What we’ve shipped
recently
Every release is driven by one question: what does security need to keep pace with how engineering ships today? Here's what that looks like in practice.
The highest F1 score in any language. Enterprise-grade, AI-augmented, zero noise.
Static analysis just got a significant upgrade. The new Checkmarx SAST builds on the deterministic foundation enterprise security teams trust, adding AI-powered coverage and an automated findings classifier that separates signal from noise before results reach your team. The result: the highest F1 score in the category, 60% fewer false positives, and 100% language coverage across your entire stack, including everything AI coding assistants are generating right now.
Explore SASTRecent Releases & Updates
Explore some of our latest features and enhancements.
Checkmarx MCP Server — AI agents with real security context.
The Checkmarx MCP Server gives AI coding assistants secure, governed access to Checkmarx One through a single MCP connection. Developers and AI agents can retrieve scan results, investigate vulnerabilities, understand remediation guidance, and act with the same enterprise security context across MCP-compatible IDEs, terminals, and assistants without building custom integrations for every tool or workflow.
Explore MCP ServerAI-BOM — know exactly what AI is in your software.
LLMs are introducing a new class of dependency risk — models, agents, MCP servers, and fine-tuning datasets that no traditional SBOM tracks. The Checkmarx AI Bill of Materials gives security teams deterministic, auditable visibility into every AI component across the SDLC, mapped against NIST AI RMF, EU AI Act, and ISO 42001 requirements. Know what AI is in your software — before your auditors ask.
Explore AI-BOMTriage Assist & Remediation Assist: Resolve Risk as Fast as AI Delivers It
Two new autonomous agents in Checkmarx One that take the manual work out of vulnerability management. Triage Assist tells you exactly what requires action and what can be safely ignored — using provable Attackability and real-world exploitability, not static severity scores. Remediation Assist generates review-ready fixes directly inside pull requests, so developers stay in flow instead of context-switching to investigate and patch.
Explore AgentsUpcoming Releases
Here's a preview of what's ahead in our pipeline.
GitHub Apps Code Repository Integrations
Coming SoonVulnerability Exploitability eXchange (VEX)
Coming SoonRisk Orchestration
Coming SoonDAST Enhancements
Coming SoonReady to Secure the Risk AI Creates?
See how Checkmarx helps enterprises reduce exploitable backlog, govern AI-generated code, and remediate application risk with speed, context, and control.