What do Checkmarx and Cycode sell?

Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Cycode sells Agentic Development Security Platform, Maestro, Context Intelligence Graph, Cycode SAST and ConnectorX.

Are Checkmarx and Cycode in the same category?

They share Static application security testing and Application security posture management. Checkmarx's primary category is Static application security testing and Cycode's is Application security posture management.

When were Checkmarx and Cycode founded?

Checkmarx was founded in 2006. Cycode was founded in 2019.

Who owns Checkmarx and Cycode?

Checkmarx is owned by Hellman & Friedman, since 2020.

Who are Checkmarx and Cycode sold to?

From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. From its own pages, Cycode sells to large enterprises, with gaming platforms and financial institutions described among them.

What have Checkmarx and Cycode announced recently?

July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.

Vendor comparison · 2 companies

Checkmarx vs Cycode

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Cycode is the agentic development security platform that unifies visibility, prioritization, and remediation across the software development lifecycle. CISO Tribune files both under Static application security testing and Application security posture management. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Checkmarx
Cycode

Add a company

Checkmarx vs Cycode: Products, Customers and Funding Compared
What it sells
	CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.checkmarx.com	CycodeCycode is the agentic development security platform that unifies visibility, prioritization, and remediation across the software development lifecycle.cycode.com
What it sells	Checkmarx Developer Assist^[5]Delivers context-aware security guidance within the IDE. It combines realtime scanning with agentic AI remediation. Checkmarx MCP Server^[5]A secure gateway that bridges AI-powered development assistants with the Checkmarx security platform.	Agentic Development Security Platform^[3][5]Cycode's platform for finding and fixing risk before it reaches production. Maestro^[1][3][6]Cycode Maestro orchestrates AI Teammates that assess exposure, analyze exploitability, and generate fixes. Context Intelligence Graph^[6]A single shared graph that distills noisy alerts into risks that matter. Cycode SAST^[7]Static application security testing (SAST) for code, designed by developers, for developers. ConnectorX^[8]Cycode's click and connect ASPM integration platform.
Categories
Categories	Static application security testing (primary category) Dynamic application security testing Software composition analysis Application security posture management	Application security posture management (primary category) Software supply chain security Static application security testing
Headquarters
Headquarters	Not stated on its pages	Not stated on its pages
Founded
Founded	2006^[2]	2019^[2]
Ownership and funding
Ownership and funding	Owned by Hellman & Friedman since 2020^[2][4][5]	Not stated on its pages
Named customers
Named customers	Not stated on its pages	Not stated on its pages
Recent news
Recent news	July 28, 2026Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.^[6] April 27, 2026Checkmarx disclosed that its investigation into a supply chain security incident found a cybercriminal group had published company-related data on the dark web.^[3]	Not stated on its pages
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: listed, seen November 3, 2026^[4] Gartner Peer Insights: Not stated on its pages	G2: listed, seen November 3, 2026^[4] Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its documentation describes plugins for several IDEs and for AI coding agents. Checkmarx offers Developer Assist in distinct licensing models, each serving a distinct segment of its customers, including SAST on-premises accounts.	From its own pages, Cycode sells to large enterprises, with gaming platforms and financial institutions described among them. Cycode also addresses automotive software development. Its pages speak to security and development teams that want to align on application security posture. Cycode offers deployment on public cloud, private cloud, and on-premises environments.
Last verified
Last verified	November 2, 2026	September 27, 2026

Where they overlap

Checkmarx and Cycode are both filed under Static application security testing and Application security posture management.

Where they differ, field by field

Checkmarx's primary category is Static application security testing; Cycode's is Application security posture management.
Checkmarx is also filed under Dynamic application security testing and Software composition analysis. Cycode is also filed under Software supply chain security.
Checkmarx lists Checkmarx Developer Assist and Checkmarx MCP Server. Cycode lists Agentic Development Security Platform, Maestro, Context Intelligence Graph, Cycode SAST and ConnectorX.
Checkmarx was founded in 2006. Cycode was founded in 2019.
Checkmarx is owned by Hellman & Friedman, since 2020.

What it sells: Checkmarx

What Checkmarx Developer Assist does^[5]: Checkmarx Developer Assist provides real-time detection, remediation and actionable insights as developers write or refine AI-generated and existing code. It comprises two main elements, Realtime Scanning and Agentic-AI Remediation. Plugins exist for IDEs and for AI coding agents.
What Checkmarx MCP Server does^[5]: The Checkmarx MCP Server defines the tools and APIs that allow AI agents to interact with Checkmarx cloud services from within the IDE. The MCP Service is installed automatically once the developer authenticates in the IDE.

