Checkmarx One vs Waratek IAST

Checkmarx One is a paid web application-security platform focused on source-code analysis. It integrates with CI/CD workflows, scans pull requests, and supports IDE use so security checks can occur during development. Teams can define custom security rules and custom rules for their requirements, while automated fixes assist with remediation. The listed analysis target is source code. Pull-request scanning provides a way to examine proposed changes, and CI/CD integration connects checks with delivery processes. IDE support places analysis in developer tooling. Checkmarx One has no free plan, and pricing is available on request. The company was founded in 2006. Its web delivery model combines configurable security policies with automated assistance for addressing findings, without listing additional analysis targets or a free tier.

Waratek IAST monitors Java applications as they run to identify vulnerabilities in application behavior. Runtime instrumentation tracks data flow and execution paths, and findings include the code line involved, a full stack trace, and the flow that led to the issue. Waratek says it analyzes compiled bytecode or binaries without source-code access. QA teams or automated suites can generate security insights while running regular functional tests, without a separate security scan phase. The product is offered through a Portal SaaS option or an on-prem Portal Dedicated deployment. Starter is a free trial for one application, with runtime analysis, basic CI/CD integration, standard vulnerability reporting, and email and knowledge base support. Team costs $2,499 per month and includes three applications, with the option to add up to two more for $833/mo per additional app. Jira and Slack integrations are marked Coming Soon. Enterprise pricing is custom, and its custom rulesets, advanced CI/CD plugins, and software composition analysis are marked Coming Soon. Waratek reports a 100% true positive rate, 0% false positive rate, and OWASP Benchmark score of 100.