CISO Tribune

Vendor comparison · 2 companies

Checkmarx vs Data Theorem

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Data Theorem sells application security products that secure code, mobile apps, APIs and cloud. CISO Tribune files both under Static application security testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Checkmarx
  • Data Theorem
Checkmarx vs Data Theorem: Products, Customers and Funding Compared
CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.checkmarx.comData TheoremData Theorem sells application security products that secure code, mobile apps, APIs and cloud.datatheorem.com
What it sells
  • Checkmarx Developer Assist[5]Delivers context-aware security guidance within the IDE. It combines realtime scanning with agentic AI remediation.
  • Checkmarx MCP Server[5]A secure gateway that bridges AI-powered development assistants with the Checkmarx security platform.
  • Mobile Secure[2][6][8]Automated security and privacy testing for every iOS and Android release.
  • Mobile Protect[2][3][7][13]Mobile Protect defends the app on the device.
  • Code SAST Secure[3][5][8][14][16]SAST, SCA and SBOM across every repo, in more than 20 languages.
  • API Secure[2][5][8][13][15]API Secure discovers every REST, GraphQL, gRPC, SOAP and serverless API.
  • Cloud Secure[2][5][8][16]Cloud Secure extends API Secure into the cloud your APIs and apps run on.
Categories
Headquarters
Not stated on its pagesPalo Alto, United States[1]
Founded
2006[2]Not stated on its pages
Ownership and funding
Owned by Hellman & Friedman since 2020[2][4][5]Not stated on its pages
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • July 28, 2026Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.[6]
  • April 27, 2026Checkmarx disclosed that its investigation into a supply chain security incident found a cybercriminal group had published company-related data on the dark web.[3]
  • June 30, 2026Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense.[17]
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: listed, seen November 3, 2026[10]
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its documentation describes plugins for several IDEs and for AI coding agents. Checkmarx offers Developer Assist in distinct licensing models, each serving a distinct segment of its customers, including SAST on-premises accounts.From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about. It addresses teams that want to catch issues in code and the pipeline and hand auditors reports built from real scans. Game publishers are addressed with Mobile Protect for Gaming, which stops cheats, tampering and clones in the game.
Last verified
November 2, 2026September 27, 2026

Where they overlap

  • Checkmarx and Data Theorem are both filed under Static application security testing.

Where they differ, field by field

  • Checkmarx's primary category is Static application security testing; Data Theorem's is API security.
  • Checkmarx is also filed under Dynamic application security testing, Software composition analysis and Application security posture management. Data Theorem is also filed under Mobile security and Cloud-native application protection (CNAPP).
  • Checkmarx lists Checkmarx Developer Assist and Checkmarx MCP Server. Data Theorem lists Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure.
  • Data Theorem is headquartered in Palo Alto, United States.
  • Checkmarx was founded in 2006.
  • Checkmarx is owned by Hellman & Friedman, since 2020.

What it sells: Checkmarx

What Checkmarx Developer Assist does[5]
Checkmarx Developer Assist provides real-time detection, remediation and actionable insights as developers write or refine AI-generated and existing code. It comprises two main elements, Realtime Scanning and Agentic-AI Remediation. Plugins exist for IDEs and for AI coding agents.
What Checkmarx MCP Server does[5]
The Checkmarx MCP Server defines the tools and APIs that allow AI agents to interact with Checkmarx cloud services from within the IDE. The MCP Service is installed automatically once the developer authenticates in the IDE.

What it sells: Data Theorem

What Mobile Secure does[2][6][8]
Mobile Secure provides automated security and privacy testing for every iOS and Android release. Mobile Secure signs in to your apps and tests every screen of every release.
What Mobile Protect does[2][3][7][13]
Mobile Protect blocks hooking frameworks, debuggers and re-signed copies inside the app. Mobile Protect scores every session and flags likely fraud to your team. Mobile Protect includes SSL pinning built on TrustKit.
What Code SAST Secure does[3][5][8][14][16]
Code SAST Secure scans your code and dependencies. Code SAST Secure secures your code, open source libraries and vendor SBOMs in one place. Code SAST Secure catches infrastructure as code misconfigurations in the repository, before they ship.
What API Secure does[2][5][8][13][15]
API Secure scores every operation on its own across authentication. API Secure probes your APIs from outside, then signs in as two different users. API Secure spots the abuse and tells the WAF you already run what to block.
What Cloud Secure does[2][5][8][16]
Cloud Secure covers the resources, roles and data behind the APIs. Cloud Secure runs the same IaC checks on what is deployed, and secures the containers and registry images your APIs and apps run on.

Questions about Checkmarx and Data Theorem

What do Checkmarx and Data Theorem sell?
Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Data Theorem sells Mobile Secure, Mobile Protect, Code SAST Secure, API Secure and Cloud Secure.
Are Checkmarx and Data Theorem in the same category?
They share Static application security testing. Checkmarx's primary category is Static application security testing and Data Theorem's is API security.
Where are Checkmarx and Data Theorem headquartered?
Data Theorem is headquartered in Palo Alto, United States.
When were Checkmarx and Data Theorem founded?
Checkmarx was founded in 2006.
Who owns Checkmarx and Data Theorem?
Checkmarx is owned by Hellman & Friedman, since 2020.
Who are Checkmarx and Data Theorem sold to?
From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. From its own pages, the company sells to teams that need to find every app, API and cloud resource, including the ones nobody told security about.
What have Checkmarx and Data Theorem announced recently?
July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers. June 30, 2026: Data Theorem launched three AI security capabilities that together form a closed-loop platform covering exploit discovery, remediation, and runtime defense.