What it sells: Cycode

What Agentic Development Security Platform does^[3][5]: Cycode says it unifies control, context, and autonomy on a single platform. Cycode provides end-to-end controls for the AI layer of the software factory. Customers can deploy on public cloud, or on private cloud and on-premises environments through the Cycode Enterprise Server offering.
What Maestro does^[1][3][6]: Cycode says its specialized agents find and fix exploitable risks 17x faster. Cycode says teams can extend agent skills and implement controls with full audit trails.
What Cycode SAST does^[7]: Cycode SAST supports a wide range of programming languages and SCMs. Language support covers Java, C#, JavaScript, PHP, Python, Ruby, and Go. SCM support covers GitHub, GitLab, BitBucket, Azure DevOps, and Gerrit.

Questions about Checkmarx and Cycode

What do Checkmarx and Cycode sell?: Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Cycode sells Agentic Development Security Platform, Maestro, Context Intelligence Graph, Cycode SAST and ConnectorX.
Are Checkmarx and Cycode in the same category?: They share Static application security testing and Application security posture management. Checkmarx's primary category is Static application security testing and Cycode's is Application security posture management.
When were Checkmarx and Cycode founded?: Checkmarx was founded in 2006. Cycode was founded in 2019.
Who owns Checkmarx and Cycode?: Checkmarx is owned by Hellman & Friedman, since 2020.
Who are Checkmarx and Cycode sold to?: From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. From its own pages, Cycode sells to large enterprises, with gaming platforms and financial institutions described among them.
What have Checkmarx and Cycode announced recently?: July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.

About Checkmarx

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Checkmarx Developer Assist helps prevent vulnerabilities before they reach the pipeline. As developers write or refine AI-generated and existing code, Checkmarx Developer Assist provides real-time detection, remediation and actionable insights.

Checkmarx Developer Assist comprises two main elements. The first is Realtime Scanning, which identifies vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Scanners run in the background whenever a developer edits a relevant file. Checkmarx scanners identify vulnerabilities and unmasked secrets in code. Checkmarx also identifies vulnerable or malicious container images and open source packages used in a project. Results are marked as Problems that are highlighted in the code and annotated with identifying icons.

The second element is Agentic-AI Remediation, in which a developer initiates an Agentic-AI session to receive remediation suggestions. Checkmarx feeds relevant information to the AI agent, which accesses the Model Context Protocol (MCP) server to gather data from proprietary databases and customized AI models. The AI assistant then uses this data to generate remediated code for the project. Developers can accept the suggested changes or chat with the AI agent to learn more about the vulnerability and fine-tune the remediation suggestion.

Checkmarx Developer Assist lets developers mark risks as Ignore, so that the risks are no longer shown in the IDE. A developer can Revive a risk at any time to resume showing that risk. Specialized realtime scanners identify vulnerable open source packages and container images, exposed secrets and IaC risks.

Checkmarx provides dedicated Developer Assist plugins for two types of coding platforms: IDEs (VS Code, Cursor, Kiro, Windsurf, Visual Studio and JetBrains) and AI Coding Agents such as Claude Code. In the coding agent plugin, Developer Assist steps in and remediates the risk as the assistant generates code. The plugin is currently available for Claude Code CLI, Copilot CLI and Cursor CLI.

The Checkmarx MCP Server is a secure gateway that bridges AI-powered development assistants with the Checkmarx security platform. The Checkmarx MCP Server defines the tools and APIs that allow AI agents such as GitHub Copilot, Cursor AI or Windsurf AI to interact with Checkmarx cloud services from within the IDE. Once the developer authenticates in the IDE, the MCP Service is automatically installed. The Checkmarx MCP Server authenticates the developer's IDE session with Checkmarx. The Checkmarx MCP Server exposes available Checkmarx tools and capabilities, such as code scanning, remediation and policy enforcement, as AI-accessible functions.

Checkmarx says the MCP standard lets any IDE-integrated AI assistant access Checkmarx engines and services, including SAST, SCA, IaC and API Security, through a unified interface. Checkmarx selected the MCP standard as the foundation for its agentic architecture. Checkmarx describes MCP as vendor-neutral and supported by a growing ecosystem of AI tools.

Developer Assist is available in three licensing models, each serving a distinct segment of Checkmarx customers.^[1]

Checkmarx on the record

About Cycode

Cycode is the agentic development security platform that unifies visibility, prioritization, and remediation across the software development lifecycle. Cycode says it unifies control, context, and autonomy on a single platform to find and fix risk before it reaches production. Cycode provides end-to-end controls for the AI layer of the software factory.^[5][10]

Cycode says its AI code security combines deterministic rules with AI detection and reasoning. Cycode offers proprietary Application Security Testing tools, including SAST, SCA, and IaC scanning, built natively into the platform. Cycode SAST supports a wide range of programming languages and SCMs. Language support covers Java, C#, JavaScript, PHP, Python, Ruby, and Go. SCM support covers GitHub, GitLab, BitBucket, Azure DevOps, and Gerrit. Cycode catches misconfigurations across Terraform, Kubernetes, Helm, and CloudFormation. Cycode finds container vulnerabilities and correlates them back to the root cause in code.^[5][7]

