Checkmarx portfolio
Merito deploys Checkmarx One, tunes its policies against your codebase and puts scanning on every pull request.
Program pillars
Why Merito for Checkmarx
Checkmarx is a specialist AppSec vendor with depth across the modern application security stack. The Agentic AI pillar (Developer Assist, Triage and Remediation) brings AI directly into the developer workflow and triage queue. The Code pillar (SAST, DAST, API Security) covers the foundational code-scanning surface. The Supply Chain pillar (AI Supply Chain Security, SCA, Malicious Package Protection, Repository Health, Software Supply Chain Security) covers the open-source and software-supply-chain surface that has become the dominant AppSec risk vector. The Cloud pillar (Container Security, IaC Security) covers cloud-native and infrastructure-as-code scanning.
A Checkmarx program covers tool deployment, policy tuning, developer enablement, CI/CD integration, triage workflow design, and ongoing run support. AppSec maturity assessment via MAPS scopes the program before implementation begins.
The Checkmarx toolchain
AI inside the developer workflow and the security triage queue. Reduces remediation cycles and false-positive review time.
Agentic AI
AI agent embedded in the developer workflow that surfaces security guidance, fix suggestions, and contextual code review during development.
Agentic AI
AI agent for the security triage queue that clusters findings, suggests remediation paths, and reduces false-positive review burden.
Foundational code-scanning across source, running applications, and APIs. The minimum AppSec surface.
Code
Checkmarx Static Application Security Testing for source-code analysis across the languages and frameworks enterprise codebases actually run.
Code
Checkmarx Dynamic Application Security Testing for running-application security across web and mobile surfaces.
Code
Open-source and software-supply-chain governance covering dependency risk, malicious packages, repository health, and AI-specific supply chain risks.
Supply Chain
AI-model and AI-component supply chain risk scanning for ML libraries, model dependencies, and AI infrastructure.
Supply Chain
Software Composition Analysis for open-source dependency risk, license compliance, and known-vulnerability tracking.
Supply Chain
Cloud-native scanning for container images and infrastructure-as-code templates.
Cloud
Infrastructure-as-code security scanning for Terraform, CloudFormation, Kubernetes, and Helm templates.
Merito services
Checkmarx One platform deployment, scanner configuration, policy tuning, and developer enablement.
Security-program assessment for Checkmarx customers consolidating SAST, DAST, SCA, and supply-chain governance.
Checkmarx scans on every pull request, wired into CI/CD, with findings managed the way developers work.
AppSec test enablement and developer-centric scanning patterns, including AI-augmented triage adoption.
Named engineer, priority SLAs, and release-time coverage for Checkmarx programs Merito implements.
Long-term run support for Checkmarx scanning pipelines, triage operations, and supply-chain governance programs.
Checkmarx One policy and triage for AppSec engineers, IDE and pull-request findings for developer advocates, and the shared findings backlog for SecOps.
AppSec engineers from Merito who know Checkmarx One across all four pillars and join your team when the program outlasts the rollout.
Checkmarx licensing
A quote starts from application and developer counts and the pillars in scope, from Code and Supply Chain to Cloud and Agentic AI.
Active development
Fresh analysis of recent Checkmarx releases, reviewed by Merito as they ship.
View all product release updatesCheckmarx One 3.66 adds native SCA reachability analysis for supported direct dependencies, plus inventory APIs, API Security analytics, and richer scan reporting. It also extends AI-assisted triage, DAST controls, SCM traceability, and developer tooling support.
Checkmarx SCA September 2026 introduces Codebashing courses for OWASP Top 10:2025 and OWASP LLM vulnerabilities. It also adds APIs to list earned certificates with role-based access and download selected certificate records by ID. The release supports governed security-training evidence for audits, release readiness, and AI application risk programs.
Checkmarx One 3.64 gives administrators organization-level control of scanner and integration settings for connected source-control organizations, including explicit project override rules. It also improves enterprise risk governance through AI usage disablement, API Security audit events, state-based policy exemptions, and inclusion of BYOR data in platform summaries and reports. SCA, DAST, MCP, SBOM, and AI Supply Chain updates broaden coverage and improve evidence for delivery, compliance, and audit teams.
Related solutions
Merito's broader AppSec program including Checkmarx, OpenText Application Security, Semgrep, Snyk, Sonatype, and Black Duck.
AppSec gates inside CI/CD with Checkmarx as the foundational scanning surface and developer-friendly findings management.
AI-augmented AppSec reducing remediation cycle time without slowing release cadence.
Frequently Asked Questions
Consultation request
Tell us about the AppSec program you run today. A Merito Checkmarx specialist follows up within one business day.
Full Checkmarx catalog
Every Checkmarx One module, from SAST and SCA to Container and IaC Security, with implementation, tuning and ongoing support scoped alongside.
MAPS-driven scoping
MAPS Assessment sizes the AppSec program before Checkmarx implementation begins, including coverage, coverage gaps, and developer enablement scope.
Next step
The first question is whether code scanning, supply chain, cloud or AI-augmented triage needs work first. The Checkmarx product recommendation follows from the answer.
API security testing for OpenAPI, REST, and GraphQL surfaces with discovery and runtime risk scoring.
Active blocking of malicious packages in the open-source ecosystem before they reach the build.
Supply Chain
Repository hygiene and health scoring for open-source projects in active dependency use.
Supply Chain
End-to-end supply-chain security covering build provenance, signing, attestation, and SBOM governance.