CISO Tribune

Vendor comparison · 2 companies

Checkmarx vs Kiuwan

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Kiuwan sells static application security testing (SAST) and software composition analysis (SCA). CISO Tribune files both under Static application security testing and Software composition analysis. This page sets the two records side by side: what each sells, where it is based, who owns and funds it, the customers it names and its recent news, each fact numbered to its source.

Change the companies

Up to four companies side by side.

  • Checkmarx
  • Kiuwan
Checkmarx vs Kiuwan: Products, Customers and Funding Compared
CheckmarxCheckmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE.checkmarx.comKiuwanKiuwan sells static application security testing (SAST) and software composition analysis (SCA).kiuwan.com
What it sells
  • Checkmarx Developer Assist[5]Delivers context-aware security guidance within the IDE. It combines realtime scanning with agentic AI remediation.
  • Checkmarx MCP Server[5]A secure gateway that bridges AI-powered development assistants with the Checkmarx security platform.
  • Code Security[1][5][7]A static application security testing tool that finds and prioritizes vulnerabilities across a codebase.
  • Insights[1][6]Supports SBOM generation by providing the components and information needed.
  • Code Quality[1][7][8]Code quality in a cloud environment for security QA engineers and IT teams.
Categories
Headquarters
Not stated on its pagesNot stated on its pages
Founded
2006[2]Not stated on its pages
Ownership and funding
Owned by Hellman & Friedman since 2020[2][4][5]Owned by Idera, Inc. since 2018[2][3]
Named customers
Not stated on its pagesNot stated on its pages
Recent news
  • July 28, 2026Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.[6]
  • April 27, 2026Checkmarx disclosed that its investigation into a supply chain security incident found a cybercriminal group had published company-related data on the dark web.[3]
Not stated on its pages
G2 and Gartner Peer Insights
  • G2: listed, seen November 3, 2026[4]
  • Gartner Peer Insights: Not stated on its pages
  • G2: Not stated on its pages
  • Gartner Peer Insights: Not stated on its pages
Who it fits
From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Its documentation describes plugins for several IDEs and for AI coding agents. Checkmarx offers Developer Assist in distinct licensing models, each serving a distinct segment of its customers, including SAST on-premises accounts.Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI. Kiuwan Governance is aimed at stakeholders, security teams, and software vendors managing risk across a software ecosystem. Kiuwan can be run in the cloud, as hybrid-cloud based solutions, or on-premise.
Last verified
November 2, 2026October 16, 2026

Where they overlap

  • Static application security testing is the primary category of both Checkmarx and Kiuwan; both are also filed under Software composition analysis.

Where they differ, field by field

  • Checkmarx is also filed under Dynamic application security testing and Application security posture management.
  • Checkmarx lists Checkmarx Developer Assist and Checkmarx MCP Server. Kiuwan lists Code Security, Insights and Code Quality.
  • Checkmarx was founded in 2006.
  • Checkmarx is owned by Hellman & Friedman, since 2020. Kiuwan is owned by Idera, Inc., since 2018.

How they differ

CISO Tribune files Checkmarx under Static application security testing, Dynamic application security testing, Software composition analysis and Application security posture management, with Static application security testing as its primary category. CISO Tribune files Kiuwan under Static application security testing and Software composition analysis, with Static application security testing as its primary category. Both companies therefore share a primary category, though Checkmarx is filed under more categories.

Checkmarx sells Checkmarx Developer Assist, which gives security guidance inside a developer's IDE through Realtime Scanning and Agentic-AI Remediation. Kiuwan sells Code Security, a SAST tool whose scans run locally or in CI/CD, and Insights, which can export an SBOM in the CycloneDX format. Kiuwan also sells Code Quality. Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. Checkmarx documents plugins for IDEs and for AI coding agents such as Claude Code. Kiuwan lists IDE plugins for Visual Studio, VS Code, Eclipse and JetBrains.

Checkmarx was founded in 2006 and has been owned by Hellman & Friedman since 2020. Kiuwan was founded in 2003 in Spain, was acquired by Idera, Inc. in 2018, and is now part of Sembi. On July 28, 2026, Checkmarx announced Checkmarx Fusion, a hybrid scanning approach in early access to its customers. On April 27, 2026, Checkmarx disclosed that its investigation into a supply chain security incident found a cybercriminal group had published company-related data on the dark web.

What it sells: Checkmarx

What Checkmarx Developer Assist does[5]
Checkmarx Developer Assist provides real-time detection, remediation and actionable insights as developers write or refine AI-generated and existing code. It comprises two main elements, Realtime Scanning and Agentic-AI Remediation. Plugins exist for IDEs and for AI coding agents.
What Checkmarx MCP Server does[5]
The Checkmarx MCP Server defines the tools and APIs that allow AI agents to interact with Checkmarx cloud services from within the IDE. The MCP Service is installed automatically once the developer authenticates in the IDE.

What it sells: Kiuwan

What Code Security does[1][5][7]
Kiuwan Code Security is a SAST tool that finds and prioritizes vulnerabilities across a codebase. Scans can run locally or in CI/CD, and findings are reviewed in a dashboard with remediation tips and compliance mappings. Kiuwan Code Security can analyze code in the cloud or use the Kiuwan Local Analyzer when code must stay on-premise. Kiuwan states that Kiuwan Code Security is compliant with security standards including CWE, OWASP, PCI, CERT, and SANS.
What Insights does[1][6]
Kiuwan Insights supports SBOM generation by providing the components and information needed. Kiuwan Insights can generate and export a complete Software Bill of Materials (SBOM) in the CycloneDX standard format. Kiuwan Insights gives visibility into the open-source and third-party components used in applications.

