Generated by One-V LLM Serve v1.1.2, this is an llms.txt file managed by the plugin and regenerated automatically on content changes.

# Checkmarx

> The world runs on code. We secure it.

## Glossary

- [.NET Scanner](https://checkmarx.com/glossary/net-scanner.md)
- [API](https://checkmarx.com/glossary/api.md)
- [Bamboo Static Code Analysis](https://checkmarx.com/glossary/bamboo-static-code-analysis-2.md)
- [Botnet Detection and Prevention](https://checkmarx.com/glossary/botnet-detection-and-prevention.md)
- [Build Server](https://checkmarx.com/glossary/build-server.md)
- [C# Static Code Analysis](https://checkmarx.com/learn/sast/effective-static-source-code-analysis.md)
- [C++ Static Code Analysis](https://checkmarx.com/glossary/c-static-code-analysis-2.md)
- [Checkmarx Visual Studio Static Code Analysis Plugin](https://checkmarx.com/glossary/checkmarx-visual-studio-static-code-analysis-plugin.md)
- [CI/CD](https://checkmarx.com/learn/devsecops/what-is-cicd-security.md)
- [Cloud Computing](https://checkmarx.com/glossary/cloud-computing.md)
- [Cloud Infrastructure](https://checkmarx.com/glossary/cloud-infrastructure.md)
- [Cloud Native](https://checkmarx.com/glossary/cloud-native.md)
- [Cloud Native Development](https://checkmarx.com/glossary/cloud-native-development.md)
- [CNCF](https://checkmarx.com/glossary/cncf.md)
- [CNI](https://checkmarx.com/glossary/cni.md)
- [Code to Cloud Security: Definition, Benefits and Best Practices](https://checkmarx.com/glossary/what-is-code-to-cloud-security.md)
- [Codebashing](https://checkmarx.com/product/codebashing-secure-code-training.md)
- [Container](https://checkmarx.com/glossary/what-is-container-security.md)
- [Correlation](https://checkmarx.com/glossary/correlation.md)
- [Cross-Site Request Forgery (CSRF) attacks](https://checkmarx.com/learn/appsec/csrf-4-types-of-attacks-with-examples-6-ways-to-prevent-them.md)
- [Cross-Site Scripting (XSS) Attacks: Types, Examples & Prevention](https://checkmarx.com/glossary/cross-site-scripting-xss-attacks.md)
- [CVE](https://checkmarx.com/glossary/cve-2.md)
- [CVS Static Code Analysis](https://checkmarx.com/learn/sast/effective-static-source-code-analysis.md)
- [Cybersecurity](https://checkmarx.com/glossary/cyber-security.md)
- [DevOps](https://checkmarx.com/glossary/devops.md)
- [DevOps Metrics: What They Are, and How to Achieve DevOps Excellence ](https://checkmarx.com/glossary/devops-metrics-what-they-are-and-how-to-achieve-devops-excellence.md)
- [Directory Traversal Vulnerability](https://checkmarx.com/glossary/directory-traversal-vulnerability.md)
- [Docker Swarm](https://checkmarx.com/glossary/docker-swarm.md)
- [Droid Intent Data Flow Analysis for Information Leakage (DidFail)](https://checkmarx.com/glossary/droid-intent-data-flow-analysis-for-information-leakage-didfail.md)
- [Engine](https://checkmarx.com/glossary/engine.md)
- [Enterprise Application Security through Secure Development](https://checkmarx.com/glossary/enterprise-application-security-through-secure-development.md)
- [Ethical Hacking For Company Security](https://checkmarx.com/glossary/ethical-hacking-for-company-security.md)
- [Everything You Need to Know about Enterprise Application Security](https://checkmarx.com/glossary/what-is-enterprise-application-security.md)
- [False Negative](https://checkmarx.com/glossary/false-negative.md)
- [False Positive](https://checkmarx.com/glossary/false-positive.md)
- [Flash Security](https://checkmarx.com/glossary/how-to-maintain-proper-securityagainst-flash-vulnerabilities.md)
- [Function as a service](https://checkmarx.com/glossary/function-as-a-service.md)
- [Gartner Magic Quadrant](https://checkmarx.com/glossary/gartner-magic-quadrant.md)
- [GIT Static Code Analysis](https://checkmarx.com/glossary/git-static-code-analysis.md)
- [How to Avoid Wireless Sniffers](https://checkmarx.com/glossary/how-to-avoid-wireless-sniffers.md)
- [How to Prevent Malicious Code](https://checkmarx.com/glossary/malicious-code.md)
- [Hudson Static Code Analysis](https://checkmarx.com/glossary/hudson-static-code-analysis.md)
- [Infrastructure-as-Code (IaC)](https://checkmarx.com/glossary/infrastructure-as-code-iac.md)
- [Insecure Cryptographic Storage](https://checkmarx.com/glossary/insecure-cryptographic-storage.md)
- [Integrated Development Environment (IDE)](https://checkmarx.com/glossary/integrated-development-environment-ide.md)
- [Internet Security](https://checkmarx.com/glossary/internet-security.md)
- [JavaScript Static Code Analysis](https://checkmarx.com/glossary/javascript-static-code-analysis.md)
- [Jenkins Static Code Analysis](https://checkmarx.com/glossary/jenkins-static-code-analysis.md)
