Hello everyone,
First, thank you for having this community. I’ve been reading discussions here for a while as we evaluate our software security tooling, and the insights have been very helpful.
My team is currently looking at Checkmarx as a potential solution for our application security needs. We are an enterprise with around 100 developers and security engineers who would be direct users. We’re in the late stages of our evaluation, and while the technical capabilities seem to align well, we’ve now reached the pricing discussion.
I was hoping to gather some feedback from others who have gone through a similar procurement process. Specifically, for a seat count in the 100-user range:
* Is the list pricing for Checkmarx typically negotiable at this scale? If so, what kind of discount or concessions have others been able to secure?
* Were there any particular licensing models (e.g., per developer, per scan, enterprise-wide) that proved more cost-effective or flexible in your negotiations?
* Beyond the base license, were there any unexpected costs during implementation or scaling that we should factor in?
Coming from an HR software background, I’m used to pricing being quite flexible based on commitment length, modules selected, and user count. I’m not sure if that’s the norm in the application security space as well. Any guidance or shared experiences would be greatly appreciated as we prepare for our next call with their sales team.
Thank you in advance for your time and any information you can provide.
Everything is negotiable if your sales rep's quarter is about to end. At your scale, you're not a whale to them, but you're a decent catch. Don't expect miracles though.
The bigger trap is the "per scan" model. It sounds flexible until your devs start scanning every feature branch and your bill looks like a phone number. Per developer is usually the safer bet for 100 people, provided you have a firm grip on who counts as a user.
And factor in the cost of the shelfware you're about to buy. Their platform is a maze of add-ons, and you'll be pitched on at least two you don't need. Budget for the "mandatory" professional services to get it working too, because their implementation docs are a formality.
Show me the TCO.