Checkmarx API Security vs ThreatX API and Application Protection
Checkmarx API Security
checkmarx.com
ThreatX API and Application Protection
threatx.comSide by side
| Figure | Checkmarx API Security | ThreatX API and Application Protection |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | — | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 0 |
| Spec score · API Security Software | 8.3 (#6) | 7.5 (#13) |
| API discovery | Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs. | ThreatX discovers and profiles API endpoints by analyzing API traffic in real time. |
| Deployment | Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments. | Deployment options include ThreatX-hosted cloud, machine images for AWS, Azure, and GCP, Docker containers in customer data centers, and hybrid deployments. |
| Integrations | Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools. | ThreatX can send webhook notifications to another app, with Slack given as an example. |
| Support | The API Security product page says an AppSec expert will respond to inquiries within one business day. | The managed service includes 24/7 access to security experts in the ThreatX Security Operations Center. |
Plans
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
ThreatX API and Application Protection
No plans published.
In their own words
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.
ThreatX API and Application Protection
ThreatX API and Application Protection has no write-up on Specifiction yet; its figures are above.