- [Keylogger: The Invisible Threat](https://checkmarx.com/glossary/keylogger-the-invisible-threat.md)
- [KICS](https://checkmarx.com/glossary/kics.md)
- [Kubernetes (K8s)](https://checkmarx.com/glossary/kubernetes-k8s.md)
- [Lambda Function](https://checkmarx.com/glossary/lambda-function.md)
- [LDAP Injection](https://checkmarx.com/glossary/ldap-injection-tutorial.md)
- [Linux Hacking](https://checkmarx.com/glossary/linux-hacking.md)
- [Malware](https://checkmarx.com/glossary/malware.md)
- [Man-In-The-Middle (MiM) Attacks](https://checkmarx.com/glossary/how-to-properly-defend-against-man-in-the-middle-attacks.md)
- [Microservices](https://checkmarx.com/glossary/microservices.md)
- [Mobile Application Security (Android/iOS)](https://checkmarx.com/glossary/mobile-application-security-android-ios.md)
- [Multi-Platform JavaScript Code Analysis](https://checkmarx.com/glossary/javascript-code-analysis.md)
- [Multi-tenant](https://checkmarx.com/glossary/multi-tenant.md)
- [On Premises](https://checkmarx.com/glossary/on-premises.md)
- [PCI DSS Compliance](https://checkmarx.com/glossary/pci-dss-compliance.md)
- [Penetration Testing For Company Security](https://checkmarx.com/glossary/penetration-testing-for-company-security.md)
- [PHP Scanner](https://checkmarx.com/glossary/php-scanner.md)
- [PHP Static Code Analysis](https://checkmarx.com/glossary/php-static-code-analysis.md)
- [Private Cloud](https://checkmarx.com/glossary/private-cloud.md)
- [RabbitMQ](https://checkmarx.com/glossary/rabbitmq.md)
- [RBAC](https://checkmarx.com/glossary/rbac.md)
- [Refactoring](https://checkmarx.com/glossary/refactoring.md)
- [Registry](https://checkmarx.com/glossary/registry.md)
- [Repository](https://checkmarx.com/glossary/repository.md)
- [Rootkit](https://checkmarx.com/glossary/rootkit.md)
- [Ruby On Rails Security](https://checkmarx.com/glossary/ruby-on-rails-preventative-security.md)
- [runC](https://checkmarx.com/glossary/runc.md)
- [SAMATE](https://checkmarx.com/glossary/samate.md)
- [Security Vulnerability](https://checkmarx.com/glossary/security-vulnerability.md)
- [SLSA Explained – Framework, Levels and Implementation Best Practices](https://checkmarx.com/glossary/what-is-the-slsa-framework.md)
- [Source Code Manager (SCM)](https://checkmarx.com/glossary/source-code-manager-scm.md)
- [Spoofing Attack](https://checkmarx.com/glossary/spoofing-attack.md)
- [Static Code Analysis for Java](https://checkmarx.com/glossary/static-code-analysis-for-java.md)
- [Static Code Analysis with Eclipse](https://checkmarx.com/glossary/svn-static-code-analysis.md)
- [SVN Static Code Analysis (Subversion SAST): How Developers Integrate Scans with SVN](https://checkmarx.com/glossary/svn-static-code-analysis.md)
- [Terraform](https://checkmarx.com/glossary/terraform.md)
- [Ticketing System (Issue Tracking) for AppSec & Dev](https://checkmarx.com/glossary/ticketing-system.md)
- [Vulnerability Assessment: Types, Process, Methods, and Metrics](https://checkmarx.com/glossary/vulnerability-assessments.md)
- [Vulnerability Scan](https://checkmarx.com/glossary/vulnerability-scan.md)
- [Vulnerability Scanning: Types, Challenges, and Best Practices](https://checkmarx.com/glossary/why-vulnerability-scanning-is-critical-for-companies.md)
- [What are APIs and Why is API Security Important?](https://checkmarx.com/glossary/api-security.md)
- [What Is a CBOM? Cryptographic Bill of Materials Guide](https://checkmarx.com/glossary/what-is-a-cbom.md)
- [What is Agile Security? Secure a Continuous Delivery Pipeline](https://checkmarx.com/glossary/agile-security.md)
- [What Is AI Code Security Assistance (ACSA)? ](https://checkmarx.com/glossary/what-is-ai-code-security-assistance-acsa.md)
- [What is AI Security, and How Does AI Work to Enhance Application Security?](https://checkmarx.com/glossary/what-ai-security.md)
- [What is an MLBOM?](https://checkmarx.com/glossary/what-is-an-mlbom.md)
- [What Is API Security? Definition, Risks, and Best Practices](https://checkmarx.com/glossary/what-is-api-security.md)
- [What Is Application Lifecycle Management (ALM)?](https://checkmarx.com/glossary/application-lifecycle-management-alm.md)
- [What is Application Security Posture Management (ASPM)?](https://checkmarx.com/learn/aspm/what-is-aspm.md)
- [What is Application Security Vulnerability: Definition](https://checkmarx.com/glossary/application-vulnerability.md)
- [What Is Container Security?](https://checkmarx.com/glossary/what-is-container-security.md): Learn what container security is, why container security has become a paramount concern for organizations, and best practices for securing containers.
