Snyk vs Checkmarx: the CLI fail, and the status check the Git host must require

A unit-test job can stay green while the security check is a different command. On Snyk, the fail-build doc opened 3 Oct 2026 is the snyk test command. It fails the build from --severity-threshold or from --fail-on. On Checkmarx One, a policy can turn on Break Build, and GitHub still merges until branch protection requires the status check named Checkmarx.

Between these two, Snyk names SCA, SAST, IaC, and Container on the Free plan, with IDE, CLI, and source-code manager integrations. Checkmarx One names package modules on checkmarx.com and prints no package dollar there. Adjacent SCA fights live on Snyk vs Mend; rules-as-code versus enterprise SAST is Semgrep vs Checkmarx.

	Snyk	Checkmarx One
Primary use case	Snyk Code, Open Source, Container, and IaC, with the documented build fail on the Open Source snyk test command	Checkmarx One policies and scanners. Break Build stops a merge only after the source host is set to require it
Where the check runs	The plans page lists IDE, CLI, and source-code manager integrations. The fail options read for this page are CLI flags on snyk test	A Checkmarx One policy, then the Git host. GitHub uses a required status check named Checkmarx. GitLab uses an unresolved thread
What fails the build	--severity-threshold reports that level or higher. --fail-on=all fails when a vulnerability can be upgraded or patched. upgradable and patchable narrow that. An organization security policy can lower a severity so the same finding no longer fails the threshold	The Break Build toggle on a policy. Findings in an exemption state are skipped for enforcement and stay visible. The toggle does nothing until the source host is configured to block
Deploy	The plans page is the hosted product. Private connectivity and a local engine are not described on the plans page or the fail-build page opened 3 Oct 2026	checkmarx.com says SaaS, and self-hosted or on-premises when residency or an air-gapped network is required. That choice is part of the quote
License/pricing	Free is $0 per month. Team is $25 per month on the plans page. The page does not state a per-developer unit or an annual commitment for that $25. Enterprise credits are contact sales. See Editions	No package dollar on checkmarx.com. AWS Marketplace lists USD per license per year for named SKUs. A license is not one developer. See Editions
Who changes the code	The CLI exits non-zero. A security policy can change the severity first. The fix is still a commit in the repo	Someone saves the policy in Checkmarx One. Someone with repo admin rights requires the check. The fix is still a commit in the repo

We read Snyk’s plans page and the CLI page for failing builds with snyk test, Checkmarx’s pricing page and Break Build policy doc, and the Checkmarx One AWS Marketplace listing, on 3 Oct 2026. We did not run either product in a paid tenant, so this is not a hands-on bake-off.

Snyk

Checkmarx

Checkmarx’s recent first-party product signal is Checkmarx Fusion for Next-Gen SAST in Checkmarx One (5 August 2026), framed as multi-model AI analysis layered on the platform’s SAST path. Snyk’s public packaging signal on the plans page is Free, Team, and Enterprise credits. Team is the published $25 per month step. That page does not say the $25 is per developer.

Editions and pricing

Every dollar below has a currency, a unit, and a period from the page that printed it. Where the unit or the included scans do not match across two spots on a vendor’s own site, the mismatch is labeled and the dollar is not glued to a scan list.

	Snyk	Checkmarx One
How you buy it now	Free and Team are on the plans page. Team is described for development teams of up to 10 developers. Enterprise is contact sales, with prepaid credits	checkmarx.com is a quote. There is no self-serve free trial. A demo is offered. The Marketplace listing is a separate seller page with license prices
Public price (3 Oct 2026)	Free is $0 per month and includes SCA, SAST, IaC, and Container, plus IDE, CLI, and source-code manager integrations. Team is $25 per month and is the Free plan plus increased test limits per product, Jira, and next-business-day support. The plans page does not say that $25 is per developer, and it does not say the month is prepaid annually. The plans page does not print a test count, so none is printed here. The plans page does not print a credit rate, so no credit dollar is printed. If prepaid credits run out before the term ends, further use is invoiced in arrears	checkmarx.com prints no package price. AWS Marketplace lists Checkmarx One Start with SAST at USD 1,035 per license per year (the Cost/12 months column) and Checkmarx One Essential at USD 1,564 per license per year. The same listing says the license unit follows developers, applications, or usage, depending on the module, so this page does not convert either price into a per-developer rate. Minimum deal size on that listing is USD 30,000 for a one-year term, excluding the Premium Service Package and professional-services days. The Marketplace table opened 3 Oct 2026 did not include a Professional price, so none is printed
What the price includes	The four product areas above are what Free names. Team adds the three extras named on the plans page. Which of Code, Container, or IaC use the same fail flags as snyk test was not on the fail-build page, so those flags are not copied onto them	On checkmarx.com, the Essentials card and the FAQ agree on SAST, SCA, API Security, and ASPM. The Professional card adds Malicious Package Protection, Repository Health, DAST, and Container Security on top of Essentials, while the FAQ says Professional adds DAST, IaC Security, and AI Security, and puts Container Security on Enterprise. IaC, AI Security, and Container’s tier do not match across those two spots, so they are not treated as included. The Marketplace price row names the SKU. It does not repeat that module list, so the USD 1,564 line is not described here as those four Essentials scanners
Main buying consideration	Is $25 per month for the Team plan, for up to 10 developers, the unit your order will actually use, or will the order say per developer?	Is the order the Marketplace license, with a USD 30,000 one-year floor, or a checkmarx.com quote whose modules you still have to match to a dollar?

