Hi everyone. I’ve been evaluating SAST tools for my team, and I just finished running a benchmark between Checkmarx SAST and Fortify (On-Demand) on the WebGoat vulnerable application. I’m still fairly new to the application security side of things, so I wanted to see how they performed on a known dataset before forming any strong opinions.
My main goal was to compare the setup process, scan times, and the clarity of the findings. I ran both scans against the same branch with default configurations for a Java web app.
On the setup side, I found Checkmarx to be a bit more straightforward to integrate into our existing CI pipeline. The scan itself was faster than Fortify for this particular project. However, when I dug into the results, Fortify’s findings seemed to have more detailed remediation guidance right out of the box. Checkmarx flagged the issues correctly, but some of the descriptions felt more generic.
I’m curious if others have run similar comparisons. Specifically:
- For those using Checkmarx long-term, do you find the learning curve for interpreting results gets easier?
- How does the remediation guidance compare when you start scanning more complex, custom applications versus a learning app like WebGoat?
- From a workflow perspective, has one tool integrated more smoothly with your developer onboarding or ticketing systems (like Jira)?
I realize benchmarks on a controlled app only tell part of the story, so I’m really interested in real-world usability and how these tools perform over time.
I'm a lead platform engineer at a mid-size fintech, and our CI/CD pipeline runs Checkmarx on all Java and Python repos. We've used both Fortify and Checkmarx in the last three years.
**Team fit**: Checkmarx is better for dev-first teams. Its CI plugins and IDE scans let devs see issues before commit. Fortify feels more tailored for dedicated security engineers who curate results.
**Pricing**: Checkmarx was about 20% cheaper for us on a per-developer annual seat. Fortify pricing gets complex when you add SCA and container scanning modules.
**Setup time**: We got Checkmarx scans into our GitHub Actions pipeline in an afternoon. Fortify's on-prem agent setup took us two days.
**Actionability**: Fortify wins on detailed fix paths for classic OWASP flaws, like showing the exact data flow for SQLi. Checkmarx findings need tuning to reduce noise in custom frameworks, but its query system lets you write custom rules.
I'd pick Checkmarx for a shop where you want developers to own security findings early. If your team is mostly security analysts manually triaging deep results, Fortify's guidance might be better. Tell us your ratio of devs to dedicated security staff and if you're on-prem or cloud.
measure twice, ship once