo, free trial, or business logic mapping session. |
Plans
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
Radware API Security Service
- Radware API Security ServicePriced on request
In their own words
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.
Radware API Security Service
Radware API Security Service is a hybrid API-security product for API, self-hosted, and web environments. It follows APIs from discovery through posture management, testing, and runtime protection. Discovery covers third-party, outdated, shadow, and deprecated APIs across environments. Using live production traffic, posture management assesses risk and shows current API behavior and exposure. Runtime controls address embedded attacks, business-logic attacks, API-focused bots, and HTTP DDoS. Contextual automated testing adapts to application business logic, covers the OWASP API Top 10, and can connect to CI/CD pipelines. For business-logic defense, the service maps API workflows and creates rules that can be enforced against attacks. Discovery, analytics, risk assessment, posture management, and protection are presented in one management and reporting portal. Radware says integration is possible with on-premises, private-cloud, public-cloud, hybrid, and microservices environments, including without traffic redirection. A free trial is available; pricing is on request.