Checkmarx API Security vs Wallarm API Security
Checkmarx API Security
checkmarx.comWallarm API Security
wallarm.comSide by side
| Figure | Checkmarx API Security | Wallarm API Security |
|---|---|---|
| Price from | — | Free |
| Free plan | — | Yes |
| Free trial | — | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 6 | 3 |
| Spec score · API Security Software | 8.3 (#6) | 7.3 (#17) |
| API discovery | Source-code scanning automatically discovers API endpoints, including undocumented shadow APIs and abandoned zombie APIs. | It finds shadow, zombie, and rogue APIs and can auto-build OpenAPI specifications from live traffic. |
| Compliance | The trust center states ISO/IEC 27001:2022 certification, annual independent SOC 2 Type II audits, GDPR alignment, and NIST SSDF alignment. | Wallarm states that it is SOC 2 Type 2 compliant. |
| Deployment | Checkmarx pricing documentation says Checkmarx One is available as SaaS or self-hosted/on-premises, including air-gapped deployments. | Wallarm supports managed Security Edge deployment and self-hosted deployment options including Kubernetes, cloud VMs, and API gateway connectors. |
| Headquarters | Ramat Gan, Israel | Wallarm says it is headquartered in Austin, Texas. |
| Integrations | Checkmarx lists 41 integrations spanning SCM, CI/CD, IDEs, ticketing, registries, cloud, and infrastructure tools. | The product page lists Splunk, Sumo, QRadar, Jira, PagerDuty, OpsGenie, and Slack for event routing. |
Plans
Checkmarx API Security
- Checkmarx One bundlePriced on request
- EnterprisePriced on request
- EssentialsPriced on request
- ProfessionalPriced on request
- Start with SASTPriced on request
- Start with Supply ChainPriced on request
Wallarm API Security
- Security Edge Free TierFree
- Cloud Native WAAPPriced on request
- WAAP + Advanced API SecurityPriced on request
In their own words
Checkmarx API Security
Checkmarx API Security discovers APIs in application source code and documentation, including undocumented shadow APIs and abandoned zombie APIs. It builds a global inventory showing vulnerabilities and supports remediation prioritization by business risk. The scanner supports Java Spring, ASP.NET Web API and Python Flask, and examines OpenAPI, Swagger and Postman collections for documentation mismatches. An API Change Log records history, including the commit and developer linked to a vulnerability-introducing change. Checkmarx DAST findings can be correlated with SAST findings in the same inventory to identify runtime-confirmed issues. Integrations include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, GitHub Actions, VS Code, JetBrains, Jira, Slack and Microsoft Teams. Security statements cover AES-256 encryption at rest, HTTPS with TLS 1.2, annual SOC 2 Type II audits and GDPR-aligned privacy practices. Deployment is cloud or hybrid. Pricing is custom, based on modules, deployment model and developers in scope; no self-serve trial is offered.
Wallarm API Security
Wallarm API Security discovers APIs and protects them in real time against attacks, abuse, and account takeover. It covers REST, GraphQL, gRPC, SOAP, and WebSocket APIs without requiring an API specification, and can identify shadow, zombie, and rogue APIs. The product can generate OpenAPI specifications from live traffic and block attacks such as injection, BOLA, broken authentication, and zero-day exploits. Behavior analysis detects credential stuffing, account takeover, malicious bots, and L7 DDoS. It can surface APIs handling personal, payment, credential, or health data and map that information to compliance scope. API Leak Management scans public sources for keys, tokens, and credentials associated with customer domains. Deployment options include managed Security Edge and self-hosted Kubernetes, cloud VM, and API gateway connector setups. The Security Edge Free Tier allows 500,000 requests per month for three users per company and excludes vulnerability assessment and API Abuse Prevention. Once the monthly quota is exceeded, console access and integrations are disabled. Paid core plans require contacting sales for pricing; listed paid plans include six months of event storage.