I'm looking at the Checkmarx platform for our team's SAST needs, but I've been burned before by vendors who advertise flexible pricing only to lock you into an auto-renewing three-year contract with hidden support fees after the first year.
Their sales team is pushing for a call to discuss "tailored quotes," which is always a red flag for opaque pricing. Has anyone recently gone through their sign-up process for a team of 25-50 developers? I need to know:
What does the actual onboarding entail after the initial demo? Is there a mandatory professional services package to get started, or can you truly self-service with their documentation?
Once you get a quote, are there any non-negotiable clauses like automatic renewal or price increases beyond a certain percentage year over year?
Beyond the core license cost, what are the actual additional fees? I'm specifically concerned about costs for scaling the number of scans, premium support tiers that become "essential," or fees for integrating with specific CI/CD pipelines.
I'm not interested in sales pitches. I need factual reports from teams who have signed a contract in the last 18 months. What did the final agreement look like compared to the initial quote?
—AF
Yeah, the "tailored quotes" thing is the standard playbook for a reason. I went through this with them about a year ago for a team of 30 devs.
To your main points: onboarding wasn't mandatory, but they heavily, heavily pushed their professional services package. The docs exist, but they're not great for a complex setup. You can self-service if you have a dedicated security engineer, otherwise you'll feel the pain.
Our final contract did have an auto-renewal clause, but we got it negotiated down to a 30-day notice window. Watch for the support fee structure - they tried to base it on a percentage of the license cost, which balloons over time. We pushed for a fixed fee. Also, ask about scan credits vs. unlimited scans. The "unlimited" model is priced for a certain volume, and exceeding it triggers a costly true-up.
Get everything they say about integrations and pipelines in writing on the quote. That was a sticking point later for us. Good luck
Still looking for the perfect one
The percentage of license cost support fee is the oldest trick in the book. Glad you pushed back. That clause is pure margin expansion on their part, disguised as 'support'.
And even the 'fixed fee' isn't safe. Last renewal they tried to redefine it as fixed per developer, not for the entire team. Had to pull out the initial email chain where their rep explicitly said "annual fixed fee, period."
> Get everything they say... in writing on the quote.
This is the only part that matters. If it's not on the official quote/order form, it doesn't exist. Their 'standard' contract will have language that directly contradicts any verbal promises about integrations.
Your stack is too complicated.
Completely get your frustration, been there with other platforms. To your point about scaling scans and CI/CD fees - that's exactly where they get you.
We pushed hard on the "unlimited scans" definition. Turns out it's unlimited *based on your initial developer count*. If you grow your team significantly, the "true-up" at renewal can be a massive, unexpected line item. Ask them to explicitly define the scan capacity in the contract annex.
For CI/CD, they said native plugins were free, but any "custom integration work" for our Jenkins setup triggered a professional services fee. That line is very blurry. Get them to list every integration method included in your tier, by name, before signing.
spreadsheet ninja