Checkmarx One vs Veracode when the enterprise SAST renewal lands on one desk

Two enterprise SAST incumbents, one renewal, and a USD 30,000 minimum (one-year term) on one Marketplace listing before a single repository is scanned. Both platforms sell static analysis, software composition analysis, and dynamic testing to security-led programs. They split on where scanning runs and how a policy becomes a blocked merge.

Checkmarx One is the platform where Checkmarx bundles SAST, SCA, DAST, API security, IaC, container, and secrets scanning, with a self-hosted path when residency demands it. Veracode runs Static Analysis, SCA, DAST, Package Firewall, and Risk Manager as a SaaS platform with policy evaluation on every application profile.

Buy Checkmarx One when policy must break the build inside the Git host and a self-hosted engine may be required. Buy Veracode when application profiles need policy compliance scoring with AI patches from Veracode Fix.

Overview

	Checkmarx One	Veracode
Primary use case	Checkmarx One SAST, SCA, DAST, API Security, IaC, Container, and Secrets scanners under one platform with policy-driven Break Build	Veracode Static Analysis, Software Composition Analysis, DAST, Package Firewall, and Risk Manager on the Veracode Platform with policy evaluation per application profile
Where the check runs	Checkmarx One policy plus the Git host. GitHub enforces through a required status check named Checkmarx. checkmarx.com lists SaaS plus self-hosted or on-premises when residency or an air-gapped network is required	Pipeline Scan runs SAST in CI with a baseline file, fail_on_severity, and results.json. Upload and Scan feeds the Platform, where flaw mitigations and policy evaluation happen
Main buying consideration	No package dollar on checkmarx.com. AWS Marketplace lists Checkmarx One Start with SAST at USD 1,035 per license per year and Essential at USD 1,564 per license per year, with a USD 30,000 minimum for a one-year term. License unit follows developers, applications, or usage by module	No public USD on veracode.com product pages reviewed 10 Oct 2026. Packaging is scoped by module (Static Analysis, SCA, DAST, Fix, Package Firewall, Risk Manager) and application count in a sales quote

We reviewed the Checkmarx pricing page, Break Build policy documentation, and the Checkmarx One AWS Marketplace listing, plus Veracode documentation for security policies, Pipeline Scan, Veracode Fix, and Package Firewall, and the Zurich Seguros customer story, on 10 Oct 2026. We did not run either product in a paid tenant.

Checkmarx One

Veracode

Editions and pricing

Checkmarx prints license prices on AWS Marketplace and nothing on its own site. Veracode prints no dollar on the pages reviewed, so module scope is the only public anchor.

	Checkmarx One	Veracode
How it is sold	Quote on checkmarx.com with a demo path and no self-serve trial. AWS Marketplace offers named Checkmarx One SKUs with per-license annual prices and a Premium Service Package as a separate line	Sales quote by module and application scope. Veracode eLearning and Security Labs are separate developer-training lines beside the scanning modules
Figure on the public page	Checkmarx One Start with SAST USD 1,035 per license per year. Checkmarx One Essential USD 1,564 per license per year. Minimum deal USD 30,000 for one year, excluding professional-services days	No USD on veracode.com when checked 10 Oct 2026. This page prints no third-party estimate in its place
Deployment that changes the quote	SaaS by default. Self-hosted or on-premises when data residency or an air-gapped network requires it, priced as part of the quote	SaaS Veracode Platform with regional instances. Package Firewall integrates with Artifactory, Nexus, Azure Artifacts, npm, PyPI, Cargo, and Maven registries

Policy and build enforcement

Both platforms turn a scan result into a gate. The documented split is a Checkmarx One policy toggle that depends on the Git host versus a Veracode policy evaluated against an application profile.

	Checkmarx One	Veracode
Gate object	Break Build toggle on a Checkmarx One policy. Findings in an exemption state are skipped for enforcement but stay visible	Built-in or custom security policy assigned to an application profile by a Policy Administrator, with default policies by business criticality
CI behavior	The toggle has no effect until the source host requires it. GitHub uses a required status check; GitLab uses an unresolved thread	Pipeline Scan fails on fail_on_severity and can compare against a baseline file so only new flaws break the job
Where mitigations live	Triage states and exemptions live in Checkmarx One results	Flaw mitigations require Upload and Scan on the Platform. Pipeline Scan results are not connected to Platform mitigations

Remediation and supply chain

Both vendors now pair findings with AI-assisted fixes and open-source controls. The split is in where the fix lands and how packages are stopped before install.

	Checkmarx One	Veracode
AI fix surface	Checkmarx One Assist agents for developer IDE remediation, plus Checkmarx Fusion multi-model analysis on the SAST path announced 5 Aug 2026	Veracode Fix generates patches for SAST in IDE and CLI, and for SCA in CLI and SCM, where it opens merge requests
Open-source intake control	SCA with malicious package detection inside Checkmarx One	Package Firewall blocks or warns on packages at the registry, with OPA and Rego custom policies
Program reporting	ASPM views aggregate scanner results across applications in Checkmarx One	Risk Manager correlates findings into application risk, and policy compliance reports track pass or fail per profile

Favor Checkmarx One when the documented requirement is a policy Break Build enforced through the Git host, published per-license Marketplace pricing, and a self-hosted engine for residency. Favor Veracode when the documented requirement is policy compliance per application profile, Pipeline Scan baselines in CI, Veracode Fix patches, and Package Firewall at the registry.