- [What is DevOps Security?](https://checkmarx.com/glossary/devops-security.md)
- [What is Docker Architecture and How Does it Work?](https://checkmarx.com/glossary/what-is-docker-architecture-and-how-does-it-work.md)
- [What is Docker Container Architecture and How Does it Work?](https://checkmarx.com/glossary/docker.md)
- [What is HIPAA?](https://checkmarx.com/glossary/what-is-hipaa.md)
- [What is NIST CSF?](https://checkmarx.com/glossary/what-is-nist-csf.md)
- [What is Path Traversal?](https://checkmarx.com/glossary/path-traversal.md)
- [What is Platform Engineering?](https://checkmarx.com/glossary/what-is-platform-engineering.md)
- [What is Product Security?](https://checkmarx.com/glossary/what-is-product-security.md)
- [What Is Public Cloud Security?](https://checkmarx.com/glossary/public-cloud.md)
- [What is Regular Expression Denial of Service Attack (ReDoS)? ](https://checkmarx.com/glossary/redos-attack.md)
- [What is RUST and How Developers Can Benefit from RUST Language Security?](https://checkmarx.com/glossary/what-is-rust-and-how-developers-can-benefit-from-rust-language-security.md)
- [What Is Secrets Detection?](https://checkmarx.com/glossary/what-is-secrets-detection.md)
- [What is the MITRE ATT&CK framework?](https://checkmarx.com/glossary/what-is-the-mitre-attck-framework.md)
- [What Is VAPT (Vulnerability Assessment & Penetration Testing)?](https://checkmarx.com/glossary/vulnerability-assessment-and-penetration-testing.md)
- [What Is YAML? Format, Syntax & Security Best Practices](https://checkmarx.com/glossary/yaml.md)
- [Workload (Computing): Definition, Types & Security](https://checkmarx.com/glossary/workload.md)

## AppSec Knowledge Hub

- [10 Container Security Tools to Know in 2026](https://checkmarx.com/learn/container-security/10-container-security-tools-to-know-in-2026.md)
- [12 Software Composition Analysis Best Practices](https://checkmarx.com/learn/sca/12-software-composition-analysis-best-practices.md)
- [14 Code Security Tools to Know in 2026](https://checkmarx.com/learn/appsec/14-code-security-tools-to-know-in-2026.md)
- [15 CNAPP Best Practices to Implement Today](https://checkmarx.com/learn/code-to-cloud-security/cnapp-best-practices.md)
- [2024 API Risk Management: Secure Your APIs In Cloud-Native World](https://checkmarx.com/learn/api-security/api-risk-management-in-cloud-native.md)
- [2025 Trends on AI Security: How AppSec Must Evolve with the AI-Shifted SDLC](https://checkmarx.com/learn/ai-security/2025-trends-on-ai-security-how-appsec-must-evolve-with-the-ai-shifted-sdlc.md)
- [5 Features the Best CNAPP Vendors Must Offer](https://checkmarx.com/learn/code-to-cloud-security/5-features-the-best-cnapp-vendors-must-offer.md)
- [5 Key Features and Capabilities for SAST Tools](https://checkmarx.com/learn/sast/5-key-features-and-capabilities-for-sast-tools.md)
- [5 Ways AI Is Changing Software Development and 9 AI Dev Functions ](https://checkmarx.com/learn/ai-security/5-ways-ai-is-changing-software-development-and-9-ai-dev-functions.md)
- [6 Pillars of SecDevOps, Why It Matters, and Critical Best Practices](https://checkmarx.com/learn/devsecops/6-pillars-of-secdevops-why-it-matters-and-critical-best-practices.md)
- [6 Types Of SCA Tools To Help Improve Security](https://checkmarx.com/learn/sca/types-of-sca-tools.md)
- [7 DAST Best Practices for Secure Applications](https://checkmarx.com/learn/dast/7-dast-best-practices-for-secure-applications.md)
- [7 IaC Security Tools and Capabilities for Improving Security](https://checkmarx.com/learn/iac-security/7-iac-security-tools-and-capabilities.md)
- [8 Types of Application Security Testing & 6 Critical Best Practices](https://checkmarx.com/learn/appsec/8-types-of-application-security-testing-6-critical-best-practices.md)
- [Addressing Open-Source Vulnerabilities With Software Composition Analysis](https://checkmarx.com/learn/sca/addressing-open-source-security-risks-with-software-composition-analysis.md)
- [Agentic AI in Cybersecurity: Top 3 Use Cases and Key Considerations](https://checkmarx.com/learn/ai-security/agentic-ai-in-cybersecurity-top-3-use-cases-and-key-considerations.md)
- [AI Agent Security: Risks, Controls, and Best Practices](https://checkmarx.com/learn/ai-security/ai-agent-security-risks-controls-and-best-practices.md)
- [AI Code Generation: Capabilities, Best Practices, and Top 9 Tools](https://checkmarx.com/learn/ai-security/ai-code-generation-capabilities-best-practices-and-top-9-tools.md)
- [AI Coding Assistants: The Basics and 15 Tools to Know in 2026](https://checkmarx.com/learn/ai-security/ai-coding-assistants-the-basics-and-15-tools-to-know.md)
