Checkmarx • Application security
Checkmarx SAST scans 30+ languages including Java, JavaScript, TypeScript, Python, C#, Go, Rust, Apex, and COBOL with reachability-aware findings, Best Fix Location guidance, and a custom query language (CxQL) that lets AppSec teams encode their own coding standards.
Checkmarx SAST rollouts spend month one on policy tuning, because vendor defaults bury real findings. CxQL rules for your standards, suppression workflows and pull-request checks in CI/CD come next.
What it is
Checkmarx SAST is the static analysis engine inside Checkmarx One. Its language breadth covers JavaScript and TypeScript, Java, C# and .NET, Python, Go, Rust, Ruby, PHP, Kotlin, Scala, Swift, C/C++, Apex, and COBOL. The same engine handles modern microservices and the legacy stacks regulated enterprises still maintain, which is the reason large AppSec programs pick Checkmarx over single-language specialists.
Two engine features carry most of the program-level value. Best Fix Location returns one fix point per logical vulnerability instead of dumping every flow path as a separate ticket and tells the developer where one edit closes the most paths. Custom rules through the CxQL query language let AppSec teams encode internal standards (must use this internal crypto wrapper, must validate input through this gateway, must not log this PII field) so policy enforcement runs inside the scanner instead of being managed in a separate document nobody reads.
The Exploitable Path Analysis (EPA) signal extends from SCA into SAST findings. Vulnerabilities in code paths that production entry points never call are demoted, so the queue ranks what an attacker could reach above lines that are vulnerable only in theory. On portfolios with deep dependency trees and large legacy footprints, that distinction is the difference between a 50,000-finding backlog nobody touches and a several-thousand-finding queue that AppSec actually works.
SAST adoption usually fails on policy drift. When vendor-default policies are never tuned, false positives pile up, developers stop trusting the scanner by month two, and the scan turns into a checkbox nobody reads. A Checkmarx SAST rollout therefore opens with policy tuned to the customer's risk tolerance, suppressions that are auditable rather than a graveyard of ignored findings, and findings posted on the pull request where developers already review code.
Ideal use cases
What it is best at
30+ languages including JavaScript, TypeScript, Java, C#, .NET, Python, Go, Rust, Ruby, PHP, Kotlin, Scala, Swift, C/C++, Salesforce Apex, and COBOL. Single-language SAST tools force enterprises to bolt together specialist scanners; Checkmarx covers the modern and the legacy stacks in one engine.
One fix point per logical vulnerability instead of one ticket per flow path. On large codebases this is the difference between a 50,000-finding backlog and a tractable queue. Developers stop seeing duplicates of the same issue under different stack traces.
Larger AppSec programs need to enforce their own coding standards (internal crypto wrapper required, input must traverse named gateway, certain logging patterns are forbidden). CxQL lets AppSec architects write those rules into the scanner directly. Few competing SAST tools expose a real query language at this depth.
Exploitable Path Analysis demotes findings in unreachable code paths so the backlog reflects what attackers can actually exploit. Combined with SCA reachability on dependencies, the program ships fewer tickets that developers correctly recognize as noise.
Incremental scan mode analyzes only the diff and reaches deltas in seconds rather than re-scanning the full codebase every PR. Build-gate latency stops being the reason developers ask to bypass SAST.
Core capabilities
The static analysis core that does the heavy lifting across modern and legacy code.
30+ language support
JavaScript, TypeScript, Java, C#, .NET, Python, Go, Rust, Ruby, PHP, Kotlin, Scala, Swift, C/C++, Salesforce Apex, COBOL, and more in a single engine. Supports microservices and mainframe-adjacent code in the same program.
Best Fix Location
Identifies the single edit point that resolves the largest number of flow paths and emits one finding instead of dozens. Reduces ticket volume on enterprise codebases by a meaningful margin.
Incremental scanning
Diff-based analysis returns PR-time results in seconds instead of full-scan minutes. Keeps build gates fast enough that developers stop asking to skip SAST.
Exploitable Path Analysis (EPA)
Reachability-aware scoring that demotes unreachable findings, so triage starts with code an attacker can reach from a real entry point.
Encoding the customer's internal coding standards inside the scanner instead of in a wiki.
CxQL query language
First-class custom-rule authoring. AppSec architects write organization-specific rules (internal crypto wrappers, mandatory input gateways, banned logging patterns) and ship them as scanner policy.
Policy tuning per application
Rule sets and severity thresholds are set per repository or business unit, so a public-facing payment service gets a stricter Checkmarx policy than internal tooling.
