> For the complete documentation index, see [llms.txt](https://docs.aquilax.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.aquilax.ai/user-manual/comparison/aquilax-vs-checkmarx.md). # AquilaX vs Checkmarx AquilaX vs Checkmarx — Head-to-Head Findings & Product Quality **Scope:** 8 independent codebases (referenced here as `project_case_1` … `project_case_8`). Each was scanned by both platforms; results below come directly from the scan exports. {% hint style="warning" %} This assessment was conducted in good faith as an internal, like-for-like benchmark across eight independent codebases. Every figure in it is drawn directly from the two platforms' own native scan exports — no findings were added, removed, or re-weighted. The tested codebases are anonymized throughout precisely to keep the focus on measurable output rather than on any specific customer or product. The differences reported are factual and reproducible, not editorial. Coverage differences reflect the detection engines each platform actually ran during the tests (for example, infrastructure-as-code, secrets, container, PII, and compliance scanning were not present in the Checkmarx output). Triage status ("Unverified," "True Positive," "False Positive") is reported exactly as each platform labeled it in its own results. Where a finding was classified as a true or false positive, that classification is the tool's own — or, where AquilaX applied its verification layer, it is identified as such. We recognize that scan results depend on configuration, scope, and product tier, and that a differently configured run could produce different numbers. For that reason we welcome Checkmarx, or any independent party, to reproduce the assessment against the same codebases under agreed conditions. If a re-run surfaces a configuration difference that materially changes any figure, we will update the assessment accordingly. This document is a point-in-time engineering comparison, not a certification, endorsement, or statement about either company's overall capabilities. It reflects the specific scans performed on the specific code tested, on the dates tested. {% endhint %} *** ### TL;DR * **AquilaX runs 9 detection engines** (SAST, SCA, IAC, Secrets, Container, PII, Compliance, Securitron, AI/Vibe-Code). **Checkmarx runs 2** (SAST, SCA). Entire risk classes — infrastructure-as-code, hardcoded secrets, container, PII, compliance — are simply **invisible to Checkmarx** in these tests. * **AquilaX ships triaged results. Checkmarx does not.** Across all 8 projects, **100% of Checkmarx findings came back as "Unverified"** (0 conformed, 0 urgent). Every one of Checkmarx's **4,838 raw findings** lands on a human to sort. AquilaX pre-classifies each finding as True Positive / False Positive. * **AquilaX confirmed 5,475 true-positive findings** at **61% aggregate precision** after its own verification — versus a Checkmarx queue that is 0% triaged. * **70.8% of AquilaX's scanner-attributed true positives (3,880 of 5,480) fall outside Checkmarx's scope entirely** — issues Checkmarx structurally could not find. In the reverse direction, a 10-item sample of Checkmarx findings on `project_case_1` were **all false positives (10/10)** — noise Checkmarx reported as valid. *** ### 1. Detection Coverage — Engines in Play Checkmarx reports on two scanner types. AquilaX reports on up to nine, so it surfaces categories Checkmarx never looks at. | Engine | AquilaX | Checkmarx | | ------------------------- | :-----: | :-------: | | SAST (static code) | ✅ | ✅ | | SCA (dependencies) | ✅ | ✅ | | IAC (infra-as-code) | ✅ | ❌ | | Secrets | ✅ | ❌ | | Container | ✅ | ❌ | | PII | ✅ | ❌ | | Compliance | ✅ | ❌ | | Securitron (AI reasoning) | ✅ | ❌ | | AI / Vibe-Code | ✅ | ❌ | **Why it matters:** in these 8 projects, IAC alone accounted for large volumes of confirmed true positives (e.g. **1,894 IAC true positives** in `project_case_3`, **872** in `project_case_4`). None of that class is in Checkmarx's field of view here. *** ### 2. Triage Quality — The Core Difference This is the single most important metric in the dataset. | Status | AquilaX | Checkmarx | | ------------------------------- | :-------------: | :-------: | | Findings pre-classified (TP/FP) | ✅ every