In June 2026, Anthropic ran an experiment that's worth mentioning before getting into the product details. Researchers gave the company's Mythos Preview model 18 security patches for SpiderMonkey, Firefox's JavaScript engine, and asked it to reverse-engineer working exploits from them. It had its first one running within an hour of Mozilla shipping the fix. The Firefox release carrying that fix was still 18 days from reaching users. A separate run against 21 Windows kernel vulnerabilities went almost as fast with proof-of-concept code for 18 of them, with the first in just 31 minutes.
That's the backdrop against which Checkmarx introduced Checkmarx Fusion on July 28, 2026, a hybrid scanning architecture built into Checkmarx One that Merito has been tracking closely since. The premise is straightforward, if the time between a patch existing and an exploit existing is shrinking toward zero, a scanner a security team has to double-check before trusting it is no longer just inconvenient. Fusion combines deterministic scanning with AI reasoning and measures the result with F1, a metric that captures both sides of accuracy in one number.
What Fusion actually does
Fusion runs a rules-based scanner and an AI-based scanner side by side and reconciles their output. A deterministic engine applies the rules-based detection logic Checkmarx has built over two decades. This gives customers a consistent and explainable result, but limited to whatever already has a matching rule or signature. Alongside it, a language-agnostic AI-based engine reasons over code more like a human reviewer would, reaching into frameworks and logic patterns that rules don't cover well, including a good deal of what AI coding assistants now write. A Findings Analysis Engine then examines the output of both, removes duplicates, confirms or suppresses individual findings, and produces one result set instead of two competing ones.
