Checkmarx connects application scanning with AI triage and code fixes

Checkmarx combines application security testing, AI triage and developer remediation. Assess scanner coverage, Assist add-ons and credit usage together.

01 / ProductScanning and AI assistance share a security workflow

The Checkmarx One platform brings code, dependency and application security findings into a common risk workflow. Static application security testing examines code; software composition analysis examines dependencies; dynamic testing exercises a running application. Those activities answer different questions. An AI-generated endpoint can be free of a familiar code pattern while still exposing an unsafe business operation, so a broad platform is useful when teams need several kinds of evidence about the same release.

Developer Assist documentation describes real-time scanners and AI remediation inside IDEs and coding-agent environments. This gives Checkmarx a direct relationship to AI-assisted development: it checks work where code is being produced and supports fixing findings. The company also offers security for AI components. Those two uses of AI should remain distinct in an evaluation: improving an AppSec process and inspecting an application that itself uses models.

Checkmarx remains the company identity for this blueprint, with Checkmarx One and Assist treated as parts of its offer. Its company overview describes its application security focus. The reason to consider it is the breadth of this established security workflow, rather than an assumption that adding an agent removes the need for a security program. The quality of a proposed fix still depends on the finding, available context and the application’s requirements.

02 / AudienceA fit for portfolios with a remediation bottleneck

Consider an enterprise with several teams, a mix of older applications and new AI-assisted services, and findings scattered across issue trackers. The problem is often not a shortage of alerts. It is deciding which finding matters, locating its owner and getting a change accepted without breaking a release. Checkmarx is relevant when central policy and repeatable developer workflows have to coexist across that portfolio.

A smaller team with one repository may find platform setup and commercial scoping disproportionate to its immediate need. A broad scanner contract also does not replace specialist testing of authorization logic or an AI application’s end-to-end behavior. Choose the application surfaces that create risk first; then decide which engines should cover them. Buying every available module before testing the integrations makes it harder to tell which capability delivered value.

For context, Snyk’s developer security approach is another way to connect code and dependency findings to engineering work. Qodo’s review workflow addresses a different layer: reviewing changes against code context and standards. A review agent can complement a security scanner, but a useful review comment does not establish that a running endpoint resists an attack.

03 / WorkflowA proposed pilot from finding to verified repair

This is a proposed evaluation, not a report of hands-on testing. Select one service with a clear owner, a representative dependency set and a reproducible build. Preserve a baseline of known findings before enabling automated assistance. Include a finding the team already understands, one that needs application context, and one previously accepted as a false positive. That sample makes it possible to judge whether AI explanations help actual decisions.

Connect the agreed repository and scanning workflow, then ask a developer to address a finding in their normal editor. Keep the original finding, proposed patch and reviewer explanation together. The first useful milestone is a patch whose purpose the developer can explain without trusting a generated summary. Run the service’s tests and rescan the relevant surface; a disappeared alert and a successful application test are separate pieces of evidence.

The AI Triage and Remediation guide documents manual and automated routes plus a GitHub pull-request workflow. It also makes credits part of the process. During the pilot, record how many actions were requested, which produced useful analysis and which ended in accepted patches. This avoids treating every AI action as equivalent to a completed security improvement.

Use a small, clearly named set of branches and repositories for the experiment. If an assistant can initiate scans or remediation through an integration, give it only the authority required for that job. Keep merge responsibility with the existing owner. A practical acceptance record should show why a finding was fixed, suppressed or deferred, including the human decision where the result remains ambiguous. The result is a repeatable remediation path rather than a larger alert dashboard.

04 / PricingQuote the package and the AI usage separately

The current pricing page uses tailored quotes rather than a universal list price. It identifies module selection, deployment model and developer scope as pricing inputs. Its package cards list Checkmarx Assist and AI Inventory as add-ons. The FAQ’s summary of Professional coverage does not fully match the cards, so the signed module schedule should resolve inclusion rather than a buyer assuming that a tier name includes every AI feature.

The triage guide says repeat analysis of an identical instance ordinarily avoids another charge, while changing SAST result grouping can cause analysis to run again. That operational detail can affect costs during a migration or broad policy change. Ask for a realistic monthly action estimate based on the pilot’s actual findings. Do not convert credits into a dollar cost without the organization’s agreed rate, included capacity and contractual treatment of additional consumption.

05 / DistinctionsThe useful distinction is where remediation happens

Checkmarx places a security workflow both near code creation and after scanning. Early assistance may help a developer correct a change while its intent is fresh. Central triage can address a portfolio backlog. These are different audiences and should have different success measures: interrupted development time for the first, risk reduction and accepted remediation for the second. Counting all activity in a single AI-adoption metric would hide those tradeoffs.

The MCP server guide describes exposing Checkmarx One operations to compatible assistants through its APIs. The architectural advantage is access to the same security records from an assistant workflow. Natural-language access does not by itself change the evidence behind a finding, and account configuration, regional endpoints and permissions still determine what the assistant can do.

Another practical distinction is preserving scanner evidence while adding interpretation. A generated explanation should make a call path or vulnerable operation easier to inspect. When an explanation merely restates a severity label, it adds little. When it identifies the relevant validation or explains why a patch preserves behavior, it can reduce the work required from the reviewer. Test that difference with your code instead of adopting a vendor-wide productivity claim.

06 / QuestionsResolve coverage and control before expanding

Confirm the exact language, framework and deployment support required by the pilot. The public platform overview is broader than any one licensed combination. Ask which Assist activities run locally, which send code or findings to hosted services, and which controls govern retention and model processing for the chosen setup. A self-hosted scanner and a hosted AI integration should not be assumed to have identical data boundaries.

Check the current status of features carrying future-availability labels before making them dependencies. The pricing navigation, for example, marks MCP Scanning as coming soon; this is distinct from using an MCP server to access existing platform operations. A team needing to audit its own MCP tools should require a demonstrated supported scanning route, rather than confusing those similarly named capabilities.

Finally, test exception handling. A safe fix might require architectural work that an inline patch cannot deliver. An accurate suppression may become invalid after a surrounding service changes. The operating process should identify who reviews these cases, how assumptions are retained and when a finding is revisited. AI assistance is most useful when it shortens that work while keeping the reason for the decision visible.

07 / DecisionChoose the first security loop you want to improve

Use Checkmarx when an application security program needs shared scanning evidence and a practical path into developer remediation. Start with a service whose security and engineering owners can jointly judge results. Expansion becomes easier to justify when the team can show accepted repairs, manageable interruptions and understood AI consumption. The next step depends on whether the immediate need is portfolio consistency, editor assistance or an unresolved deployment requirement.