SECURITY ATLAS / EVALUATION BRIEF Checkmarx One Research reviewed: 2026-10-18 https://atlasofsecurity.com/landscape/vendors/checkmarx-one/ THE ATLAS TAKE Checkmarx One puts several application-security scanners behind shared project and reporting workflows. Its SCA documentation is particularly useful for understanding the distinction between identifying packaged files and resolving dependencies through package managers. Atlas analysis: this is a strong evaluation candidate when a program wants coordinated source and dependency work, provided the real build ecosystem is represented. Do not assess the platform by a scan count alone. Confirm what each selected engine analyzed, which private repositories it reached, and how unresolved dependencies or partial scans affect the apparent risk picture. SCOPE Source-upload versus air-gap deployment, Fusion or hybrid engine accuracy on the local stack, and whether ASPM can land analytics without locking to Checkmarx scanners are buyer tests. Documentation describes ASPM as a landing analytics surface rather than a replacement engine. WORTH A LOOK WHEN Programs coordinating several AppSec analysis engines and centralized project-level triage. THINK TWICE WHEN The organization cannot provide build context or assumes a source upload guarantees complete dependency resolution. IMPLEMENTATION 1. Map the scanner plan Choose engines for each application and record exclusions and supported ecosystems. 2. Resolve representative dependencies Include private registries, transitive packages, and the build runner used for releases. 3. Define actionable gates Agree finding ownership, severity policy, incomplete-scan handling, and approved exception expiry. OPERATING REALITY Project definitions, scanner selection, repository permissions, and resolver configuration need ownership. Atlas analysis: private package registries and monorepos are good pilot cases. Security should agree which incomplete scans fail a pipeline and which remain advisory, rather than allowing missing data to appear as a clean security result. COMMERCIAL CONSIDERATIONS Quote each intended scanner and governance capability with deployment and integration requirements attached. - Purchased engines and application scope - Repository and resolver integration work - Triage and centralized governance needs EVALUATION PLAN / PROPOSED TESTS, NOT COMPLETED RESULTS 1. Prove dependency resolution Acceptance evidence: Compare the resolved graph with the application lockfile and private package source. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 2. Check a source defect path Acceptance evidence: Retain the reported data flow, exact code revision, and owner validation. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ 3. Exercise a partial scan Acceptance evidence: Remove a lab dependency credential and verify the pipeline exposes incomplete coverage rather than a false clean state. Owner: __________ Pass criterion: __________ Observed result: __________ Evidence location: __________ QUESTIONS FOR THE VENDOR - Can source stay in-region or air-gapped, and what must still be uploaded? - How accurate are Fusion or hybrid engines on this stack compared with individual engines? - Does ASPM accept non-Checkmarx scanners without forcing a rip-and-replace? EVIDENCE GAPS - No independent finding-accuracy or developer-effort test was conducted. - Language support and source-data flow must be checked for each selected engine. SOURCES Checkmarx One workflow (Documentation) https://docs.checkmarx.com/en/34965-68520-checkmarx-one-workflow.html SCA scanner methods (Documentation) https://docs.checkmarx.com/en/34965-322318-sca-scanner.html SCA architecture and data FAQ (Documentation) https://docs.checkmarx.com/en/34965-19101-faq.html Use synthetic fixtures in an authorized environment. Agree rollback and acceptance criteria before enforcement. Documentation research and Atlas analysis. Independent hands-on effectiveness, effort, and complete price remain unassessed.