- [AI Cybersecurity Solutions for the SDLC: An AppSec Implementation Guide](https://checkmarx.com/learn/ai-security/ai-cybersecurity-solutions-for-the-sdlc-an-appsec-implementation-guide.md)
- [AI Cybersecurity: 6 Solutions Transforming AppSec and the SOC](https://checkmarx.com/learn/ai-security/ai-cybersecurity-6-solutions-transforming-appsec-and-the-soc.md)
- [AI DevOps: How AI Is Changing DevOps & The AI DevSecops Revolution](https://checkmarx.com/learn/ai-security/ai-devops-how-ai-is-changing-devops-the-ai-devsecops-revolution.md)
- [AI Security Posture Management: Key Components and Tips for Success](https://checkmarx.com/learn/aspm/ai-security-posture-management-key-components-and-tips-for-success.md)
- [AI Security Testing: Safeguarding DevSecOps in the Age of GenAI and LLMs](https://checkmarx.com/learn/appsec/the-complete-guide-to-ai-application-security-testing.md)
- [AI Security: Ultimate Guide to Securing the AI Ecosystem](https://checkmarx.com/learn/ai-security-ultimate-guide-to-securing-the-ai-ecosystem.md)
- [Aligning Security and Development Teams Around Common KPIs and Secure Coding Best Practices](https://checkmarx.com/learn/developers/security-development-teams-kpis.md)
- [API Management Best Practice: Automated API Security Testing](https://checkmarx.com/learn/api-security/api-management-best-practice-automated-api-security-testing.md)
- [API Security Best Practices: How to Catch Shadow and Zombie APIs Before Attackers Do](https://checkmarx.com/learn/api-security/api-security-best-practices-how-to-catch-shadow-and-zombie-apis-before-attackers-do.md)
- [ASPM Best Practices for 2024-2025](https://checkmarx.com/learn/appsec/aspm-best-practices-for-2024-2025.md)
- [ASPM vs CSPM – What’s the Difference?](https://checkmarx.com/learn/appsec/aspm-vs-cspm-whats-the-difference.md)
- [Best AI Code Security Solutions: Top 5 Options in 2026](https://checkmarx.com/learn/ai-security/best-ai-code-security-solutions-top-5-options-in-2026.md)
- [Best AI Cybersecurity Providers: Top 6 Options in 2026](https://checkmarx.com/learn/best-ai-cybersecurity-providers-top-6-options-in-2026.md)
- [Best AI Cybersecurity Solutions: Top 9 Options in 2026](https://checkmarx.com/learn/ai-security/best-ai-cybersecurity-solutions-top-9-options-in-2026.md)
- [Best AI Cybersecurity Tools: Top 9 to Watch in 2026](https://checkmarx.com/learn/ai-security/best-ai-cybersecurity-tools-top-9-to-watch-in-2026.md)
- [Best AI Security Testing Platforms: Top 10 in 2026](https://checkmarx.com/learn/ai-security/best-ai-security-testing-platforms-top-10-in-2026.md)
- [Best ASPM Solutions: Top 5 Options in 2026](https://checkmarx.com/learn/aspm/best-aspm-solutions-top-5-options-in-2026.md)
- [Best ASPM Tools: 5 Platforms to Watch in 2026](https://checkmarx.com/learn/aspm/best-aspm-tools-5-platforms-to-watch-in-2026.md)
- [Best GenAI Security Tools: Top 5 Options in 2026](https://checkmarx.com/learn/ai-security/best-genai-security-tools-top-5-options-in-2026.md)
- [Best GenAI Security Tools: Top 6 Options in 2026](https://checkmarx.com/learn/ai-security/best-genai-security-tools-top-6-options-in-2026.md)
- [Breaking Down False Positives in Secrets Scanning](https://checkmarx.com/learn/breaking-down-false-positives-in-secrets-scanning.md)
- [Breaking Down the OWASP Top 10 for LLM Applications](https://checkmarx.com/learn/breaking-down-the-owasp-top-10-for-llm-applications.md)
- [Building an AI-Ready AppSec Team in the Agentic Age: Skills and Training](https://checkmarx.com/learn/building-an-ai-ready-appsec-team-in-the-agentic-age-skills-and-training.md)
- [Building an MCP Security Architecture: 18 Key Security Controls](https://checkmarx.com/learn/ai-security/building-an-mcp-security-architecture-18-key-security-controls.md)
- [Building Trust in AI-Powered Code Generation: A Guide for Secure Adoption](https://checkmarx.com/learn/ai-security/building-trust-in-ai-powered-code-generation-a-guide-for-secure-adoption.md)
- [Checklist: 10 SCA Tools “Must-have” Features](https://checkmarx.com/learn/sca/checklist-10-sca-tools-must-have-features.md)
- [Choosing A Cloud-Native Application Protection Platform: The Top 5 Considerations](https://checkmarx.com/learn/code-to-cloud-security/choosing-a-cloud-native-application-protection-platform.md)
- [Claude AI Security: Risks, Security Gaps, and How to Overcome Them](https://checkmarx.com/learn/ai-security/claude-ai-security-risks-security-gaps-and-how-to-overcome-them.md)
- [Claude Code Security: Top 6 Risks, Controls, and Best Practices](https://checkmarx.com/learn/ai-security/claude-code-security-top-6-risks-controls-and-best-practices.md)
- [Cloud Application Security: An Enterprise’s Guide To Cyber Resilience](https://checkmarx.com/learn/code-to-cloud-security/cloud-application-security-enterprise-guide.md)
