What do Checkmarx and Fleuret AI sell?

Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Fleuret AI sells Émile and Hortense.

Are Checkmarx and Fleuret AI in the same category?

They share Static application security testing and Dynamic application security testing. Checkmarx's primary category is Static application security testing and Fleuret AI's is Breach simulation and automated pen-testing.

Who owns Checkmarx and Fleuret AI?

Checkmarx is owned by Hellman & Friedman, since 2020. Fleuret AI is privately held.

Who are Checkmarx and Fleuret AI sold to?

From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its published guides address CISOs at credit institutions and at SaaS companies.

What have Checkmarx and Fleuret AI announced recently?

July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers. October 5, 2026: Fleuret AI closed a €4M pre-seed round led by RAISE Ventures, with participation from Auriga Cyber Ventures, Wind Capital and Better Angle.

Vendor comparison · 2 companies

Checkmarx vs Fleuret AI

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Fleuret AI sells pentesting that combines artificial intelligence and offensive expertise. CISO Tribune files both under Static application security testing and Dynamic application security testing. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

Checkmarx
Fleuret AI

Add a company

Checkmarx vs Fleuret AI: Products, Customers and Funding Compared
What it sells
	CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.checkmarx.com	Fleuret AIFleuret AI sells pentesting that combines artificial intelligence and offensive expertise.fleuret.ai
What it sells	Checkmarx Developer Assist^[5]Delivers context-aware security guidance within the IDE. It combines realtime scanning with agentic AI remediation. Checkmarx MCP Server^[5]A secure gateway that bridges AI-powered development assistants with the Checkmarx security platform.	Émile^[4][6]Runs pentests on applications, APIs and infrastructure and ships a replayable exploit with every finding. Hortense^[4][5][6]Tells customers what to test next, and when.
Categories
Categories	Static application security testing (primary category) Dynamic application security testing Software composition analysis Application security posture management	Breach simulation and automated pen-testing (primary category) Penetration testing and red team services Static application security testing Dynamic application security testing
Headquarters
Headquarters	Not stated on its pages	Not stated on its pages
Founded
Founded	2006^[2]	Not stated on its pages
Ownership and funding
Ownership and funding	Owned by Hellman & Friedman since 2020^[2][4][5]	Privately held
Named customers
Named customers	Not stated on its pages	Not stated on its pages
Recent news
Recent news	July 28, 2026Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.^[6] April 27, 2026Checkmarx disclosed that its investigation into a supply chain security incident found a cybercriminal group had published company-related data on the dark web.^[3]	October 5, 2026Fleuret AI closed a €4M pre-seed round led by RAISE Ventures, with participation from Auriga Cyber Ventures, Wind Capital and Better Angle.^[2]
G2 and Gartner Peer Insights
G2 and Gartner Peer Insights	G2: listed, seen November 3, 2026^[4] Gartner Peer Insights: Not stated on its pages	G2: Not stated on its pages Gartner Peer Insights: Not stated on its pages
Who it fits
Who it fits	From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its documentation describes plugins for several IDEs and for AI coding agents. Checkmarx offers Developer Assist in distinct licensing models, each serving a distinct segment of its customers, including SAST on-premises accounts.	Its published guides address CISOs at credit institutions and at SaaS companies. Fleuret describes its service as adding to the people already in place, such as a customer's team, MSSP or PASSI-certified firm. Its reports are signed and mapped to DORA, NIS2 and ISO 27001. Hosting and inference run on Scaleway in Paris.
Last verified
Last verified	November 2, 2026	October 21, 2026

Where they overlap

Checkmarx and Fleuret AI are both filed under Static application security testing and Dynamic application security testing.

Where they differ, field by field

Checkmarx's primary category is Static application security testing; Fleuret AI's is Breach simulation and automated pen-testing.
Checkmarx is also filed under Software composition analysis and Application security posture management. Fleuret AI is also filed under Penetration testing and red team services.
Checkmarx lists Checkmarx Developer Assist and Checkmarx MCP Server. Fleuret AI lists Émile and Hortense.
Checkmarx was founded in 2006.
Checkmarx is owned by Hellman & Friedman, since 2020. Fleuret AI is privately held.

What it sells: Checkmarx

What Checkmarx Developer Assist does^[5]: Checkmarx Developer Assist provides real-time detection, remediation and actionable insights as developers write or refine AI-generated and existing code. It comprises two main elements, Realtime Scanning and Agentic-AI Remediation. Plugins exist for IDEs and for AI coding agents.
What Checkmarx MCP Server does^[5]: The Checkmarx MCP Server defines the tools and APIs that allow AI agents to interact with Checkmarx cloud services from within the IDE. The MCP Service is installed automatically once the developer authenticates in the IDE.

