Delivers multi-scan-engine correlation across open source and proprietary code, as well as context-based risk prioritization in a single report featuring both list and topographic views
SAN FRANCISCO, CA AND RAMAT GAN – June 7, 2022 – Developers and application security (AppSec) teams today have long needed a single, integrated view into the interaction, functions and vulnerabilities of the dozens of components in today’s typical application in order to perform comprehensive AppSec testing. In response to that need, Checkmarx, the global leader in developer-centric application security testing (AST) solutions, today announced the availability of Checkmarx Fusion, a context-aware correlation engine that enables full visibility into applications, component interactions, and bills of materials. It leverages a holistic view of application security scan results across all stages of the software lifecycle to correlate and prioritize vulnerabilities, thereby guiding remediation of the most critical issues first. Checkmarx Fusion is part of Checkmarx One, the industry’s most comprehensive application security testing (AST) platform.
“Development teams test tens of millions of lines of code monthly. With the complexity of modern applications – which include source code, open source code, Infrastructure-as-Code, containers, and more – developers and their AppSec leaders have a critical need for visibility into how application components interact,” said Checkmarx Chief Product Officer Razi Sharir. “Working closely with our customers worldwide, we know that developers and AppSec teams need a holistic view of the context and prioritization of application vulnerabilities that are lacking in AST and ASOC (Application Security Orchestration and Correlation) solutions. Checkmarx Fusion unifies, prioritizes, and streamlines AppSec vulnerability remediation thereby increasing developer efficiency and organizational agility.”
Teams can now “shift left” and bring comprehensive AppSec testing and remediation into the development cycle from creation of the first line of code to the last. Unlike ASOC solutions, Checkmarx Fusion offers multi-engine-scan correlation and context-based risk prioritization of scan results across engines. Checkmarx Fusion empowers developers and AppSec teams with these four pillars:
- Visibility: Provides threat modeling by mapping threats in a visual, intuitive graph containing all software elements, consumed cloud resources, and relationships between them. Checkmarx Fusion extrapolates potential vulnerabilities within two or more scans that might otherwise escape detection.
- Correlation: Adds context to the silo scanners by combining and correlating results from static code scans and runtime scans, effectively eliminating false positives.
- Prioritization: Focuses developers and AppSec teams on solving the most critical issues by prioritizing vulnerabilities based on their real impact and risk.
- Cloud-Native: Leverages cloud-native architecture including microservices, cloud resources, containers, and APIs while correlating insights from pre-deployment to runtime.
Checkmarx Fusion: Topology View
According to Melinda-Carol Ballou, Research Director for IDC’s Application Life-Cycle Management (ALM) program[i], “The breadth of capabilities in Checkmarx’s portfolio, which spans SAST, SCA, and IaC security, delivered in a unified platform is an advantage in the highly competitive DevSecOps market space. The platform’s developer focus, along with DevOps toolchain integrations and contextualized training, can increase developer performance and lighten the load of security testing, permitting the rapid delivery of more secure applications.”
Checkmarx Fusion is available now. For more information, visit this page, visit booth #1755 at RSA 2022 or booth #651 at the Gartner Security and Risk Management Summit.
About Checkmarx
Checkmarx is constantly pushing the boundaries of Application Security (AppSec) Testing to make security seamless and simple for the world’s developers while giving CISOs the confidence and control they need. As the AppSec testing leader, Checkmarx provides the industry’s most comprehensive AST platform, Checkmarx One, that provides developers and security teams with unparalleled accuracy, coverage, visibility and guidance to reduce risk across all components of modern software—including proprietary code, open source, APIs and infrastructure as code. Over 1,800 customers, including half of the Fortune 50, trust Checkmarx security technology, expert research, and global services to securely optimize development at speed and scale. For more information, visit the Checkmarx website, check out the blog or follow the company on LinkedIn.
Media Contact
Katie Brookes
Merritt Group for Checkmarx
brookes@merrittgrp.com
[i] IDC, IDC MarketScape: Worldwide Application Security Testing, Code Analytics, and Software Composition Analysis 2022 Vendor Assessment, by Melinda-Carol Ballou, March 2022.