IT AI Index
Index Vendors › Checkmarx One · September 2026 Edition
Checkmarx · 1 category · Ranked

Checkmarx One

141Judge labels
26First choices
57Negative labels
12 of 12Models named it
1Category
September 2026 Edition. Every number here is derived from the raw labels under vendor table vv2026-09.2, every buyer segment counted.
Best standing
54% in SAST for enterprise buyers
Rank 44 of 47 in the mid-market standingcriticized challenger
0 of 12 models made it the first choice on the direct prompt; 48% of its 46 labels there were negative.
By buyer segmentAn enterprise product: leader at enterprise, not named at small business or mid-market.
In sast · each standing computed within its segment · bars are 0 to 100 · the accent bar is the product's own best reading

Standing by category

Every category where a model named Checkmarx One for a mid-market B2B company. Share is first choices across the direct, paraphrase, budget and scale prompts; rank is within every product named in that category.
CategoryFunctionShareRankNegative rateLabelsQuadrant
Static application security testingDeveloper platform0%44 of 4748%46criticized challenger

Movement

This is the first edition on this tier, so no move can be computed for Checkmarx One yet. From the next edition this section shows, per buyer segment, whether its share moved by more than the measured noise floor.

By model

How each model treated Checkmarx One across every prompt where it was named for a mid-market B2B company. Twelve models, six prompts per category.
ModelFirst choiceAlternativeMentionNegativeLabels
Claude Haiku 4.502103
GPT-5.4 mini11013
Gemini 3.5 Flash01045
Perplexity Sonar10113
Grok 4.1 Fast11035
Mistral Small02103
DeepSeek V4 Flash02158
Llama 4 Maverick00202
Qwen 3.7 Flash10034
Kimi K201023
GLM 4.7 FlashX01023
MiniMax M2.502114

By framing

Which of the six questions produced the naming. By model says how often; this says asked what. The first-choice count on the right carries the marks of the models that produced it.
FramingLabels by classFirst choices
Direct24 labels12
Paraphrase26 labels8
Comparative27 labels11not counted in share
Budget-constrained17 labels3
Scale-constrained20 labels3
Negative27 labels1not counted in share
First choiceAlternativeMentionNegative141 labels in all, every segment counted; 26 of the 38 first choices count toward share, since the comparative and negative framings do not. The bar is one segment per label class, to scale within the framing.

What the models said for it

Verbatim evidence the judge attached to positive labels.

“Consistently ranked as a market leader (Gartner/Forrester)... Choose Checkmarx/Veracode if you are a large enterprise” Qwen 3.7 Flash · SAST · comparative prompt · first choice
“Enterprise leader for comprehensive suites. ... Scale to Checkmarx/Snyk for enterprise.” Grok 4.1 Fast · SAST · comparative prompt · first choice
“Best enterprise all-rounders: Checkmarx, Veracode, HCL AppScan” GPT-5.4 mini · SAST · comparative prompt · first choice
“Best overall enterprise choice: Checkmarx or Veracode” Perplexity Sonar · SAST · comparative prompt · first choice

And against it

Verbatim evidence attached to negative labels. A warning on a product with few labels is a warning; on a product with many, it is one voice among them.

“Tools to Avoid on a Tight Budget ... Checkmarx One / Fortify / Vercode: These are enterprise-grade tools” Qwen 3.7 Flash · SAST · budget prompt · hard negative
“traditional enterprise legacy tools (like Checkmarx or Veracode) are usually too expensive, slow, and noisy” Gemini 3.5 Flash · SAST · paraphrase prompt · hard negative
“Avoid enterprise tools like Checkmarx and Veracode unless you have an established enterprise budget” DeepSeek V4 Flash · SAST · budget prompt · hard negative
“Why Legacy Tools (Veracode, Checkmarx, Fortify) are Usually Wrong for Mid-Market B2B” Gemini 3.5 Flash · SAST · direct prompt · hard negative

Named alongside

The products named in the same answers as Checkmarx One, over the 138 answers that named it. Took the first choice instead counts the answers where the other product was the first choice and Checkmarx One was named but was not.
ProductSame answerTook the first choice insteadHead to head
Semgrep113 of 13841Not in the top three
SonarQube105 of 13811Not in the top three
Veracode102 of 1380Not in the top three
OpenText Fortify88 of 1380Not in the top three
Snyk Code82 of 13812Not in the top three
CodeQL42 of 1382Not in the top three
Aikido Security30 of 1384Not in the top three
GitHub Advanced Security27 of 1383Not in the top three
Black Duck Coverity26 of 1380Not in the top three
Snyk20 of 1382Not in the top three
A head-to-head page exists where both products are in a category's top three. The other rows are the same fact without a page behind them, so they link to the product instead.

What carried it into the answer

The sites and pages cited by the answers that named Checkmarx One. A fact about retrieval, not a lever on the model.

Citations exist only for the models that return a source list, four of the twelve in this edition, so these counts come from 116 of the 138 answers that named Checkmarx One and are not a share of its labels.

Domains cited

appsecsanta.com72
augmentcode.com65
corgea.com65
zeropath.com64
dev.to56
pixee.ai56
checkmarx.comYour site51
cycode.com46
ox.security44
aikido.dev41

509 of the 560 domain citations in answers naming Checkmarx One came from somebody else's page.

Pages cited

Pages are listed as the models cited them.

Names read as Checkmarx One

What the judge wrote, as written, with how often. The vendor table decides that these count as Checkmarx One; a claim can dispute any of them.
Checkmarx 24Checkmarx (Checkmarx One) 1Checkmarx (CxSAST) 1Checkmarx (now part of Veracode) 1Checkmarx One / Checkmarx SAST 1
Is this your product?

Claim this page

Claiming is free and changes nothing in the data. A claimed page shows a verified contact who is told when each edition publishes and when Checkmarx One's standing changes by more than the noise floor; the right to propose corrections to the vendor table, meaning names the judge wrote that should or should not read as Checkmarx One, applied by version and listed in the change log; and a one-line description supplied by the vendor and marked as such.

It does not get any change to labels, shares or verdicts, any preview, or any say over which quotes appear. A verification link goes to your work email; an address at checkmarx.com is approved on the spot, any other address is reviewed by hand.

Your name and company appear on the claimed page, or the company alone if you ask below. A title and a LinkedIn address appear there too if you give them, and are left off if you do not. Your email address is never published.

Subscribe to the pack