Checkmarx Fusion SAST:
Find More Real Vulnerabilities

Checkmarx Fusion SAST is Checkmarx’s highest-fidelity static application security testing experience. It combines established Checkmarx application security analysis with curated frontier-model reasoning to produce one fused, higher-fidelity result.

It is designed to find more real vulnerabilities, including novel and contextual risks established detection may miss, without turning broader discovery into a larger backlog of noise.

Checkmarx Fusion SAST improves detection without increasing noise. In SAST testing, F1 accuracy score increased to 0.74, meaning Checkmarx found more real vulnerabilities while preserving precision.

The core SAST foundation does not consume frontier-model Credits. Additional frontier reasoning in Fusion SAST is metered through Checkmarx Credits at a predetermined rate based on the selected model and lines of code scanned, visible before the scan runs.

Checkmarx SAST already provides a high-fidelity hybrid analysis foundation using rules analysis plus AI-based analysis where applicable. Fusion SAST adds curated frontier-model reasoning for deeper discovery.

F1 measures precision and recall together: how effectively a scanner finds real vulnerabilities while avoiding false positives.

Fusion SAST supports a curated set of frontier models, including models from Anthropic. Available models can evolve as Checkmarx validates new capabilities, so teams benefit from advances in frontier reasoning without tying their application security architecture to a specific model version. 

The models used within Fusion SAST are enabled through Amazon Bedrock, which protects customer source code and data from being shared back with Anthropic. All exchanges stay contained within the customer’s own cloud environment or tenant.

No. Fusion SAST operates within the Checkmarx One workflow. Teams use their existing repositories, scan configuration, and application-security processes rather than deploying a separate frontier-AI scanning system.

Most SAST tools rely on pattern matching against predefined rules. Checkmarx SAST uses a hybrid approach: deterministic, auditable analysis for core languages, an AI-powered engine for emerging and AI-generated code, and automatic classification that cuts noise by 60%. The result is 70% better fidelity than traditional SAST. Coverage, precision, and signal in the same scan.

Findings Analysis is an AI-powered capability that evaluates scan results and classifies each finding as a likely true positive or false positive before it reaches your team. It reduces noise automatically so engineers focus on findings worth fixing.

Frontier models can identify vulnerabilities, reason across complex code, and propose fixes. Fusion SAST combines that reasoning with Checkmarx’s established security analysis and findings validation in one enterprise SAST workflow. Through Checkmarx One, teams can also apply security policies, manage findings in context, and connect detection to triage and remediation.

The advantage is a complete governed security workflow rather than building and maintaining these capabilities around a standalone frontier model.

AI-generated code can accelerate development, but it does not guarantee secure output. Checkmarx Fusion SAST scanner validates generated and human-written code with hybrid analysis, broad language coverage, and Findings Analysis to reduce noise.

Checkmarx Fusion SAST is part of the Checkmarx One platform. This allows a complete enterprise application security program to run on a single platform, reducing total cost of ownership and allowing for correlation and better actionable insights. The Checkmarx One platform includes SAST security scanning, DAST security scanning, AI Supply Chain Security, AI BOM, SCA, SCS, API Security, IaC Security, and Container Security.

On-premises SAST uses a rules-based scanning engine. SAST on Checkmarx One includes the AI-based engine, the Findings Analysis Engine, and Checkmarx Fusion. None of which are available on-premises. If you’re running on-premises today, moving to Checkmarx One is how you access the full hybrid scanning architecture and the F1 gains that come with it. Learn more in the on-prem to cloud migration brief.

Checkmarx SAST supports a broad range of modern, enterprise, and legacy languages, including Java, JavaScript, TypeScript, Python, C#, C/C++, Go, PHP, Ruby, Swift, Kotlin, COBOL, PL/SQL, and more.

With Fusion SAST, LLM-based scanning extends detection to emerging languages and frameworks that deterministic rules don’t cover.

A SAST security scan reviews source code, looking for vulnerabilities in static code – it doesn’t require the application to be running. In contrast, a dynamic application security testing (DAST) scan evaluates a running application, testing how it behaves in real-time by simulating attacks. While SAST finds issues in the code, DAST focuses on identifying runtime vulnerabilities like authentication or input validation problems.

Checkmarx Professional Services offers the Checkmarx Application Security Assessment & Remediation Service. This is a focused engagement with Checkmarx. We map and prioritize exploitable vulnerabilities in your code, help confirm it, provide the best course of action for the code fixes that matter most, and document the remediation.

Yes. Checkmarx SAST scans source code directly from repositories such as GitHub, GitLab, Azure, and Bitbucket, without requiring a build. As an enterprise SAST tool, it adds security analysis, workflow integration, fix guidance, and risk context beyond basic source code scanning.