In June 2026, Anthropic ran an experiment that's worth mentioning before getting into the product details. Researchers gave the company's Mythos Preview model 18 security patches for SpiderMonkey, Firefox's JavaScript engine, and asked it to reverse-engineer working exploits from them. It had its first one running within an hour of Mozilla shipping the fix. The Firefox release carrying that fix was still 18 days from reaching users. A separate run against 21 Windows kernel vulnerabilities went almost as fast with proof-of-concept code for 18 of them, with the first in just 31 minutes.
That's the backdrop against which Checkmarx introduced Checkmarx Fusion on July 28, 2026, a hybrid scanning architecture built into Checkmarx One that Merito has been tracking closely since. The premise is straightforward, if the time between a patch existing and an exploit existing is shrinking toward zero, a scanner a security team has to double-check before trusting it is no longer just inconvenient. Fusion combines deterministic scanning with AI reasoning and measures the result with F1, a metric that captures both sides of accuracy in one number.
What Fusion actually does
Fusion runs a rules-based scanner and an AI-based scanner side by side and reconciles their output. A deterministic engine applies the rules-based detection logic Checkmarx has built over two decades. This gives customers a consistent and explainable result, but limited to whatever already has a matching rule or signature. Alongside it, a language-agnostic AI-based engine reasons over code more like a human reviewer would, reaching into frameworks and logic patterns that rules don't cover well, including a good deal of what AI coding assistants now write. A Findings Analysis Engine then examines the output of both, removes duplicates, confirms or suppresses individual findings, and produces one result set instead of two competing ones.
Fusion then adds a second reasoning pass. A curated set of frontier large language models, delivered through partners including Anthropic, reviews the Findings Analysis Engine's output for vulnerabilities that have no existing rule, CVE, or signature. Checkmarx made this layer model-agnostic, so customers can match model cost to each project.
Fusion is in early access within Checkmarx One now, for SAST specifically, with general availability expected in October 2026. It isn't available for on-premises SAST deployments. Checkmarx has said publicly that secrets detection, IaC, API security, and DAST are next.
What F1 measures
F1 is a single score that combines precision and recall to measure a detection model's accuracy. It matters here because a scanner fails in exactly two ways. It can flag code that isn't vulnerable, a false positive, or it can miss code that is, a false negative. Most of the language vendors use to describe accuracy only ever addresses one side of that, "detected X vulnerabilities" says nothing about what got missed, and "fewer false positives than the competition" says nothing about whether that quiet queue is quiet because it's accurate or because it's timid. Tuning a scanner for maximum recall buries real findings in noise, and tuning it for certainty produces a clean dashboard that hides missed issues.
F1 is the harmonic mean of precision (the share of flagged code that was vulnerable) and recall (the share of vulnerable code that got flagged). As a harmonic mean, it drops sharply when either side is weak, so trading one for the other can't inflate it.
Checkmarx has published F1 figures at two stages of this rollout. Announced June 15, 2026, the hybrid engine on its own, deterministic plus AI-based plus the Findings Analysis Engine, is what Checkmarx now calls NG SAST on its innovations page. The outcome, "three engines, one clean result set," scoring 0.64 against a roughly 0.20 average the company attributes to query-based, rules-only SAST, alongside a reported 60% drop in false positives. CEO Sandeep Johri said at the time,"No single approach, rules-based or AI, tells the whole story on its own." With the Fusion layer added on top, Checkmarx's own listing puts the result at "0.74 F1 in SAST, and the same answer every scan," a nod to the consistency problem that raw accuracy numbers alone don't address. CPO Jonathan Rende focused on what teams can act on, "What teams need isn't just more findings, it's confidence and predictability."
Why neither half works alone
Deterministic, rules-based scanning is consistent and auditable, but it's structurally blind to anything without a matching pattern already on file. That's a growing problem as more production code gets written or shaped by AI coding assistants that don't always follow the conventions a rules engine was trained against. A general-purpose frontier model handles that kind of contextual reasoning well, but it wasn't built for security validation specifically. Output can vary between runs, and a model built to produce plausible, functional answers doesn't reliably flag its own uncertainty the way a deterministic check does by design.
Reconciling the two before a human ever sees the output is what lets an organization pick up the AI layer's coverage without losing the reproducibility rules-based scanning has spent two decades earning. The climb from 0.20 to 0.64 to 0.74 across each added layer measures that gap closing.
It's also a reasonable proxy for where the broader application security market is headed. Both camps are converging, with rules-based vendors adding AI reasoning and AI-native vendors adding deterministic checks. Whether a vendor publishes precision and recall, and how openly, is likely to say more about its tooling over the next few product cycles than any single feature comparison.
What this means in practice
For a security team, the F1 gains translate into a few concrete things. Checkmarx reports a 60-70% reduction in false positives compared to standalone AI scanning, so fewer findings need manual review before triage starts. Coverage extends to the kind of novel logic flaw a purely rules-based scanner can't catch by definition, which matters more as AI-generated code makes up a larger share of what gets scanned. Because the architecture is model-agnostic, teams can weigh cost against thoroughness per project. And because Fusion's output feeds into Checkmarx One's existing risk view, it doesn't create another dashboard to reconcile by hand; it can feed straight into triage and remediation workflows already built on that platform.
Security teams still own prioritization and remediation. Erik Brown, an AppSec leader at Nelnet, said, "With AI generating unprecedented amounts of code, security has to be an enabler, not a bottleneck." Fusion's aim is to give that judgment a cleaner, more trustworthy set of findings to start from.
Fusion is one piece of a broader platform. Checkmarx's own list of current innovations places it alongside an MCP Server that gives AI coding assistants "secure, governed access to Checkmarx One through a single MCP connection," an AI-BOM that tracks the dependency risk traditional SBOMs miss (models, agents, MCP servers, fine-tuning datasets), and a pair of Triage and Remediation Assist agents built to act on whatever a scanner like Fusion hands them. Fusion produces the result set, and those tools handle what comes next.
Resources
Shared for this piece:
- Checkmarx Fusion — product page
- Checkmarx One Achieves Industry's Highest Scanning Fidelity — Yahoo Finance syndication
- Learnings from Checkmarx Agentic AppSec Unleashed '26
- What Is Checkmarx Fusion?
- Checkmarx Fusion: Hybrid SAST for Higher Detection Accuracy
Additional primary sources used to verify figures and dates:
- Checkmarx One Achieves Industry's Highest Scanning Fidelity — press release, June 15, 2026
- Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection Available — press release, July 28, 2026
- Checkmarx Unveils Next Generation SAST Engine with Hybrid AI Architecture — SD Times
- Anthropic — N-days research, published June 8, 2026
- N-day is Becoming N-Hour: Patching Faster Won't Save You — The Hacker News
- Checkmarx — Latest Innovations (Live section)