- [Cloud Application Security: The Definitive Checklist For AppSec Leaders](https://checkmarx.com/learn/code-to-cloud-security/cloud-application-security-checklist-for-leaders.md)
- [Cloud Native Application Security: Best Practices For Code To Cloud Security](https://checkmarx.com/learn/code-to-cloud-security/cloud-native-application-security-cnas-best-practices.md)
- [Cloud-Native Application Security: Strategic 4C](https://checkmarx.com/learn/code-to-cloud-security/cloud-native-application-security-strategic-4c.md)
- [Container Security in 2026: 7 Key Components, Risks & Defenses](https://checkmarx.com/learn/container-security/container-security-in-2026-7-key-components-risks-defenses.md)
- [Container Vulnerability Management: Cutting Through the Noise](https://checkmarx.com/learn/container-security/container-vulnerability-management-cutting-through-the-noise.md)
- [CSRF: 4 Types of Attacks with Examples and 6 Ways to Prevent Them](https://checkmarx.com/learn/appsec/csrf-4-types-of-attacks-with-examples-6-ways-to-prevent-them.md)
- [Cursor Security: Risks, Practices & 4 Critical Security Controls](https://checkmarx.com/learn/ai-security/cursor-security-risks-practices-4-critical-security-controls.md)
- [CWE](https://checkmarx.com/learn/open-source-security/cwe-2.md)
- [DAST Scans in Your DevSecOps Pipeline: A Practical Guide \[2026\]](https://checkmarx.com/learn/dast/dast-scans-in-your-devsecops-pipeline-a-practical-guide-2026.md)
- [DAST Tools: Key Features and 12 Solutions to Know in 2026](https://checkmarx.com/learn/dast/dast-tools-key-features-and-12-solutions-to-know-in-2026.md)
- [DAST vs. Pentesting: Understanding the Differences](https://checkmarx.com/learn/dast/dast-vs-pentesting-understanding-the-differences.md)
- [Developer-Centric AppSec Tools: What to Look For](https://checkmarx.com/learn/developer-centric-appsec-tools-what-to-look-for.md)
- [DevOps Performance Metrics 2025: The Complete Guide to Successfully Measuring Dev Operations](https://checkmarx.com/learn/appsec/devops-metrics-2025-the-complete-guide-to-successfully-measuring-dev-operations.md)
- [DevOps Security Best Practices: How to Achieve a Secure Developer Environment](https://checkmarx.com/learn/developers/devops-security-best-practices-how-to-achieve-a-secure-developer-environment.md)
- [DevSecOps Best Practices for Application Security Teams](https://checkmarx.com/learn/developers/devsecops-best-practices.md)
- [DevSecOps Best Practices in the Age of AI](https://checkmarx.com/learn/ai-security/devsecops-best-practices-in-the-age-of-ai.md)
- [Docker Container Security Best Practices: Image Scanning Is Non-Negotiable](https://checkmarx.com/learn/container-security/docker-container-security-best-practices-image-scanning-is-non-negotiable.md)
- [Effective SCA Tool: 7 Essential Features for 2024](https://checkmarx.com/learn/sca/effective-sca-solution-features.md)
- [Essential AppSec Features of the Best Application Security Tools](https://checkmarx.com/learn/appsec/essential-appsec-features-of-the-best-application-security-tools.md)
- [Features the Best DevSecOps Tools Will Have in 2025](https://checkmarx.com/learn/appsec/features-the-best-devsecops-tools-will-have-in-2025.md)
- [Finding an Effective Secrets Scanning Tool: Key Considerations](https://checkmarx.com/learn/secrets-detection/finding-an-effective-secrets-scanning-tool-key-considerations.md)
- [From Dockerfile to Deployment: Choosing and Integrating the Right Container Security Solution](https://checkmarx.com/learn/container-security/from-dockerfile-to-deployment-choosing-and-integrating-the-right-container-security-solution.md)
- [From Log4j to XZ Utils: The Escalating Crisis of Open-Source Vulnerabilities](https://checkmarx.com/learn/sca/from-log4j-to-xz-utils-the-escalating-crisis-of-open-source-vulnerabilities.md)
- [Future-Proofing Your Container Security Strategy](https://checkmarx.com/learn/future-proofing-your-container-security-strategy.md)
- [Generative AI in Cybersecurity: Why the IDE Is Now a Critical Attack Surface](https://checkmarx.com/learn/ai-security/generative-ai-in-cybersecurity-why-the-ide-is-now-a-critical-attack-surface.md)
- [How A CNAPP Helps Manage Cloud-Native Application Security Challenges](https://checkmarx.com/learn/code-to-cloud-security/cnapp-managing-cloud-native-application-security.md)
- [How AI Runtime Security Works, Threats Addressed & Key Challenges](https://checkmarx.com/learn/ai-security/how-ai-runtime-security-works-threats-addressed-key-challenges.md)
