Source: helpnetsecurity.com. Originally announced at RSA Conference 2020.
Overview
At RSA Conference 2020, Checkmarx announced significant enhancements to its Software Security Platform aimed at making application security testing (AST) faster to adopt and easier to automate in modern development and DevOps environments. The centerpiece of this announcement was CxFlow — an orchestration module that bridges the gap between security scanning and developer workflows.
What Is CxFlow?
CxFlow is an orchestration layer built on top of the Checkmarx Software Security Platform. Its primary purpose is to automate the full lifecycle of AST — from triggering scans at the right points in the development process to routing vulnerability findings to the appropriate tracking and ticketing systems.
Rather than requiring security teams to manually configure and trigger scans, CxFlow hooks directly into the tools development teams already use, removing friction and reducing the time between code commit and security feedback.
Key Capabilities
1. End-to-End Automation from Scanning to Ticketing
CxFlow automates the steps required to onboard an application into an organization’s AST framework. By leveraging Checkmarx’s ability to scan uncompiled source code, it eliminates manual configuration overhead. Once a scan completes, findings are automatically published or updated in a defect or backlog management system — such as Jira — based on configurable policy rules, so development teams can track and remediate issues within their existing workflows.
2. Seamless Integration with the Modern Development Ecosystem
CxFlow integrates with widely used source control management (SCM) systems and CI/CD tools, including:
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
- Jira
This means security scans can be triggered automatically on pull requests, branch pushes, or pipeline stages — delivering consumable results inside the environments developers already work in, without requiring context switching.
3. Centralized Management and Governance
CxFlow provides a single configuration and orchestration point between an organization’s development toolchain and the Checkmarx platform. This centralized approach allows security and DevOps teams to:
- Onboard new applications and teams quickly
- Enforce consistent security policies across projects
- Simplify governance of DevSecOps processes organization-wide
Why This Matters for DevSecOps
One of the persistent challenges in DevSecOps adoption is that security tooling often disrupts developer velocity. Teams are forced to learn new tools, leave their CI/CD environments, or wait for security reviews that run outside the normal development pipeline. This friction slows adoption and leads to security being treated as a post-development gate rather than an integrated practice.
Gartner has noted that security and risk management teams responsible for application security should integrate security and compliance testing seamlessly into DevSecOps, so developers never have to leave their continuous integration or continuous deployment toolchain environments. CxFlow is Checkmarx’s answer to that challenge.
According to Nir Livni, VP of Products at Checkmarx:
“The main goal of any application security testing program is to reduce enterprise risk without hindering software release cycles, which is best achieved through thoughtful planning and implementation of security testing automation. However, this often remains an obstacle for today’s organizations. With CxFlow, Checkmarx addresses these automation challenges with a best-in-class solution and methodology that supports the ‘you code it, you own it’ philosophy. This allows organizations to detect and remediate software vulnerabilities within fast-paced development environments.”
— Nir Livni, VP of Products, Checkmarx
The “You Code It, You Own It” Philosophy
Central to CxFlow’s design is the idea that vulnerability remediation should be the responsibility of the developer who introduced the code, not a separate security team reviewing results weeks later. By surfacing scan results directly in the tools developers use — as Jira tickets, pull request comments, or pipeline failures — CxFlow reinforces this ownership model and encourages faster, more targeted remediation.
Summary
CxFlow represents a significant step toward making AST a native part of the software delivery pipeline rather than an external gate. For DevOps and DevSecOps teams looking to embed security earlier in the SDLC without creating new bottlenecks, CxFlow’s integration-first, automation-driven approach addresses a genuine operational pain point. Organizations evaluating application security platforms should assess how well candidate solutions integrate with their existing SCM and CI/CD toolchains — and CxFlow’s broad integration support makes it a strong contender in that evaluation.