What fails the build

	Snyk	Checkmarx One
Default gate shape	snyk test fails when the chosen threshold or --fail-on value is met. --fail-on=all means at least one vulnerability that can be upgraded or patched. The CLI page says the CLI alone does not cover more complex pass/fail cases. snyk-filter and snyk-delta are the companion tools named there	Break Build is off until the toggle is on. GitHub: branch protection, require status checks, and enter Checkmarx. Azure DevOps: a status policy named Checkmarx set to Required. GitLab: all threads must be resolved. The doc says a GitLab user can resolve that thread and still merge
Where people see it first	IDE, CLI, and source-code manager integrations are on the plans page. Whether an IDE result by itself fails the pull request was not on the fail-build page	The policy result is what the required check or the unresolved thread represents. Developer Assist in the IDE is described on the Marketplace listing as a separate add-on, not as the Break Build toggle
Scans in the gate	The fail flags above are for snyk test, the Open Source command on that page. Snyk Code, Container, and IaC are named on the plans page. Their fail flags were not on the page that documents snyk test	The Break Build doc says you pick a scanner when you add an exemption rule. It does not say every package scanner fails the build by default. Essentials’ agreed set is SAST, SCA, API Security, and ASPM. Other scanners stay unmatched where the pricing card and the FAQ disagree
Main buying consideration	Will the pipeline fail on snyk test at the severity you set, and who can lower that severity in an organization policy before the command runs?	Who can turn on Break Build, and who can require the Checkmarx status check, or resolve the GitLab thread and merge anyway?

The comment is about a Snyk finding that does not match the operating system they run. It is a reason to read what --fail-on and a security policy will actually fail, not a reason to treat the two products as different kinds of teams.

Who changes the code

	Snyk	Checkmarx One
What the tool emits	snyk test reports vulnerabilities at the threshold. JSON from that command can be passed to snyk-filter so the display and the fail rule are not the same list	Policy violations, plus findings that an exemption skipped for enforcement but still tracks. Fusion is described on Checkmarx’s 5 August 2026 post as analysis on the SAST path, not as the Break Build switch
Who owns the fail rule	Whoever sets the CLI flags in the pipeline, and whoever can change severity in the organization security policy	Whoever edits the Checkmarx One policy, and whoever can edit branch protection or the GitLab merge check
Who owns the fix	Whoever commits the upgrade, patch, or code change. The fail-build page does not assign that commit to a job title	Whoever commits the change that clears the violation. The Break Build doc does not assign that commit to a job title. On GitLab, resolving the thread is a separate action from fixing the code, and the doc says that resolve can allow the merge
Main buying consideration	Do you want the fail rule in the pipeline command, with a policy that can lower severity before the command sees it?	Do you want the fail rule in a Checkmarx One policy that still needs a required status check, or an unresolved thread, on the Git host?

Choose Snyk when the build should fail from snyk test at a severity or a fixable finding, and the order can start from Free at $0 per month or Team at $25 per month for up to 10 developers, with the per-developer unit still unmatched on that page. Choose Checkmarx One when the merge should wait on a Break Build policy, and you will require the Checkmarx status check yourself. Do not treat USD 1,035 or USD 1,564 per license per year as the Essentials module list, and do not treat either figure as a per-developer price.