About Checkmarx

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Checkmarx Developer Assist helps prevent vulnerabilities before they reach the pipeline. As developers write or refine AI-generated and existing code, Checkmarx Developer Assist provides real-time detection, remediation and actionable insights.

Checkmarx Developer Assist comprises two main elements. The first is Realtime Scanning, which identifies vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Scanners run in the background whenever a developer edits a relevant file. Checkmarx scanners identify vulnerabilities and unmasked secrets in code. Checkmarx also identifies vulnerable or malicious container images and open source packages used in a project. Results are marked as Problems that are highlighted in the code and annotated with identifying icons.

The second element is Agentic-AI Remediation, in which a developer initiates an Agentic-AI session to receive remediation suggestions. Checkmarx feeds relevant information to the AI agent, which accesses the Model Context Protocol (MCP) server to gather data from proprietary databases and customized AI models. The AI assistant then uses this data to generate remediated code for the project. Developers can accept the suggested changes or chat with the AI agent to learn more about the vulnerability and fine-tune the remediation suggestion.

Checkmarx Developer Assist lets developers mark risks as Ignore, so that the risks are no longer shown in the IDE. A developer can Revive a risk at any time to resume showing that risk. Specialized realtime scanners identify vulnerable open source packages and container images, exposed secrets and IaC risks.

Checkmarx provides dedicated Developer Assist plugins for two types of coding platforms: IDEs (VS Code, Cursor, Kiro, Windsurf, Visual Studio and JetBrains) and AI Coding Agents such as Claude Code. In the coding agent plugin, Developer Assist steps in and remediates the risk as the assistant generates code. The plugin is currently available for Claude Code CLI, Copilot CLI and Cursor CLI.

The Checkmarx MCP Server is a secure gateway that bridges AI-powered development assistants with the Checkmarx security platform. The Checkmarx MCP Server defines the tools and APIs that allow AI agents such as GitHub Copilot, Cursor AI or Windsurf AI to interact with Checkmarx cloud services from within the IDE. Once the developer authenticates in the IDE, the MCP Service is automatically installed. The Checkmarx MCP Server authenticates the developer's IDE session with Checkmarx. The Checkmarx MCP Server exposes available Checkmarx tools and capabilities, such as code scanning, remediation and policy enforcement, as AI-accessible functions.

Checkmarx says the MCP standard lets any IDE-integrated AI assistant access Checkmarx engines and services, including SAST, SCA, IaC and API Security, through a unified interface. Checkmarx selected the MCP standard as the foundation for its agentic architecture. Checkmarx describes MCP as vendor-neutral and supported by a growing ecosystem of AI tools.

Developer Assist is available in three licensing models, each serving a distinct segment of Checkmarx customers.[1]

Checkmarx on the record

Sources

Checkmarx full record

  1. [1]checkmarx.comCheckmarx · checkmarx.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Hellman friedman completes acquisition of checkmarxCheckmarx · checkmarx.com · published April 16, 2020 · Tier A
  3. [3]Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 AttackThe Hacker News · published April 27, 2026 · Tier B
  4. [4]Checkmarx Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 23, 2026 · Tier C
  5. [5]About Checkmarx Developer AssistCheckmarx · undated page, accessed November 3, 2026 · Tier A
  6. [6]Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection AvailableGlobeNewswire · published July 28, 2026 · Tier A

Data Theorem full record

  1. [1]Data theorem unveils code secure fully integrated ast product with sast sca and sbom management 302269428Data Theorem via PR Newswire · prnewswire.com · published October 8, 2024 · Tier A
  2. [2]datatheorem.comData Theorem · datatheorem.com · undated page, accessed September 27, 2026 · Tier A
  3. [3]Solutions | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  4. [4]DevSecOps: Security in Every Stage, From Code to Runtime | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  5. [5]Products | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  6. [6]Mobile SecureData Theorem · undated page, accessed October 24, 2026 · Tier A
  7. [7]Mobile ProtectData Theorem · undated page, accessed October 24, 2026 · Tier A
  8. [8]Data Theorem | AppSec | API Security | Cloud SecurityData Theorem · undated page, accessed October 24, 2026 · Tier A
  9. [9]ASPM: Application Security Posture Management | Data TheoremData Theorem · undated page, accessed October 24, 2026 · Tier A
  10. [10]Data Theorem Reviews 2026: Details, Pricing, & Features | G2G2 · undated page, accessed October 24, 2026 · Tier C
  11. [11]Regulatory Compliance | Audit-Ready Reports | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  12. [12]AI-Driven Application Security (AppSec) | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  13. [13]AI Runtime Protection for Apps and APIs | Data TheoremData Theorem · undated page, accessed November 3, 2026 · Tier A
  14. [14]Code SAST Secure: SAST, SCA, SBOM and AI Auto-RemediationData Theorem · undated page, accessed November 3, 2026 · Tier A
  15. [15]API Security Testing and Runtime Protection | API SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  16. [16]Cloud Security for APIs and Cloud-Native Apps | Cloud SecureData Theorem · undated page, accessed November 3, 2026 · Tier A
  17. [17]Data Theorem Launches the Industry’s First Closed-Loop AI Security PlatformData Theorem · published June 30, 2026 · Tier A

Spot a factual error? Request a correction.