Source: businesswire.com | Originally published: May 8, 2020
Checkmarx Tops the DevOps/DevSecOps Use Case in Gartner’s 2020 Critical Capabilities Report
Checkmarx announced in May 2020 that it ranked highest for the DevOps/DevSecOps use case in the 2020 Gartner Critical Capabilities for Application Security Testing report. The company also held a Leader position in the 2020 Gartner Magic Quadrant for Application Security Testing, and had previously been named a 2019 Gartner Peer Insights Customers’ Choice for Application Security Testing based on verified customer reviews.
What Are Gartner Critical Capabilities?
Gartner describes Critical Capabilities as attributes that differentiate products and services within a category based on quality and performance. Gartner recommends that buyers treat these capabilities as among the most important criteria when making acquisition decisions.
In the Magic Quadrant for Application Security Testing (April 2020), Gartner noted that the major driver behind AST market evolution is the need to support enterprise DevOps initiatives. Buyers expect solutions that deliver high-assurance, high-value findings without unnecessarily slowing down development pipelines — and that integrate earlier in the SDLC, with testing increasingly driven by developers rather than dedicated security specialists.
Why DevSecOps Fit Matters for AST Tools
Traditional application security testing was often a gate at the end of the development cycle, handled by a separate security team. Modern DevOps practices demand a different model: security scanning must be fast, automated, and embedded directly into the developer workflow — in IDEs, pull requests, and CI/CD pipelines — without becoming a bottleneck.
This shift toward shift-left security means AST vendors must provide:
- Low-friction integrations with source control systems (GitHub, GitLab, Bitbucket, Azure Repos)
- Native plugins or APIs for CI/CD platforms (Jenkins, Azure DevOps, CircleCI, GitHub Actions)
- Scan times and result noise levels that developers can realistically act on within a sprint
- Developer-friendly remediation guidance, not just raw vulnerability reports
- Consolidated coverage across SAST, DAST, IAST, and SCA from a single platform where possible
The Checkmarx Software Security Platform
Checkmarx’s platform as described in 2020 combined several testing disciplines into a unified offering:
- SAST (Static Application Security Testing): Analyzes source code for vulnerabilities without executing the application.
- IAST (Interactive Application Security Testing): Instruments running applications to detect vulnerabilities during functional testing.
- SCA (Software Composition Analysis): Identifies known vulnerabilities in open-source and third-party dependencies.
- AppSec Awareness and Training: Developer-facing educational content to reduce vulnerability introduction at the source.
The platform was available for on-premises deployment, cloud-hosted environments, and hybrid configurations, addressing the range of enterprise infrastructure patterns common in large organizations.
CxFlow: End-to-End AST Orchestration for DevOps
A notable product introduced around this period was CxFlow, an orchestration module for the Checkmarx platform. CxFlow was designed to automate the handoff between security scanning and development workflows, addressing one of the common friction points in DevSecOps adoption: the gap between detecting a vulnerability and getting it tracked and remediated.
Key capabilities described for CxFlow included:
- Integration with source control management systems to trigger scans automatically on code events (pushes, pull requests, merges)
- Integration with CI/CD pipelines for build-time scanning
- Automated ticket creation in issue trackers (such as Jira) based on scan results, enabling developers to work vulnerabilities directly from their existing task management tools
- End-to-end automation from scan initiation through to defect ticketing — positioning it as a differentiator among AST vendors at the time
Executive Perspective
“Supporting the needs of enterprise DevOps and DevSecOps has always been a key focus for Checkmarx, and achieving the number-one ranking in this use case is a formidable vote of confidence for our approach to application security testing. Checkmarx is committed to delivering rapid and accurate software security testing solutions that are increasingly integrated and automated throughout the SDLC to support modern software development.”
— Emmanuel Benzaquen, CEO, Checkmarx (May 2020)
About Checkmarx
As of 2020, Checkmarx described itself as trusted by more than 40 of the Fortune 100 companies and half of the Fortune 50, with customers including SAP, Samsung, and Salesforce. The company is headquartered in Ramat Gan, Israel, with offices in New York and other locations globally.
Gartner Disclaimers
Gartner Peer Insights Customers’ Choice designations represent the subjective opinions of individual end-user reviews, ratings, and data applied against a documented methodology. They do not represent the views of, nor constitute an endorsement by, Gartner or its affiliates.
Gartner does not endorse any vendor, product, or service depicted in its research publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner research publications consist of the opinions of Gartner’s research organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this research, including any warranties of merchantability or fitness for a particular purpose.
Report References
- Gartner, Critical Capabilities for Application Security Testing, Dale Gardner, Dionisio Zumerle, Mark Horvath, 27 April 2020
- Gartner, Magic Quadrant for Application Security Testing, Mark Horvath, Dionisio Zumerle, Dale Gardner, 29 April 2020