- [How Supply Chain Attacks Work, Real Examples, Impact & Mitigation](https://checkmarx.com/learn/supply-chain-security/how-supply-chain-attacks-work-real-examples-impact-mitigation.md)
- [How to Become a Product Security Engineer](https://checkmarx.com/learn/developers/how-to-become-a-product-security-engineer.md)
- [How to Choose Code Scanning Tools as Part of Application Security](https://checkmarx.com/learn/sca/how-to-choose-code-scanning-tools-as-part-of-application-security.md)
- [How to Choose SAST Using the Gartner® Magic Quadrant™ for Application Security Testing](https://checkmarx.com/learn/sast/choosing-sast-tool-with-gartner-magic-quadrant.md)
- [How to Detect and Remove Leaked API Keys, Tokens, and Passwords from Code Repositories](https://checkmarx.com/learn/how-to-detect-and-remove-leaked-api-keys-tokens-and-passwords-from-code-repositories.md)
- [How To Get Started With SCA Security Tools](https://checkmarx.com/learn/sca/how-to-get-started-with-sca-security-tool.md)
- [How To Incorporate SAST, DAST, And SCA Into The SDLC](https://checkmarx.com/learn/appsec/incorporate-sast-sca-dast-in-sdlc.md)
- [How to Integrate SCA into DevSecOps Workflows Without Slowing Down Development](https://checkmarx.com/learn/sca/how-to-integrate-sca-into-devsecops-workflows-without-slowing-down-development.md)
- [How to Maintain Developer Productivity and Developer Velocity While Keeping Code Secured](https://checkmarx.com/learn/developers/how-to-maintain-developer-productivity-and-developer-velocity-while-keeping-code-secured.md)
- [How to Prevent Malicious Code through Application Security Testing](https://checkmarx.com/learn/supply-chain-security/malicious-code-guide.md)
- [How to Protect Your Pipeline With DevSecOps](https://checkmarx.com/learn/how-to-protect-your-pipeline-with-devsecops.md)
- [How to Protect Your Pipeline With DevSecOps: What Happens After You Find a Secret?](https://checkmarx.com/learn/secrets-detection/how-to-protect-your-pipeline-with-devsecops-what-happens-after-you-find-a-secret.md)
- [How to Red Team Your LLMs: AppSec Testing Strategies for Prompt Injection and Beyond](https://checkmarx.com/learn/how-to-red-team-your-llms-appsec-testing-strategies-for-prompt-injection-and-beyond.md)
- [How to Secure Application Development without Impacting Developer Productivity](https://checkmarx.com/learn/developers/developer-security-training-appsec.md)
- [How to Secure Your Software Against Malicious Code](https://checkmarx.com/learn/supply-chain-security/how-to-secure-software-against-malicious-code.md)
- [How to Streamline Your DevSecOps Profile by Building DevSecOps Trust](https://checkmarx.com/learn/developers/how-to-streamline-devsecops-with-dev-trust.md)
- [Human-in-the-Loop Cybersecurity: Designing HITL Controls for AI and AppSec](https://checkmarx.com/learn/ai-security/human-in-the-loop-cybersecurity-designing-hitl-controls-for-ai-and-appsec.md)
- [Iac Security Best Practices – how to secure infrastructure as code](https://checkmarx.com/learn/iac-security/iac-security-best-practices-how-to-secure-infrastructure-as-code.md)
- [Implementing Policy Management for Container Security Compliance](https://checkmarx.com/learn/container-security/implementing-policy-management-for-container-security-compliance.md)
- [Inside the Mind of an Attacker: How Malicious Code is Crafted and Deployed](https://checkmarx.com/learn/aspm/inside-the-mind-of-an-attacker-how-malicious-code-is-crafted-and-deployed.md)
- [Integrating DAST and SAST into DevSecOps for Continuous API Security](https://checkmarx.com/learn/integrating-dast-and-sast-into-devsecops-for-continuous-api-security.md)
- [Kubernetes Security: Risks, Technologies, and 9 Best Practices](https://checkmarx.com/learn/container-security/kubernetes-security-risks-technologies-and-9-best-practices.md)
- [Leveraging AI Agents for AppSec: Scaling Security with Intelligent Autonomy](https://checkmarx.com/learn/appsec/leveraging-ai-agents-for-appsec-scaling-security-with-intelligent-autonomy.md)
- [Leveraging AI To Enhance Static Code Analysis (SAST)](https://checkmarx.com/learn/sast/how-ai-enables-more-effective-static-application-security-testing.md)
- [MCP Security: Risks, Real World Incidents and Security Controls](https://checkmarx.com/learn/mcp-security-risks-real-world-incidents-and-security-controls.md)
- [Navigating The Compliance Maze: Harnessing SAST For Regulatory Success](https://checkmarx.com/learn/sast/compliance-harnessing-sast-for-regulatory-success.md)
- [Not All Secrets Are Equal: How to Prioritize Secrets Remediation Based on Risk](https://checkmarx.com/learn/secrets-detection/not-all-secrets-are-equal-how-to-prioritize-secrets-remediation-based-on-risk.md)
