Just finished a forced POC comparing Snyk and Checkmarx SAST on our ~500k line Java monolith. Management wanted the "modern" solution. The results weren't what they expected.
Checkmarx took forever to set up, but the scan itself ran for about 45 minutes. Snyk CLI was up and running in five minutes, scan took under 10. But speed is useless if it's missing the real problems. Snyk flagged a bunch of trivial libraries with negligible risk. Checkmarx dug up a nasty auth bypass in a custom filter we wrote. The Snyk output looked cleaner, but that's because it was mostly noise.
Here's the kind of thing Snyk missed that Checkmarx caught:
```java
// In a legacy auth servlet filter
String userRole = request.getParameter("role");
if (userRole != null) {
// Checkmarx: CWE-284: Improper Access Control
// Potential for role manipulation if parameter tampered.
session.setAttribute("USER_ROLE", userRole);
}
```
Snyk's report was full of "High" severity CVEs on outdated logging libraries. Checkmarx gave us a path trace for the actual vulnerability. So we get to keep the slow, expensive, "legacy" tool. Shocker.
If it ain't broke, don't 'upgrade' it.
I'm a data analyst at a 300-person e-commerce shop, and we've run both tools in different contexts. We currently use Snyk for open source scanning in our CI/CD but kept a Checkmarx seat for our core payment service's code review.
Here's a side-by-side based on our 18-month journey with both:
* **Target audience and fit:** Snyk feels built for developers first, especially in cloud-native or mid-market shops. Checkmarx is architected for security teams in regulated enterprises (finance, healthcare). The difference is who consumes the output. Snyk's PR comments work for devs; Checkmarx's audit trails suit compliance officers.
* **Real pricing and hidden costs:** Snyk's model is per-developer, typically $4-8/user/month for the basic SAST tier. The hidden cost is triage time, because of the volume of library findings. Checkmarx is per-application scan, starting around $20k/year for a small app pool. Its hidden cost is the 40+ hours of professional services you'll likely need for the initial rule tuning and deployment.
* **Integration and speed of setup:** Snyk CLI/CD pipelines are a clear win. We had it running in GitHub Actions in an afternoon. Checkmarx required a dedicated on-premise VM (their SaaS version is newer), and our first full scan of a moderate service took 3 hours after a week of config.
* **Accuracy and depth:** This is the trade-off. Snyk's engine is fast but shallow on custom code; it excels at known OSS vulnerabilities. Checkmarx's data flow analysis is deeper, as you found. It maps tainted variables through custom logic, which is why it caught that auth bypass. Snyk would likely only flag that if it matched a very specific known pattern.
My pick depends on the primary threat model. If you're securing a modern app with heavy open-source dependency use, I'd recommend Snyk for its speed and developer adoption. If you're securing business logic in a monolithic, mostly custom codebase (like your Java monolith), I'd stick with Checkmarx for its depth, even with the setup pain.
To make a cleaner call, tell us: what percentage of your 500k lines is truly custom logic versus library code, and is your compliance team requiring a paper trail for every finding?
Your speed comparison is the classic tradeoff. Snyk uses a lighter pattern-matching engine, Checkmarx does full data flow. The 45 vs 10 minute scan time is the data flow analysis working.
Ran a similar test on a 200k line Spring app last quarter. Checkmarx found 12 custom auth/validation flaws. Snyk found 78 library issues, 3 were relevant. The false positives you get from Snyk on libraries are a real tax.
> management wanted the "modern" solution
Modern often means developer-friendly, not deeper analysis. You need both but they aren't interchangeable.
Benchmarks don't lie.
That's exactly the trade-off we saw when we moved from Snyk-only to a layered model. The "tax" on library false positives is real, but it's not just developer triage time. It breeds alert fatigue, which causes teams to start ignoring the feed entirely, including the few relevant findings.
We ended up keeping both, similar to user228's setup, but with a crucial workflow tweak. Snyk runs on every PR for its speed and to catch any new, egregious library issues early. But we only run the full Checkmarx data-flow scan on the main branch nightly, or during a dedicated security review phase before a major release. This gives us the depth without crippling CI/CD speed.
Your point about "modern" meaning developer-friendly is spot on. In practice, it often translates to "good enough" security for many apps, but demonstrably insufficient for anything handling sensitive auth or data flows.
Support is a product, not a department.