Checkmarx

Profile narrative

Checkmarx provides application security testing solutions that help organisations identify and remediate vulnerabilities in their source code before deployment. Its portfolio includes static application security testing (SAST), interactive application security testing (IAST), software composition analysis (SCA), and developer‑focused security tools that integrate directly into integrated development environments and continuous integration/continuous delivery pipelines. The company supports a wide range of programming languages and frameworks, enabling customers across sectors such as finance, healthcare, technology, and retail to enforce security policies throughout the software development lifecycle. Checkmarx offers both on‑premises and cloud‑based deployment options, allowing flexibility for organisations with differing infrastructure and compliance requirements.

In March 2026 Checkmarx disclosed a supply chain attack that targeted its open source KICS project, resulting in the theft of credentials that allowed attackers to hijack GitHub Action tags and poison a variety of artefacts including OpenVSX plugins, VS Code and Developer Assist extensions, a DockerHub image, and the Bitwarden CLI NPM package. The intrusion facilitated the exfiltration of source code, employee data, API keys, and database credentials, which were later published on a leak site. After detecting the breach, Checkmarx removed the malicious packages, revoked compromised credentials, blocked attacker infrastructure, notified law enforcement, engaged the Mandiant incident response team, instituted a broad credential reset, tightened access controls, locked down repository access, and launched a comprehensive code audit to remediate the vulnerability and prevent recurrence.

Checkmarx is distinguished by its developer‑centric approach to application security, emphasising early detection of flaws within the development workflow to reduce remediation cost and time. Its scanning engines are noted for low false‑positive rates and deep language coverage, which assists organisations in meeting regulatory standards such as PCI DSS, HIPAA, and GDPR without overwhelming development teams with noise. The company maintains a dedicated research team that contributes threat intelligence and open source tools like KICS, reinforcing its reputation for innovation in secure coding practices and its ability to adapt to evolving threat landscapes.

Checkmarx’s headquarters is located in Israel, reflecting its origins in a region known for a strong cybersecurity ecosystem. No further details about ownership or parent‑subsidiary relationships are provided in the source material, so those aspects are not elaborated upon here.

Incidents

1 incident linked to this organisation.