Checkmarx One

Ingests, deduplicates and normalizes signals from security tools across DevSecOps pipelines and runtime environments (SAST, DAST, SCA, container scanning, secrets scanning, runtime and cloud telemetry) into a single finding model with a consistent severity scale across sources.

Groups findings from multiple tools that refer to the same underlying vulnerability in the same code location, presenting one actionable finding instead of multiple redundant alerts.

Scores aggregated findings using multiple contextual factors (exploitability, reachability, internet exposure, threat intelligence, and business criticality) rather than individual tool severity ratings, producing a single actionable priority queue across all AppSec signals.

Traverses the full dependency graph to surface CVEs in indirect dependencies, packages required by your direct dependencies. Direct-only scanning misses the majority of vulnerable code paths in modern polyglot projects.

Determines whether a vulnerable function is actually reachable and invoked, not merely present in the dependency tree, cutting actionable CVEs down to those with real exploit paths. Delivered either statically, by call-graph analysis layered on dependency scanning, or at runtime, by instrumenting the workload to observe which components actually execute.

Identifies packages with known-malicious behavior (typosquatting, dependency confusion, backdoored releases), distinct from packages with CVEs in legitimate code.

Risk context for open-source dependencies including reachability, exploitability, and upgrade impact.

Detection and provenance tracking of AI and ML components, models, and LLM usage within the software supply chain.

Compiles vendor, third-party and open-source maintainer reputation to flag risk from unmaintained, deprecated or abandoned software.

Scans infrastructure-as-code definitions across Terraform, CloudFormation, ARM and Bicep, Pulumi, Kubernetes YAML and Helm charts against security and compliance policies before deployment, so misconfigurations are caught in code rather than in production. Framework coverage and check depth per framework vary across products.

Detects credentials, API keys, tokens and certificates embedded in infrastructure-as-code files, variables and the repositories that hold them, flagging them in the pull request and pipeline before they are committed or deployed.