Suppression discipline
Auditable suppression workflows with expiry, reviewer assignment, and rationale capture. Suppressions stop being permanent ignore lists.
SAST in the developer workflow, not a separate dashboard.
PR-time scanning
Scans the changed lines of each pull request and comments findings inline. Developers see issues in the review they were already doing.
Build-gate policy
Configurable thresholds (severity, count, age) pass or fail each build. New vulnerabilities are blocked as they are introduced, while the older backlog is triaged on its own schedule.
Findings forwarding
Direct integration with Jira, Azure Boards, ServiceNow, and other ticket systems. Findings become trackable work items rather than dashboard rows.
IDE integration
VS Code, IntelliJ, and Eclipse plugins surface findings during authoring. Pairs naturally with Checkmarx Developer Assist for AI-suggested fixes.
Where it fits in the stack
Deployment and implementation
Licensing and packaging
Checkmarx One Essentials
SAST plus baseline SCA and Container Security in a single bundle.
Best for: Programs starting consolidation onto Checkmarx One.
Checkmarx One Advanced
Gives SAST findings runtime confirmation through DAST and API Security, and adds IaC Security, Malicious Package Protection and Repository Health.
Best for: Mature AppSec programs running multiple scan types.
Checkmarx One Enterprise
Puts Developer Assist fix suggestions and Triage and Remediation on top of SAST findings and includes premium SLAs plus Software Supply Chain Security and AI Supply Chain Security.
Best for: Enterprise programs with AI-augmented triage and supply-chain governance in scope.
Merito services
Pick the engagement that matches where you are in the lifecycle.
Tenant setup, policy tuning, language configuration, and CI/CD integration.
Explore serviceAppSec program scoping for Checkmarx SAST adoption alongside or against Semgrep, Snyk Code, Veracode, and OpenText Fortify SAST.
Explore serviceSAST checks on pull requests and builds across GitHub Actions, Azure DevOps, GitLab CI, Jenkins and Bitbucket, using incremental scans so pipelines stay fast.
Explore serviceNamed engineer, priority SLAs, and release-time coverage for Checkmarx SAST in production.
Explore servicePolicy retuned against new findings, CxQL rules kept current as coding standards change, and suppression reviews so ignored findings do not pile up again.
Explore serviceCxQL rule-writing workshops for AppSec architects, suppression-workflow training for security engineers, and onboarding for developers who see SAST results in pull requests.
Explore serviceAppSec engineers fluent in CxQL and Checkmarx One, placed on your team for as long as the SAST program needs them.
Explore serviceCheckmarx SAST licensing
Best Fix Location and Exploitable Path Analysis only shrink the backlog when they are switched on early and the policies are tuned to your risk tolerance.
Merito point of view
Some Checkmarx SAST programs have an engine that works fine and solid language coverage, and the backlog still grows uncontrollably. The cause is almost always that vendor-default policies were never tuned to the customer's actual risk tolerance, suppressions accumulated as a permanent ignore list instead of an auditable workflow, and findings flowed to a queue that nobody owned. Those are policy and operating-model problems, and no SAST replacement fixes them.
Checkmarx SAST is the right pick when the program needs language breadth across modern and legacy stacks, when CxQL custom rules let internal coding standards become enforceable, or when consolidation onto a single Checkmarx One platform pays back the migration cost. Where mature Snyk Code or Veracode pipelines already run, a move to Checkmarx is a 12-month effort that seldom gains enough to justify the disruption, and the honest recommendation is to stay put.
Best Fix Location and Exploitable Path Analysis are the two engine features that materially change backlog math. Programs adopting Checkmarx SAST without using either are leaving the productized advantages on the table. Merito's engagements turn both on early so the program ships fewer false positives and lower-priority findings.
What buyers usually underestimate
Related from Merito
Related solutions
Related services
Related products
Frequently Asked Questions
Consultation request
Share the size and languages of your codebase, your current SAST tool if there is one, and how the AppSec program is run. A Merito Checkmarx specialist follows up within one business day.
Language breadth
30+ languages including COBOL and Apex alongside JavaScript and Go. One scanner across the portfolio instead of stitched specialist tools.
Policy first
Vendor defaults generate noise. Merito's first thirty days are policy tuning, CxQL rule authoring, and suppression-workflow design.
Next step
A Merito Checkmarx SAST engagement starts with policy tuning, CxQL rule authoring, and PR-time integration.
Proof and resources
Checkmarx Fusion pairs deterministic SAST with a further layer of frontier AI reasoning, backed by a published F1 score. Here's how the hybrid architecture works, and why it matters as patch-to-exploit timelines collapse toward zero.