What it sells: Fleuret AI

What Émile does^[4][6]: A separate validator confirms every finding with a non-destructive exploit. Every finding ships with a working, replayable exploit. Each finding lands as a ticket with its exploit, an owner and a remediation, pushed to Jira, Linear or Slack.
What Hortense does^[4][5][6]: Hortense maps a customer's estate from domain to database. Hortense crosses what changed in the code with what is exposed on the internet and what past pentests found. Hortense prepares the scope, and a person with launch rights starts the pentest, which Émile runs. Hortense comes with every yearly plan.

Questions about Checkmarx and Fleuret AI

What do Checkmarx and Fleuret AI sell?: Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Fleuret AI sells Émile and Hortense.
Are Checkmarx and Fleuret AI in the same category?: They share Static application security testing and Dynamic application security testing. Checkmarx's primary category is Static application security testing and Fleuret AI's is Breach simulation and automated pen-testing.
When were Checkmarx and Fleuret AI founded?: Checkmarx was founded in 2006.
Who owns Checkmarx and Fleuret AI?: Checkmarx is owned by Hellman & Friedman, since 2020. Fleuret AI is privately held.
Who are Checkmarx and Fleuret AI sold to?: From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its published guides address CISOs at credit institutions and at SaaS companies.
What have Checkmarx and Fleuret AI announced recently?: July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers. October 5, 2026: Fleuret AI closed a €4M pre-seed round led by RAISE Ventures, with participation from Auriga Cyber Ventures, Wind Capital and Better Angle.

About Checkmarx

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Checkmarx Developer Assist helps prevent vulnerabilities before they reach the pipeline. As developers write or refine AI-generated and existing code, Checkmarx Developer Assist provides real-time detection, remediation and actionable insights.

Checkmarx Developer Assist comprises two main elements. The first is Realtime Scanning, which identifies vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Scanners run in the background whenever a developer edits a relevant file. Checkmarx scanners identify vulnerabilities and unmasked secrets in code. Checkmarx also identifies vulnerable or malicious container images and open source packages used in a project. Results are marked as Problems that are highlighted in the code and annotated with identifying icons.

The second element is Agentic-AI Remediation, in which a developer initiates an Agentic-AI session to receive remediation suggestions. Checkmarx feeds relevant information to the AI agent, which accesses the Model Context Protocol (MCP) server to gather data from proprietary databases and customized AI models. The AI assistant then uses this data to generate remediated code for the project. Developers can accept the suggested changes or chat with the AI agent to learn more about the vulnerability and fine-tune the remediation suggestion.

Checkmarx Developer Assist lets developers mark risks as Ignore, so that the risks are no longer shown in the IDE. A developer can Revive a risk at any time to resume showing that risk. Specialized realtime scanners identify vulnerable open source packages and container images, exposed secrets and IaC risks.

Checkmarx provides dedicated Developer Assist plugins for two types of coding platforms: IDEs (VS Code, Cursor, Kiro, Windsurf, Visual Studio and JetBrains) and AI Coding Agents such as Claude Code. In the coding agent plugin, Developer Assist steps in and remediates the risk as the assistant generates code. The plugin is currently available for Claude Code CLI, Copilot CLI and Cursor CLI.

The Checkmarx MCP Server is a secure gateway that bridges AI-powered development assistants with the Checkmarx security platform. The Checkmarx MCP Server defines the tools and APIs that allow AI agents such as GitHub Copilot, Cursor AI or Windsurf AI to interact with Checkmarx cloud services from within the IDE. Once the developer authenticates in the IDE, the MCP Service is automatically installed. The Checkmarx MCP Server authenticates the developer's IDE session with Checkmarx. The Checkmarx MCP Server exposes available Checkmarx tools and capabilities, such as code scanning, remediation and policy enforcement, as AI-accessible functions.

Checkmarx says the MCP standard lets any IDE-integrated AI assistant access Checkmarx engines and services, including SAST, SCA, IaC and API Security, through a unified interface. Checkmarx selected the MCP standard as the foundation for its agentic architecture. Checkmarx describes MCP as vendor-neutral and supported by a growing ecosystem of AI tools.

