Having managed SAST implementations across multiple martech stacks, I'm evaluating a platform switch for our internal development. We've used Veracode for three years but are under pressure to consolidate with a vendor already providing other services (Checkmarx).
My primary concern is the delta in analysis methodology and the operational impact. Veracode's binary/agentless scanning is a known quantity, but I understand Checkmarx requires source code access and uses a different AST engine. For those who have made this move:
* What was the tangible change in false-positive rates, especially for modern JavaScript frameworks and API layers? Veracode tends to over-flag in our React/Node.js services.
* How does Checkmarx handle monorepos (specifically pnpm workspaces) compared to Veracode's project structuring? Our current pipeline depends on granular, path-based scans.
* Was there a significant shift in remediation workload? I'm less interested in "it's better/worse" and more in the *type* of findings that became prevalent—e.g., a move from more path traversal issues to injection flaws.
Our metrics show a current baseline of ~15% false positives with Veracode after tuning, and scan times averaging 8 minutes per service. Any data points comparing these operational benchmarks post-migration would be invaluable.
Show me the data