- [On-Prem vs. Cloud SAST: What Security Leaders Need to Know Before They Migrate](https://checkmarx.com/learn/sast/on-prem-vs-cloud-sast-what-security-leaders-need-to-know-before-they-migrate.md)
- [OWASP Top 10 Vulnerabilities](https://checkmarx.com/learn/owasp/owasp-top-10.md)
- [Preventing Secret Leakage: Real-World Consequences and Best Practices](https://checkmarx.com/learn/secrets-detection/preventing-secret-leakage-real-world-consequences-and-best-practices.md)
- [Product Security vs Application Security: What’s the Difference?](https://checkmarx.com/learn/appsec/product-security-vs-application-security-whats-the-difference.md)
- [Quick Start Guide to IaC Security](https://checkmarx.com/learn/iac-security/quick-start-guide-to-iac-security.md)
- [Rethinking Secrets Management Tools: Why Vaults Alone Aren’t Enough](https://checkmarx.com/learn/secrets-detection/rethinking-secrets-management-tools-why-vaults-alone-arent-enough.md)
- [Runtime Is the New Battleground: Why Container Security Solutions Must Extend Beyond Scanning](https://checkmarx.com/learn/container-security/runtime-is-the-new-battleground-why-container-security-solutions-must-extend-beyond-scanning.md)
- [Safeguarding Your Software Supply Chain: Strategies For Securing Open-Source Packages](https://checkmarx.com/learn/supply-chain-security/safeguarding-your-software-supply-chain-strategies-for-securing-open-source-packages.md)
- [SAST Best Practices and More – How To Secure Source Code](https://checkmarx.com/learn/sast/sast-best-practices-for-secure-source-code.md)
- [SAST vs DAST: Key Differences, Use Cases and When to Use Each](https://checkmarx.com/learn/sast/sast-vs-dast.md)
- [SBOM: What’s Inside, Formats, Standards, and Best Practices](https://checkmarx.com/learn/software-composition-analysis/what-is-sbom.md)
- [SCA Tools: Key Capabilities & 11 Tools to Watch in 2026](https://checkmarx.com/learn/sca/sca-tools-key-capabilities-11-tools-to-watch-in-2026.md)
- [SCA Vs SAST Vs DAST – Which Is Right For The Organization?](https://checkmarx.com/learn/sca/sca-sast-dast.md)
- [SCA vs. SBOM: How They Compare and What to Do with Each One](https://checkmarx.com/learn/sca/sca-vs-sbom-how-they-compare-and-what-to-do-with-each-one.md)
- [SDLC: The Ultimate Guide To Software Development Lifecycle](https://checkmarx.com/learn/appsec/sdlc-guide.md)
- [Secrets Hygiene as a Culture: Training, Tooling, and Policies](https://checkmarx.com/learn/secrets-detection/secrets-hygiene-as-a-culture-training-tooling-and-policies.md)
- [Secure Code Review: 6 Best Practices Every Developer Should Follow](https://checkmarx.com/learn/developers/secure-code-review-6-best-practices-every-developer-should-follow.md)
- [Secure Coding Practices: 7 Best Practices, OWASP Guidance, and AI-Era Tips ](https://checkmarx.com/learn/ai-security/secure-coding-practices-7-best-practices-owasp-guidance-and-ai-era-tips.md)
- [Secure SDLC (SSDLC): Core Stages, SAST & AI Automation](https://checkmarx.com/learn/devsecops/a-secure-sdlc-with-static-source-code-analysis-tools.md)
- [Securing the Cloud-Native Software Supply Chain with AI-Powered Application Security](https://checkmarx.com/learn/ai-security/securing-the-cloud-native-software-supply-chain-with-ai-powered-application-security.md)
- [Security Where Devs Live: Why IDE Integration Is the Key to SAST and SCA Adoption](https://checkmarx.com/learn/sast/security-where-devs-live-why-ide-integration-is-the-key-to-sast-and-sca-adoption.md)
- [Shadow & Zombie APIs: The Undocumented API Vulnerabilities Threaten Security Posture](https://checkmarx.com/learn/api-security/shadow-zombie-apis-undocumented-api-vulnerabilities-threaten-security-posture.md)
- [Shift-Left Security: Integrate SAST Into DevSecOps Pipeline](https://checkmarx.com/learn/sast/shift-left-security-integrate-sast-into-devsecops-pipeline.md)
- [Simple Strategies To Help Developers Embrace SAST](https://checkmarx.com/learn/sast/simple-strategies-to-help-developers-embrace-sast.md)
- [Snyk Pricing: Free vs. Paid Plans, TCO, and What Users Have to Say](https://checkmarx.com/learn/snyk/snyk-pricing-free-vs-paid-plans-tco-and-what-users-have-to-say.md)
- [Static Analyzers in Modern Dev: Types, Use Cases & Evaluation](https://checkmarx.com/learn/sast/static-analyzers-in-modern-dev-types-use-cases-evaluation.md)
- [Static Application Security Testing (SAST): SAST Security Explained](https://checkmarx.com/learn/sast/ultimate-sast-guide.md)
- [Static Code Analysis: Why It’s Important, and How It Works](https://checkmarx.com/learn/sast/effective-static-source-code-analysis.md)
- [Static Code Analysis: Why Your Company’s Reputation Depends On It](https://checkmarx.com/learn/sast/effective-static-source-code-analysis.md)
