# Checkmarx vs StackHawk

| Attribute | Checkmarx | StackHawk |
|---|---|---|
| **Vioscale score** | 53.7 (46% (low)) | 50.5 (73% (medium)) |
| deployment.options | `{"cloud":true}` | `{"cloud":true}` |
| description.long | An integrated platform combining static analysis, dynamic testing, dependency scanning, and AI-powered agents to identify and prioritize vulnerabilities across the entire software development lifecycle, from code to cloud deployment. | A platform that enables AI coding agents (such as Claude, GitHub Copilot, Cursor) to automatically identify, analyze, and remediate security vulnerabilities in applications during development, eliminating context switching and manual handoffs to security teams. |
| features.capabilities | `{"sca":true,"dast":true,"sast":true,"sbom":true,"hosting":"cloud","ci_native":true,"ide_plugin":true,"reachability":true}` | `{"dast":true,"hosting":"cloud","ci_native":true,"ide_plugin":true,"auto_fix_pr":true,"open_source":true}` |
| integrations.count | 1 | 11 |
| integrations.list | `[{"name":"Wiz"}]` | `[{"name":"Claude Code"},{"name":"Codex"},{"name":"Gemini CLI"},{"name":"GitHub Copilot"},{"name":"OpenCode"},{"name":"Cursor"},{"name":"Snyk"},{"name":"Auth0"},{"name":"GitHub Actions"},{"name":"GitLab"},{"name":"Jenkins"},{"name":"CircleCI"}]` |
| market.availability | `{"hqCountry":"IL","primaryMarkets":["US","GB"],"availabilityScope":"global","availableCountries":["US","GB","PT","FR","AU","IN","SG","DE","IL"],"notAvailableCountries":[]}` | `{"primaryMarkets":[],"availabilityScope":"global","availableCountries":[],"notAvailableCountries":[]}` |
| platform.support | `{"web":true}` | `{"cli":true,"web":true}` |
| pricing | `{"type":"quote","plans":[{"free":false,"name":"Essentials","summary":"Custom quote required","features":["SAST","SCA","API Security","ASPM visibility","Core reporting"],"description":"Core application security coverage. Establish a unified foundation for identifying, managing, and reporting application risk.","contactSales":true},{"free":false,"name":"Professional","summary":"Custom quote required","features":["Everything in Essentials","DAST","IaC Security","AI Security","Advanced ASPM","PR Decorations"],"description":"Advanced protection and AI-powered security. Scale your AppSec program with AI-assisted remediation and deeper multi-layer coverage.","contactSales":true},{"free":false,"name":"Enterprise","summary":"Custom quote required","features":["Everything in Professional","Supply Chain Security","Container Security","Runtime Protection","Custom Policies","Executive Reporting"],"description":"Complete coverage and full compliance. Maximum coverage and control for organizations with the most demanding security requirements.","contactSales":true}],"summary":"All three tiers require custom quote. No published per-seat or usage-based pricing.","freeTier":false,"sourceUrl":"https://checkmarx.com","retrievedAt":"2026-08-05T14:23:25.473Z"}` | `{"type":"subscription","plans":[{"free":false,"name":"Wingman","summary":"$10/user/month","features":["Works inside Claude Code, Cursor, GitHub Copilot","Auto-configures and boots app","Runtime testing against running app","Finds and fixes vulnerabilities in same session","Auto-rescanning to verify fix","Pre-PR security attestation","Unlimited apps","50 scans/user/month"],"commitment":"monthly","components":[{"kind":"per_unit","unit":"user","amount":10,"period":"month","currency":"USD"}],"description":"For individuals and teams shipping with AI coding agents","contactSales":false,"includedLimits":{"apps":"unlimited","scans":"50/user/month"}},{"free":false,"name":"Scale","summary":"Custom pricing. Contact sales.","features":["Everything in Wingman","Attack surface discovery","Sensitive data detection","Deeper, broader scan coverage","Program reporting (coverage, fix rates by team)","Teams, roles, and enterprise support","Unlimited agentic scans"],"description":"For security teams needing attack surface discovery, coverage, and proof across every app","contactSales":true,"includedLimits":{"apps":"unlimited","scans":"unlimited"}}],"summary":"From $10/user/month (Wingman). 14-day free trial. Scale plan available via sales consultation.","currency":"USD","freeTier":true,"sourceUrl":"https://www.stackhawk.com","retrievedAt":"2026-08-03T22:45:21.019Z","freeTrialDays":14,"startingPrice":{"amount":10,"period":"month","currency":"USD"},"billingPeriods":["month"]}` |
| pricing.free_tier | no | yes |
| pricing.model | commercial | freemium |
| pricing.price_level | unknown | low |
| pricing.transparent | no | no |
| reliability.status_page | - | yes |
| security.disclosure_policy | - | yes |
| security.fedramp | yes | - |
| security.gdpr | yes | - |
| security.iso27001 | yes | - |
| security.soc2 | yes | yes |

## Capabilities (DevSecOps Tools)

| Capability | Checkmarx | StackHawk |
|---|:--:|:--:|
| **Scan types** |  |  |
| SAST (static analysis) | ✓ | - |
| DAST (dynamic analysis) | ✓ | ✓ |
| SCA / dependency scanning | ✓ | - |
| Secret scanning | - | - |
| Container / image scanning | - | - |
| IaC misconfiguration scanning | - | - |
| **Governance** |  |  |
| OSS licence compliance | - | - |
| SBOM generation (SPDX/CycloneDX) | ✓ | - |
| **Remediation** |  |  |
| Automated fix / upgrade PRs | - | ✓ |
| **Prioritisation** |  |  |
| Reachability / exploitability prioritisation | ✓ | - |
| **Deployment** |  |  |
| Hosting | Cloud only | Cloud only |
| **Integration** |  |  |
| First-class CI / pipeline integration | ✓ | ✓ |
| In-editor / IDE scanning | ✓ | ✓ |
| **Licensing** |  |  |
| OSS engine available | - | ✓ |

*Source: Vioscale. Generated 2026-09-01T16:41:25.822Z. "-" = undocumented, not absent.*