Integrate Checkmarx One with Vulnetix. Export SAST scan results as SARIF via the Checkmarx CLI.
How Vulnetix compares: better together
Vulnetix does not replace Checkmarx One. Keep running it. Vulnetix sits on top of Checkmarx One (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Checkmarx One is strongest at its core category and also carries features in SCA, DAST, IaC & Cloud Configuration, Container & Image Scanning, Secret Scanning, SBOM Generation, License Compliance, just as Vulnetix spans categories.
| Capability | Vulnetix | Checkmarx One |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ Core enterprise SAST, 30+ languages |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✓ SCA with exploitable-path validation against source |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✓ Native DAST against running apps and APIs |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✓ Container security in supply-chain module |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ IaC security scanning built into IDE/CI |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✓ Secrets detection in Developer Assist |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ~ License data surfaced via SCA |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✓ SBOM report generation; can scan an SBOM file |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✓ Malicious Package Protection with large threat DB |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✓ ASPM control plane correlates findings across scanners |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✓ CxScore uses EPSS + CISA KEV + PoC availability |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✓ Exploitable Path traces call path to vulnerable functions |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✓ VEX triage of OSS deps, exportable within SBOMs |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ AI fix suggestions and non-vulnerable replacement packages |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Checkmarx One does well
- Enterprise-grade SAST with market-leading language breadth (30+) and a deep, precise engine trusted in heavily regulated industries (finance, healthcare, government)
- Genuinely unified multi-scanner platform (SAST, SCA, DAST, API security, IaC, container, secrets, malicious-package protection) under one ASPM control plane
- Exploitable Path analysis correlates SCA findings with SAST call-graphs to prove whether a vulnerable package is actually reached from first-party code
- CxScore prioritisation blends severity with EPSS, CISA KEV, Exploitable Path and PoC availability, plus AI-generated fix/replacement-package suggestions
Where Vulnetix adds to it: Checkmarx One is a strong unified AppSec suite with its own ASPM; Vulnetix does not replace its scanners. Vulnetix ingests Checkmarx SAST/SCA/DAST/IaC/container output (and Vulnetix does NOT itself run DAST) folding it into a vendor-neutral cross-scanner queue that also consolidates tools Checkmarx does not run (cloud/CSPM, network, fuzzing, MAST, pentest). On top it adds broader exploit-intel (Coalition ESS, CWSS, Vulnetix LEV alongside EPSS/KEV), immutable versioned VEX with full audit history, install-time package firewall across 25+ registries, EOL policy and SSVC decisioning.
No migration, no rip-and-replace. Checkmarx One keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Checkmarx One results in Vulnetix
Upload Checkmarx One SARIF, CycloneDX, SPDX output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.