Checkmarx One

My main use case for Checkmarx One  is mostly for scanning and vulnerability detection, and in that, I mostly use the SAST  scans and access management for users and the remediation part for scans.

A recent scenario is that Checkmarx One  is integrated with the pipeline, so mostly our DevOps engineer can scan it from the pipeline, the security scan is initiated, and I get reports in Checkmarx, and I share that, and accordingly, I help developers to remediate vulnerabilities in the code. That's how I use it.

I also manage policies that are for security scan features like implementation of security gates, according to which, the application will be blocked from pipeline production. And to reduce vulnerability, mostly, I use it.

The best features Checkmarx One offers, in my opinion, are that it is easy to use, and there is not much deep diving into this. Anyone can use it for scanning purposes and for security gate purposes. It is really helpful, to be honest. For me, I personally believe it is a great tool.

The entire process in Checkmarx One is easy to understand, and although not a particular part stands out, there are no multiple features which I need to enable, or I have to deep dive into another tab or options for scanning and doing work. I can directly do this from the home page, and I can use it even for basic tasks.

Checkmarx One has helped with efficiency and security for sure, as I am able to detect vulnerabilities on the earliest basis and help developers to remediate them. It really helps a lot at the enterprise level.

Most probably, the most common thing that Checkmarx One does is reduce the vulnerabilities and the criticality of the vulnerabilities also. I am able to detect, and in the same way, I can collaborate with developers to remediate them on the earliest basis. That is a useful part.

I wish there could be some features to improve Checkmarx One, but I don't think so. It is an easy-to-use application, so I'm happy with the current features. I don't think there is anything required.

The latest version or upgraded version of Checkmarx One is too good, and I'm satisfied.

There are some downtimes when Checkmarx One is being upgraded to the latest version or some improvement is there. Sometimes I face issues, and I get a notification from Checkmarx. That's okay.

I have been using Checkmarx One for the last three years for my daily work in the office, in my daily routine work.

Checkmarx One's scalability is that I have a limited license number, and accordingly, it is able to manage most of my scans and the number of scans at the same time.

Customer support for Checkmarx One is good because I had some doubts or issues, so I asked them, and I got a reply within 24 working hours. That's good, I would say.

I would advise others to use Checkmarx One, as it is a good application, and for most of the work I do, I would suggest SAST  scans are really helpful, and it is easy to use. I need not do much work, and it will be helpful for any organization that is using it. I'm not sure about the pricing metrics, but it is helpful. I gave this review a rating of 9.5 out of 10.

My main use case for Checkmarx One  is that we have a Git  repository, and we are implementing and integrating Checkmarx One  to our Git  repository to manage vulnerabilities and scan for vulnerabilities inside the repository. We are scanning this repo on a monthly or quarterly basis to keep our repositories clean and secured.

A specific example of how I use Checkmarx One with my Git repository is that in the last two months, we first integrated Checkmarx One into our repository and discovered Spring  Security vulnerabilities that were causing a lot of issues in our application. Because of Checkmarx One, we easily found which vulnerability was causing the issues in our application. After the scanning, we immediately got the vulnerability list detailing whatever vulnerabilities were present in the repository, and we started working on that. This was really helpful at that time.

The best features Checkmarx One offers include the SAST  report, which really helps us during the scan. This report also aids us from a security point of view because there are some IMA controllers included. After getting the report, we have to submit it to the security team, and they scan it. This helps us for security purposes as well.

When I explore Checkmarx One, I find that the SAST  capability, accurate findings, and clean UI are very notable. It is a very dependable performance and a highly effective platform for our organization and our company.

Checkmarx One has positively impacted my organization because in the past, when Checkmarx One scan was not implemented, we faced a lot of issues finding vulnerabilities inside the repository. But now, since we have integrated Checkmarx One into our repository, we can smoothly and very easily find vulnerabilities and manage those effectively.

One way Checkmarx One could be improved is if it could automatically run scans every month after implementation. If it is possible to set it in the SAST portal to scan the repositories automatically, that would help us because currently, we have to run Checkmarx One scan manually every time.

From the perspective of needed improvements, first-line support is also necessary for Checkmarx One because sometimes people encounter issues while implementing Checkmarx One. At that time, they need help from Checkmarx team, so that support is also needed.

I am using Checkmarx One for the last one year, and the experience has been very good.

Checkmarx One is stable.

Regarding Checkmarx One's scalability, I have implemented it in two projects, and we are using Checkmarx One in both of those projects.

I can share specific outcomes with Checkmarx One. Before we did not have Checkmarx One scan, so we tried to find vulnerabilities via the G-SOC report, but that was very difficult due to a lot of troubles. However, now, because of Checkmarx One, we easily find scans for particular repositories, which helps us and it consumes very little time, making it efficient for our team as well.

My advice for others looking into using Checkmarx One is that it is good to use. If they want to implement it, I recommend they do so as it saves time and is efficient as well. I would rate Checkmarx One highly based on my positive experience with the product.

Checkmarx One  is primarily used for SAST  scans in my organization. A specific example of how I use Checkmarx One  for SAST  scans is in applications that require scanning both static and dynamic vulnerabilities. For the static vulnerabilities, Checkmarx One identifies SQL injections and other static vulnerabilities in the code.

Checkmarx One has been included in the CI/CD pipelines, so it runs automatically for all components and microservices across various applications. The tool indicates severity levels from one, two, three, and so on, and is integrated within the pipeline.

Checkmarx One offers several standout features. The tool summarizes CWE reports so I can identify what is exploitable and what is non-exploitable. It is well-integrated with other internal tools where I can disposition false positives and provides vulnerability resolutions and guidance on how to fix them, which are sometimes very helpful.

The CWE report summaries assist in my daily work by showing up in reports, allowing me to see all types of vulnerabilities at once. The tool indicates when there are multiple vulnerabilities in specific legacy code, for example, by showing that there are 12 findings for CVE X.X, and I can fix them all at once.

Checkmarx One has positively impacted the organization by providing resolution strategies and indicating which vulnerabilities need to be fixed. It is beneficial to catch vulnerabilities early in the pipeline so that any false positives can be addressed later, which is especially important for security in a banking environment.

Checkmarx One can be improved by reducing noise and improving false positive filtering. There are instances when false positives appear, such as when the word 'password' appears in a file, which actually refers to a code variable elsewhere. Checkmarx One could provide better reports, and the UI could be made more user-friendly.

Integration into the IDE  being used would be beneficial so that code does not need to be uploaded to the website and an IDE-friendly report could be generated.

Checkmarx One has been used for approximately three years.

Checkmarx One has been stable with no observed issues with downtime or reliability.

Checkmarx One has handled increased workloads adequately.

There has been no interaction with the support team.

Checkmarx One saves significant time because it is directly integrated into the CI/CD pipeline, although specific metrics are not available. The overall rating for Checkmarx One is seven out of ten, primarily based on the previously mentioned features and capabilities. Checkmarx One is a solid program that has a secure-first mentality, and no specific advice comes to mind for others considering the product. There is no business relationship with the vendor other than being a customer.