Okay, so I just went through a pretty deep dive on this exact transition for my team's main monorepo. We were on GitHub Advanced Security (GHAS) for about 18 months, leveraging the secret scanning, code scanning (with CodeQL), and dependency scanning. The push to consolidate tools and some specific requirements around compliance reporting led us to pilot Checkmarx One, and we've now fully switched.
Here's my **detailed, pipeline-obsessed breakdown** of where each shines and where they frustrate me.
## The GHAS Experience (What I Miss)
The **integration is just seamless**. You're basically flipping switches in the UI and your Actions workflows get the `github/codeql-action/init` and `github/codeql-action/analyze` steps. The fact that CodeQL database generation and analysis happens as part of your CI, but the management, query packs, and alert triage live in the GitHub UI is super convenient.
* **CodeQL's learning curve is steep**, but writing custom queries for your own code patterns is incredibly powerful. I had a bunch for our internal framework.
* **Secret scanning on repos** is fire-and-forget and catches things pre-commit with push protection.
* The **dependency graph and Dependabot alerts** are right there, linked to the repo.
But... we started hitting limits:
* **Customizability in workflows** felt boxed in. Want to tweak the CodeQL analysis *heavily* for performance in a huge monorepo? You're diving into YAML and external config files anyway.
* The **reporting and compliance features** felt like an afterthought. Getting the exact data out in the format our security team needed was always a chore.
* While CodeQL is deep, for **SAST**, we sometimes felt blind to certain OWASP Top 10 issues that other engines seemed to catch more consistently out-of-the-box.
## The Checkmarx One Shift (The New Reality)
We're now running Checkmarx One scans via their **GitHub Actions integration** (no Jenkins here!). The configuration is more explicit, which I actually appreciate as a pipeline nut.
```yaml
- name: Checkmarx One Scan
uses: checkmarx-ts/checkmarx-action@v1.1.0
with:
base-url: ${{ secrets.CX_BASE_URL }}
client-id: ${{ secrets.CX_CLIENT_ID }}
client-secret: ${{ secrets.CX_CLIENT_SECRET }}
project-name: 'my-app-${{ github.ref_name }}'
incremental: true
scan-types: 'sast,sca'
sast-filter-preset: 'Default'
sast-threshold: true
sast-high: 10
sast-medium: 20
```
*Example of a step in our workflow. Note the explicit thresholds and scan types.*
**What's noticeably better:**
* **The SCA (dependency scanning) is more granular** in its vulnerability data and license policies. The path-through-dependency tree visualization is superior, IMO.
* **The SAST covers a broader range of vulnerability categories** immediately, without needing custom queries. The findings are also very actionable for devs.
* **Reporting and compliance dashboards** are a core strength. This was a major win for our security governance folks.
**What's more clunky:**
* It's **another interface**. You live in GitHub for code, but triage happens in Checkmarx's portal. Context switching is real.
* The **integration feels "bolted on"** compared to GHAS's native feel. You manage projects, branches, and scans within Checkmarx, not as a native GitHub concept.
* **Performance on the initial scan** was slower than CodeQL for our codebase, but incremental scans are decent.
## Which is "Better"?
It **entirely depends on your pipeline philosophy and organizational needs**.
* If you want **deep GitHub-native integration**, minimal context switching, and the power of a declarative analysis engine (CodeQL), **GHAS** is fantastic.
* If you need **strong compliance reporting**, a wider out-of-the-box SAST coverage for common vulnerabilities, and more control over scan configuration at the cost of a separate tool, **Checkmarx One** (or similar) makes sense.
For us, the reporting and compliance features tipped the scales. But I genuinely miss the tightness of the GHAS workflow. Sometimes I think about maintaining *both* in parallel, just for the SAST comparison, but our budget controller would have a heart attack.
I'm curious – has anyone else made this switch? How did you handle the workflow shift with your dev teams, especially around triage habits? And does anyone have clever pipelines that merge results from multiple scanners into a single dashboard?
pipeline all the things