finding | ❌ none | | Findings left "Unverified" | minimal | **100%** | Checkmarx status breakdown, **every project**: `Unverified = 100%`, `Conformed = 0`, `Urgent = 0`. **Translation:** Checkmarx hands over a raw, unranked list. A security engineer must manually confirm or dismiss all **4,838** findings. AquilaX does that classification up front, so the team starts from a list that already separates real issues from noise. *** ### 3. Per-Project Numbers #### AquilaX — confirmed findings & precision "Precision" = True Positives ÷ (True Positives + False Positives), using AquilaX's own verification labels. | Project | True Positives | False Positives | Precision | | ---------------- | -------------: | --------------: | --------: | | project\_case\_1 | 386 | 897 | 30.1% | | project\_case\_2 | 173 | 272 | 38.9% | | project\_case\_3 | 2,507 | 245 | **91.1%** | | project\_case\_4 | 1,314 | 841 | 61.0% | | project\_case\_5 | 973 | 1,179 | 45.2% | | project\_case\_6 | 5 | 0 | **100%** | | project\_case\_7 | 5 | 0 | **100%** | | project\_case\_8 | 112 | 71 | 61.2% | | **Total** | **5,475** | **3,505** | **61.0%** | #### Checkmarx — raw findings, none triaged | Project | Raw findings | Verified | Unverified | | ---------------- | -----------: | -------: | ---------------: | | project\_case\_1 | 124 | 0 | 124 (100%) | | project\_case\_2 | 217 | 0 | 217 (100%) | | project\_case\_3 | 240 | 0 | 240 (100%) | | project\_case\_4 | 1,713 | 0 | 1,713 (100%) | | project\_case\_5 | 448 | 0 | 448 (100%) | | project\_case\_6 | 486 | 0 | 486 (100%) | | project\_case\_7 | 320 | 0 | 320 (100%) | | project\_case\_8 | 1,290 | 0 | 1,290 (100%) | | **Total** | **4,838** | **0** | **4,838 (100%)** | **Read the two tables together:** AquilaX delivers 5,475 *confirmed* issues with each finding already labeled. Checkmarx delivers 4,838 issues with *zero* labeled — the triage cost is entirely downstream on the customer. *** ### 4. Severity Distribution (AquilaX confirmed true positives) Where a finding was confirmed, this is how it broke down by severity. Shows AquilaX isn't just producing volume — it's flagging genuine High/Critical exposure.
ProjectCriticalHighMediumLowInfo
project_case_10762048819
project_case_204985347
project_case_3152031,79346927
project_case_4511992925112
project_case_5212861121616
project_case_802645338
*** ### 5. Concrete Cases — Both Directions #### 5a. Cases where AquilaX found the vulnerability and Checkmarx did NOT Checkmarx ran only two engines (SAST + SCA). Every AquilaX-confirmed true positive from any other engine is a finding Checkmarx **structurally could not detect**. That is not a handful of edge cases — it is the majority of confirmed risk: * **3,880 confirmed true positives** sit in engine classes Checkmarx never runs. * That is **70.8% of all AquilaX scanner-attributed true positives** (3,880 of 5,480). * It is **0.80× the size of Checkmarx's entire output** across all 8 projects (3,880 vs 4,838 raw findings) — an invisible risk surface nearly as large as everything Checkmarx reported in total. **Aggregate — confirmed true positives Checkmarx missed, by engine:** | Engine (not run by Checkmarx) | Confirmed TPs missed by Checkmarx | Share of missed | | ----------------------------- | --------------------------------: | --------------: | | IAC (infrastructure-as-code) | 3,550 | 91.5% | | Securitron (AI reasoning) | 205 | 5.3% | | Secrets | 85 | 2.2% | | Compliance | 29 | 0.7% | | AI / Vibe-Code | 8 | 0.2% | | Container | 2 | 0.1% | | PII | 1 | 0.0% | | **Total** | **3,880** | **100%** | **Per-project — confirmed findings Checkmarx couldn't see:** | Project | Missed TPs | Breakdown | | ---------------- | ---------: | --------------------------------------------------------------------------- | | project\_case\_1 | 198 | IAC 156, Securitron 40, Compliance 1, Vibe-Code 1 | | project\_case\_2 | 65 | IAC 39, Securitron 21, Compliance 4, Vibe-Code 1 | | project\_case\_3 | 2,000 | IAC 1,894, Securitron 58, Secrets 43, Compliance 3, PII 1, Vibe-Code 1 | | project\_case\_4 | 929 | IAC 872, Secrets 23, Securitron 20, Compliance 12, Container 1, Vibe-Code 1 | | project\_case\_5 | 566 | IAC 503, Securitron 43, Secrets 17, Container 1, Compliance 1, Vibe-Code 1 | | project\_case\_6 | 5 | Securitron 2, Compliance 2, Vibe-Code 1 | | project\_case\_7 | 5 | Securitron 2, Compliance 2, Vibe-Code 1 | | project\_case\_8 | 112 | IAC 86, Securitron 19, Compliance 4, Secrets 2, Vibe-Code 1 | **Sharpest single case — project\_case\_3:** AquilaX confirmed **2,000 true positives** in classes Checkmarx doesn't scan (1,894 IAC + 58 Securitron + 43 secrets + 3 compliance + 1 PII + 1 AI). Checkmarx's total output on the same codebase was **240 findings** — meaning AquilaX surfaced **8.3× more confirmed risk from categories Checkmarx cannot see** than Checkmarx reported in total. #### 5b. Cases where AquilaX flagged it as a FALSE POSITIVE but Checkmarx reported it as VALID On `project_case_1`, a 10-finding sample was pulled from Checkmarx's 124 reported vulnerabilities and reviewed. **All 10 (100% of the sample) were false positives** — findings Checkmarx reported as valid that are not real vulnerabilities. Checkmarx left every one "Unverified," pushing the disproof work onto the customer. **Sample false-positive rate: 10 / 10 (100%).** By vulnerability class: | Checkmarx "vulnerability" class | Count in sample | Why it's a false positive | | ------------------------------- | --------------: | ---------------------------------------------------------------------------------- | | Broken Hashing (MD5) | 2 | MD5 used for non-security purposes (element IDs, cache keys), not password storage | | Missing HSTS Header | 1 | Raised on error responses, which don't require HSTS | | HttpOnly Cookie Flag Not Set | 1 | Flagged a cookie READ path, not a SET path | | Weak PRNG | 1 | Randomness used for UI uniqueness, not cryptographic security | | Unchecked Loop Condition | 1 | Loop bound is internal completion, not a user-controlled count | | DOM Open Redirect | 1 | Redirect target is a system-generated link, not user input | | Unsafe Reflection | 1 | Call goes through a whitelist-validated framework mechanism | | CSRF | 1 | Raised on test-framework/debug code, not a production path | | Prototype Pollution | 1 | Legacy polyfill parsing its own parameters, not external data | | **Total** | **10** | **0 real vulnerabilities** | **The number that matters:** in this sample, **100% of Checkmarx's "valid" findings were noise**, and every one was shipped unverified. Extrapolated across its 4,838 raw findings, the untriaged false-positive burden is the customer's to absorb. AquilaX's verification layer is what removes this class before it reaches the report. *** ### 6. Bottom Line | Dimension | AquilaX | Checkmarx | | --------------------------------------- | ------------------------------------------------------- | ---------------------------------- | | Detection engines | 9 | 2 | | Risk classes covered | SAST, SCA, IAC, Secrets, Container, PII, Compliance, AI | SAST, SCA only | | Findings pre-triaged | Yes — every finding labeled TP/FP | No — 100% unverified | | Confirmed true positives (8 projects) | 5,475 | not distinguished | | Aggregate precision (post-verification) | 61.0% | n/a (untriaged) | | Human triage burden handed to customer | Low | 4,838 raw findings, 0 sorted | | Context-aware validation | Yes (see §5b) | No — false positives shipped as-is | **The value in one line:** AquilaX covers more of the attack surface, verifies its own findings before you see them, and demonstrably catches real issues Checkmarx misses while filtering out noise Checkmarx ships raw. Checkmarx's output in these 8 tests is narrower in coverage and 100% unverified — the actual work of separating signal from noise is left entirely to your team. *** *All figures taken directly from the scan-export workbook (8 project sheets). True-positive / false-positive labels are as recorded in each platform's own output. Product names of the tested codebases have been anonymized to `project_case_1`–`project_case_8`.* *Note on totals: the status-based confirmed-TP total is 5,475 (from each project's TP/FP/Unverified breakdown); the scanner-attributed TP total is 5,480 (from each project's per-engine breakdown). The 5-count difference is a rounding/attribution artifact in the source workbook, not a computed error. Coverage percentages in §5a use the scanner-attributed basis (3,880 of 5,480 = 70.8%) because the miss is defined per engine.*