Developer Assist is available in three licensing models, each serving a distinct segment of Checkmarx customers.^[1]

Checkmarx on the record

About Fleuret AI

Fleuret AI sells pentesting that combines artificial intelligence and offensive expertise. Fleuret uses agentic AI to simulate real attacks on its customers' systems. Émile runs pentests on customer applications, APIs and infrastructure and ships a replayable exploit with every finding. Hortense tells customers what to test next, and when. Fleuret states that its service is built and hosted in Europe.^[1][3][4]

A separate validator confirms every finding with a non-destructive exploit. Several agents test the surface at once and reproduce every finding before it is reported. Every finding ships with a working, replayable exploit, and a finding that cannot be reproduced is left out of the report. Fleuret states that proofs of concept are read-only and non-destructive. Fleuret states that its orchestration is deterministic code, not a free-running model, and that it ends in a signed report.^[4][5]

Each finding becomes a ticket with its exploit, an owner and a remediation, pushed to Jira, Linear or Slack. Customers can launch a full pentest the day an application changes and can re-test a fix whenever they want. Fleuret reports contain a replayable exploit for every finding, logged re-tests, the coverage of what was tested and held, and a signed report mapped to DORA, NIS2 and ISO 27001.^[4]

Hortense maps a customer's estate from domain to database and crosses what changed in the code with what is exposed on the internet and what past pentests found. Hortense connects what a customer already has into a view of risk: what to test, what to fix first, what can wait, and why. For each application, Hortense weighs the last pentest, what changed since, and how close it sits to a crown jewel. Hortense then recommends a pentest with its reasons and prepares it, and the customer approves it. Hortense prepares the scope, and a person with launch rights starts the pentest, which Émile runs. Hortense comes with every yearly plan.^[1][4][6]

Fleuret sells pentests from 4,000 euros per test. Each extra credit costs €4,000, whatever the plan. Credits are valid for the subscription year and do not carry over to the next one. A first pentest is credited in full against a yearly plan taken within 60 days.^[5][7]

Hosting and inference run on Scaleway in Paris, which Fleuret describes as a European provider. Fleuret runs open-weight models (gpt-oss, Kimi K2.5) on H100 GPUs at Scaleway in Paris. Engagement data does not leave that environment to reach a third-party model API. Engagement data, namely vulnerabilities, exploitation evidence and reports, is retained for 18 months in a per-client segmented European environment, then deleted. Fleuret AI states that stored data is encrypted with AES-256 and that communications use TLS 1.2 or higher. Fleuret AI states that its production data is hosted in data centers within the European Union. Fleuret AI states that it is compliant with the General Data Protection Regulation. Fleuret AI gives its address as 60 Rue François 1er, 75008 Paris, France.^[4][8]

Fleuret AI publishes practical guides for CISOs scoping penetration testing under DORA, NIS2, ISO 27001, SOC 2 and PCI DSS. One guide covers how SaaS CISOs decide scope and evidence pentest against Article 21(2)(e) and 21(2)(f).^[1][4][5][9]

Fleuret AI on the record

Sources

Checkmarx full record

[1]checkmarx.comCheckmarx · checkmarx.com · undated page, accessed September 27, 2026 · Tier A
[2]Hellman friedman completes acquisition of checkmarxCheckmarx · checkmarx.com · published April 16, 2020 · Tier A
[3]Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 AttackThe Hacker News · published April 27, 2026 · Tier B
[4]Checkmarx Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 23, 2026 · Tier C
[5]About Checkmarx Developer AssistCheckmarx · undated page, accessed November 3, 2026 · Tier A
[6]Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection AvailableGlobeNewswire · published July 28, 2026 · Tier A

Fleuret AI full record

[1]fleuret.aiFleuret AI · fleuret.ai · undated page, accessed October 21, 2026 · Tier A
[2]Fleuret raises €4M pre-seed for agentic pentestingFleuret AI · published October 5, 2026 · Tier A
[3]About Fleuret | Agentic AI pentestingFleuret AI · undated page, accessed November 10, 2026 · Tier A
[4]Fleuret | AI-powered automated pentestingFleuret AI · undated page, accessed November 10, 2026 · Tier A
[5]Pricing | Pentest credits, platform included | FleuretFleuret AI · undated page, accessed November 10, 2026 · Tier A
[6]Hortense, your offsec brain | Know what to test next, and when | FleuretFleuret AI · undated page, accessed November 10, 2026 · Tier A
[7]SOC 2 and ISO 27001 cost calculator | FleuretFleuret AI · undated page, accessed November 10, 2026 · Tier A
[8]Security Policy | FleuretFleuret AI · published March 11, 2026 · Tier A
[9]Compliance Pentest Guides | DORA, NIS2, ISO 27001 | FleuretFleuret AI · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.