Checkmarx One

Vorteile

The ability to use CI/CD pipelines so when the build task kicks off, scanning for static code and open source libraries is done at build time.

Nachteile

The only thing I do not like is we have some languages that the product does not support like ColdFusion and R-Code.

Vorteile

Easy of use, the 0 complexity it adds to configure a new project, it feels to work in a collaborative way even in an on premise environment.

Nachteile

The implementation requires Windows and SQL, i would prefer that it runs on linux with postgresql.
The reporting could be improved.

Vorteile

It certainly covers all the vulnerability rules you would ever need.

Nachteile

It is SUPER expensive, very slow and the reporting is too messy. It would have been better if it can take a more integrated into the code approach like Sonar.

Vorteile

CXSast has several very important advantages. The first is that the code is scanned before it is even compiled, this means that de developers can scan and fix while they are still in the coding process.

Second CXSAST fully integrates in any devops proces. Scanning and reporting will be doen from within the screens developers work in, so no unneccesary switching between screens. (see extention CXflow)

Nex to that the rules (or queries) are open, every one can see them or a organisation can tailor them to their own need. If needed a FP free setup can be created!

V9.3 now enable installation of the engines on Linux, you can dockarize the stuff

Last but not least CXSast can be setup with additions such as CX-SCA (opensource analysis) and CX-IAST (passive IAST scanning)

Nachteile

The installation can sometimes be difficult. However Checkmarx counters this by offering free installation services for their costumers.

Vorteile

Can be used to analyse application, source code, byte code, and binaries for coding and design conditions.Key elements of the checkmarx dashboard can be split into two sections, namely scan, statistics and scan trends.

Nachteile

Unavailable or downtime of application causes delay in deploying the code through pipeline which is integrated with Checkmarx.

Vorteile

Finding code vulnerabilities is hard. CxSAST makes it easy. Not only does it point out the vulnerability, it explains why the code is vulnerable, which is very valuable for future proofing code.

Nachteile

Can sometimes include false positives. However this is mitigated by selecting “proposed not exploitable” if necessary.

Vorteile

We use this tool to check security vulnerabilities
Option to configure multiple projects
Compare the results between two scans
Download the report results

Nachteile

Not very User-Friendly.
Takes time to run the scan
Difficult to configure with development studios.