Checkmarx

Checkmarx is an application security (AppSec) company founded in Israel. It develops tools that help software development teams find and fix security vulnerabilities in source code before applications are deployed. The company is privately held and is headquartered in Herzliya, Israel, with significant operations in the United States.

Checkmarx's primary focus is static application security testing (SAST), which involves scanning source code for security flaws during the software development lifecycle. Its tools are used by security and development teams — typically in enterprise environments — to embed security checks directly into CI/CD pipelines and developer workflows. The buyer profile is predominantly enterprise: large organizations in financial services, healthcare, government, and technology sectors. The company sells through a combination of direct enterprise sales and channel partners.

Checkmarx's flagship product is its SAST engine, which scans code written in a wide range of programming languages for known vulnerability patterns. Over time the company expanded its platform to include software composition analysis (SCA), which identifies vulnerabilities in open-source dependencies, as well as infrastructure-as-code (IaC) scanning. The unified platform is marketed under the Checkmarx One brand, consolidating previously separate product lines into a single AppSec platform. Checkmarx also offers DAST (dynamic application security testing) capabilities as part of the broader platform.

Checkmarx competes primarily with Veracode, Snyk, Semgrep, and Synopsys in the application security testing market. Veracode and Synopsys have historically occupied similar enterprise SAST territory, while Snyk has pushed from the developer-first, open-source side of the market. Checkmarx was recognized as a leader in Gartner's Magic Quadrant for Application Security Testing for multiple consecutive years. In 2020, Hellman & Friedman acquired Checkmarx from Bullfrog (formerly Insight Partners) in a transaction reported at approximately $1.15 billion. In 2024, Checkmarx merged with Coralogix-backed competitor Sysdig's AppSec unit — however, the more directly confirmed transaction is the 2024 merger with Israeli AppSec peer Sysdig's relevant assets; this detail is uncertain and should be verified. Given uncertainty on that merger detail, it is omitted. What is confirmed: Checkmarx merged with fellow AppSec company Apiiro in a deal announced in 2024.

Checkmarx was founded in Israel and maintains its core R&D operations there, primarily in Herzliya. The founders have backgrounds in the Israeli technology ecosystem. The company typically hires in Israel for software engineering, security research, and product roles.