Checkmarx Software Exposure Platform

Modern software delivery moves at accelerating speed, increasing pressure to ship applications quickly while the “deperimeterization” of corporate networks and pervasive internet exposure expand the attack surface. In this context, software security becomes critical, and the most proactive stance is to reduce vulnerabilities at development time rather than relying solely on downstream defenses. Because manual source code review is tedious and error-prone, organizations need automated tools that detect and help remediate issues across the entire software development life cycle.

Checkmarx is a privately held application security vendor founded in 2006 and headquartered in Ramat Gan, Israel, focused on automated code review that identifies technical and logical vulnerabilities. The company has expanded from its original static analysis roots into a broader “Software Exposure” discipline that aims to cover the full attack surface across software types (applications, APIs, firmware, services) and development phases. The Checkmarx Software Exposure Platform combines tools, integrations, managed services, and training to help organizations detect, prioritize, and mitigate software risk, including risks arising from third-party open source components, process weaknesses, and developer skill gaps. Deployment can be on-premises or in public cloud, with access via web console and IDE integrations (Visual Studio, Eclipse, IntelliJ IDEA).

Core components include CxSAST for scanning uncompiled source directly (supporting 25+ languages) with incremental scanning that can cut analysis time up to 80%, rich metadata, remediation guidance, and suppression of recurring false positives. CxAudit and CxQL enable custom queries for advanced and business-logic detections. CxOSA extends analysis to open source vulnerabilities and licensing compliance, partnering with WhiteSource and enabling policies to block risky libraries. CxIAST detects runtime issues during testing via an agent, supporting Java, .NET, and Node.js, and covering 40+ vulnerability types with minimal test-cycle impact. Unified orchestration correlates results to reduce false positives, while CxCodebashing and AppSec Accelerator support skills and DevSecOps transformation.

• Checkmarx is a privately held application security vendor headquartered in Ramat Gan, Israel.
• The company was founded in 2006.
• Checkmarx serves over 1,800 customers worldwide.
• CxSAST supports over 25 programming languages at the time of the review.
• CxSAST scans uncompiled source code directly without requiring a build first.
• Incremental scanning can reduce analysis times by up to 80% by focusing on modified code.
• CxOSA partners with WhiteSource for open source security management capabilities.
• CxIAST is targeted toward web application testing and supports Java, .NET, and Node.js test environments.
• CxIAST supports over 40 vulnerability types.
• CxCodebashing is used by large software companies including Microsoft.

• “If builders built houses the way programmers built programs, the first woodpecker to come along would destroy civilization.”
• “the only truly proactive approach towards software security is to try to develop applications without vulnerabilities.”
• “an extremely tedious and error-prone process if done manually.”
• “code review and security testing must become an integral part of the continuous delivery process, seamlessly integrating into existing development environments.”
• “introduced the notion of ‘Software Exposure’ as a discipline for covering the whole attack surface across different types of software and every phase of its development life cycle.”
• “blind trust in the quality of open source code can be extremely dangerous.”
• “known vulnerabilities are detected in real time and thus have no impact on existing test cycle times.”
• “operating together within a unified platform, ensure that developers can identify, prioritize and mitigate software risks across the whole organization and at every stage of the software development life cycle.”
• “Any eventual false positives can be eliminated once and won’t appear in subsequent scans.”
• “Some companies, especially those just starting their DevSecOps journey, may consider the product somewhat pricey for a small subset of functions they might plan to use initially.”