Questions about Checkmarx and Kiuwan

What do Checkmarx and Kiuwan sell?
Checkmarx sells Checkmarx Developer Assist and Checkmarx MCP Server. Kiuwan sells Code Security, Insights and Code Quality.
Are Checkmarx and Kiuwan in the same category?
Yes. Static application security testing is the primary category of both on CISO Tribune.
When were Checkmarx and Kiuwan founded?
Checkmarx was founded in 2006.
Who owns Checkmarx and Kiuwan?
Checkmarx is owned by Hellman & Friedman, since 2020. Kiuwan is owned by Idera, Inc., since 2018.
Who are Checkmarx and Kiuwan sold to?
From its own pages, Checkmarx sells mainly to developers who write code in IDEs and with AI coding agents. Kiuwan states that its SAST is compliant with financial security standards like NYDFS, GLBA, and PCI, and with banking security standards such as ISO/IEC, NIST, and PCI.
What have Checkmarx and Kiuwan announced recently?
July 28, 2026: Checkmarx announced Checkmarx Fusion, a hybrid scanning approach now available in early access to its customers.

About Checkmarx

Checkmarx sells Checkmarx Developer Assist, which delivers context-aware security guidance directly within a developer's IDE. Checkmarx Developer Assist helps prevent vulnerabilities before they reach the pipeline. As developers write or refine AI-generated and existing code, Checkmarx Developer Assist provides real-time detection, remediation and actionable insights.

Checkmarx Developer Assist comprises two main elements. The first is Realtime Scanning, which identifies vulnerabilities in realtime during IDE development of both human-generated and AI-generated code. Scanners run in the background whenever a developer edits a relevant file. Checkmarx scanners identify vulnerabilities and unmasked secrets in code. Checkmarx also identifies vulnerable or malicious container images and open source packages used in a project. Results are marked as Problems that are highlighted in the code and annotated with identifying icons.

The second element is Agentic-AI Remediation, in which a developer initiates an Agentic-AI session to receive remediation suggestions. Checkmarx feeds relevant information to the AI agent, which accesses the Model Context Protocol (MCP) server to gather data from proprietary databases and customized AI models. The AI assistant then uses this data to generate remediated code for the project. Developers can accept the suggested changes or chat with the AI agent to learn more about the vulnerability and fine-tune the remediation suggestion.

Checkmarx Developer Assist lets developers mark risks as Ignore, so that the risks are no longer shown in the IDE. A developer can Revive a risk at any time to resume showing that risk. Specialized realtime scanners identify vulnerable open source packages and container images, exposed secrets and IaC risks.

Checkmarx provides dedicated Developer Assist plugins for two types of coding platforms: IDEs (VS Code, Cursor, Kiro, Windsurf, Visual Studio and JetBrains) and AI Coding Agents such as Claude Code. In the coding agent plugin, Developer Assist steps in and remediates the risk as the assistant generates code. The plugin is currently available for Claude Code CLI, Copilot CLI and Cursor CLI.

The Checkmarx MCP Server is a secure gateway that bridges AI-powered development assistants with the Checkmarx security platform. The Checkmarx MCP Server defines the tools and APIs that allow AI agents such as GitHub Copilot, Cursor AI or Windsurf AI to interact with Checkmarx cloud services from within the IDE. Once the developer authenticates in the IDE, the MCP Service is automatically installed. The Checkmarx MCP Server authenticates the developer's IDE session with Checkmarx. The Checkmarx MCP Server exposes available Checkmarx tools and capabilities, such as code scanning, remediation and policy enforcement, as AI-accessible functions.

Checkmarx says the MCP standard lets any IDE-integrated AI assistant access Checkmarx engines and services, including SAST, SCA, IaC and API Security, through a unified interface. Checkmarx selected the MCP standard as the foundation for its agentic architecture. Checkmarx describes MCP as vendor-neutral and supported by a growing ecosystem of AI tools.

Developer Assist is available in three licensing models, each serving a distinct segment of Checkmarx customers.[1]

Checkmarx on the record

Sources

Checkmarx full record

  1. [1]checkmarx.comCheckmarx · checkmarx.com · undated page, accessed September 27, 2026 · Tier A
  2. [2]Hellman friedman completes acquisition of checkmarxCheckmarx · checkmarx.com · published April 16, 2020 · Tier A
  3. [3]Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 AttackThe Hacker News · published April 27, 2026 · Tier B
  4. [4]Checkmarx Reviews 2026: Details, Pricing, & Features - G2G2 · undated page, accessed October 23, 2026 · Tier C
  5. [5]About Checkmarx Developer AssistCheckmarx · undated page, accessed November 3, 2026 · Tier A
  6. [6]Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection AvailableGlobeNewswire · published July 28, 2026 · Tier A

Kiuwan full record

  1. [1]kiuwan.comKiuwan · kiuwan.com · undated page, accessed October 16, 2026 · Tier A
  2. [2]Idera acquires kiuwanKiuwan · kiuwan.com · published May 26, 2021 · Tier A
  3. [3]About Us | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  4. [4]Why US Organizations Need Kiuwan | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  5. [5]Static Application Security Testing (SAST) | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  6. [6]SBOM Software Bill Of Materials | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  7. [7]Code Security | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  8. [8]Pricing | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  9. [9]Why Finance Organizations Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A
  10. [10]Why Banks Need SAST | KiuwanKiuwan · undated page, accessed November 10, 2026 · Tier A

Spot a factual error? Request a correction.