On the software supply chain side, Cycode says it scans, detects, and blocks secret exposure in code, pipelines, productivity tools, and AI assistants. Cycode says it identifies misconfigured pipelines and prevents supply chain attacks with runtime eBPF monitoring. Cycode says it detects proprietary source code exposed to the public. Cycode can ingest, generate, and manage a software bill of materials. Cycode says it auto-discovers shadow AI, coding assistants, and MCP servers across the development environment. Cycode says it enforces policy-driven control over AI tools with full AIBOM coverage.

Cycode describes the Context Intelligence Graph as a single shared graph that distills noisy alerts into risks that matter. Cycode Maestro orchestrates AI Teammates that assess exposure, analyze exploitability, and generate fixes. Cycode says its specialized agents find and fix exploitable risks 17x faster. Cycode says it combines security understanding with code-to-runtime context to determine what attackers can actually exploit. Cycode says it unifies visibility and correlates risk across the ADLC into a single, queryable view. Cycode's risk posture module integrates 120+ tools across SCMs, CI/CD, cloud, ticketing, and security tools. Cycode says teams can create dashboards aligned with their business and stakeholders.^[1][8]

The RIG is the ASPM engine behind Cycode's native security solutions and ConnectorX, providing code to cloud traceability and automating vulnerability discovery, prioritization and remediation. ConnectorX is Cycode's click and connect ASPM integration platform that lets companies use Cycode's native ASPM tools or maximize their investments in their existing AppSec tools.^[8]

Cycode customers can deploy on public cloud, or on private cloud and on-premises environments through the Cycode Enterprise Server offering. Cycode offers enterprise SaaS customers a choice between EU data residency and Global (US) data residency.

Unity replaced fragmented scanning with Cycode's converged platform and gained unified visibility across thousands of repos. Uphold standardized on Cycode to bring AST, SSCS, and ASPM under a single graph. Cycode says Solaris cut critical-vulnerability MTTR by 99.4% and triage time by 99% after deploying Cycode. theScore is a Cycode customer that uses one platform dedicated to developer security. Cycode says it helps enterprises like UBS and Elastic prove compliance and keep shipping software securely. For automotive software teams, Cycode says it supports alignment with ISO/SAE 21434 and UNECE WP.29 lifecycle requirements through automated evidence collection and real-time posture reporting.^[5][8][10]

Cycode holds ISO27001 certification and ISO/IEC 42001 certification. Cycode has completed a SOC 2 Type II audit and a CSA STAR Level 1 attestation. Lior Levy is Co-founder and CEO of Cycode. Cycode is backed by Insight Partners and YL Ventures, and the series-B company has raised $80M. Cycode lists ION Crossover Partners among its backers.^[1][8][11]

Cycode on the record

Sources

Checkmarx full record

[1]checkmarx.comCheckmarx · checkmarx.com · undated page, accessed September 27, 2026 · Tier A
[2]Hellman friedman completes acquisition of checkmarxCheckmarx · checkmarx.com · published April 16, 2020 · Tier A
[3]Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 AttackThe Hacker News · published April 27, 2026 · Tier B
[4]Checkmarx Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 23, 2026 · Tier C
[5]About Checkmarx Developer AssistCheckmarx · undated page, accessed November 3, 2026 · Tier A
[6]Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection AvailableGlobeNewswire · published July 28, 2026 · Tier A

Cycode full record

[1]cycode.comCycode · cycode.com · undated page, accessed September 27, 2026 · Tier A
[2]About usCycode · cycode.com · undated page, accessed September 27, 2026 · Tier A
[3]Cycode | Agentic Development Security PlatformCycode · undated page, accessed October 24, 2026 · Tier A
[4]Cycode Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 24, 2026 · Tier C
[5]Cycode ReviewsCycode · undated page, accessed November 3, 2026 · Tier A
[6]Agentic Development Security Platform (ADSP) | CycodeCycode · undated page, accessed November 3, 2026 · Tier A
[7]SAST Tool - Static Application Security TestingCycode · undated page, accessed November 3, 2026 · Tier A
[8]Cycode Introduces a Complete Approach to ASPMCycode · published November 14, 2023 · Tier A
[9]Cycode Security & TrustCycode · undated page, accessed November 3, 2026 · Tier A
[10]Automotive Software Security | CycodeCycode · undated page, accessed November 3, 2026 · Tier A
[11]Cycode | About UsCycode · undated page, accessed November 3, 2026 · Tier A

Spot a factual error? Request a correction.