- [The 2025 Container Security Platform Landscape: What You Need to Know](https://checkmarx.com/learn/the-2025-container-security-platform-landscape-what-you-need-to-know.md)
- [The Benefits and Limitations of DAST, And Why You Should Care](https://checkmarx.com/learn/dast/the-benefits-and-limitations-of-dast-and-why-you-should-care.md)
- [The Cost of an Exposed Secret: Real Lessons from Real Breaches](https://checkmarx.com/learn/secrets-detection/the-cost-of-an-exposed-secret-real-lessons-from-real-breaches.md)
- [The Future of Secrets Detection: Automating Security Without Slowing Down Development](https://checkmarx.com/learn/secrets-detection/the-future-of-secrets-detection-automating-security-without-slowing-down-development.md)
- [The Guide to a Secure Software Supply Chain with Open-Source Packages](https://checkmarx.com/learn/supply-chain-security/the-guide-to-a-secure-software-supply-chain-with-open-source-packages.md)
- [The Misguided Pursuit of Zero-vulnerability Applications ](https://checkmarx.com/learn/developers/the-misguided-pursuit-of-zero-vulnerability-applications.md)
- [The Missing Signal in AppSec: How Repository Health Can Boost Your Security Posture](https://checkmarx.com/learn/appsec/the-missing-signal-in-appsec-how-repository-health-can-boost-your-security-posture.md)
- [The Role of Humans in AI-Powered AppSec](https://checkmarx.com/learn/appsec/the-role-of-humans-in-ai-powered-appsec.md)
- [The Role of Runtime Monitoring in Container Security](https://checkmarx.com/learn/container-security/the-role-of-runtime-monitoring-in-container-security.md)
- [The Role of SAST in Achieving Compliance](https://checkmarx.com/learn/sast/the-role-of-sast-in-achieving-compliance.md)
- [The Ultimate Guide to Code to Cloud Security](https://checkmarx.com/learn/code-to-cloud-security/the-ultimate-guide-to-code-to-cloud-security.md)
- [The Ultimate Guide to Infrastructure as Code (IAC) Security](https://checkmarx.com/learn/iac-security/the-ultimate-guide-to-infrastructure-as-code-iac-security.md)
- [The Ultimate Guide To Software Supply Chain Security](https://checkmarx.com/learn/supply-chain-security/software-supply-chain-security-guide.md)
- [Top 10 Container Security Best Practices](https://checkmarx.com/learn/container-security/best-practices.md)
- [Top 10 SAST Tools (Open Source + Premium) and How to Choose](https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools.md)
- [Top 10 Vulnerability Management Best Practices and Scaling Operations](https://checkmarx.com/learn/appsec/top-10-vulnerability-management-best-practices-and-scaling-operations.md)
- [Top 11 ASPM Best Practices in 2026](https://checkmarx.com/learn/aspm/top-11-aspm-best-practices-in-2026.md)
- [Top 12 AI Developer Tools in 2026 for Security, Coding, and Quality](https://checkmarx.com/learn/ai-security/top-12-ai-developer-tools-in-2026-for-security-coding-and-quality.md)
- [Top 18 DevSecOps Tools for the AI Era: Securing the SDLC in 2026](https://checkmarx.com/learn/devsecops/top-18-devsecops-tools-for-the-ai-era-securing-the-sdlc-in-2026.md)
- [Top 20 API Security Best Practices in 2026](https://checkmarx.com/learn/api-security/api-security-best-practices.md)
- [Top 21 Kubernetes Security Best Practices in 2026](https://checkmarx.com/learn/container-security/top-21-kubernetes-security-best-practices.md)
- [Top 5 GitHub Copilot Security Risks & 9 Ways to Mitigate Them](https://checkmarx.com/learn/ai-security/top-5-github-copilot-security-risks-9-ways-to-mitigate-them.md)
- [Ultimate guide to API Security 2024](https://checkmarx.com/learn/api-security/ultimate-guide-to-api-security.md)
- [Understanding Software Bill Of Materials (SBOM): A Keystone In Modern Application Security And Compliance](https://checkmarx.com/learn/supply-chain-security/understanding-software-bill-of-materials-sbom.md)
- [Understanding the Differences Between NVD and CVE](https://checkmarx.com/learn/appsec/understanding-the-differences-between-nvd-and-cve.md)
- [Vulnerability Management Tools: Key Features and 12 Solutions to Know ](https://checkmarx.com/learn/appsec/vulnerability-management-tools-key-features-and-12-solutions-to-know.md)
- [Vulnerability Remediation: Process, Best Practices & Tools](https://checkmarx.com/learn/aspm/vulnerability-remediation-process-best-practices-tools.md)
- [What is a Software Supply Chain Security Attack?](https://checkmarx.com/learn/software-supply-chain-management/what-is-a-software-supply-chain-security-attack.md)
- [What Is A Static Application Security Testing (SAST) Tool? What is SAST Scanning?](https://checkmarx.com/learn/sast/static-application-security-testing-sast.md)
- [What is an AIBOM?](https://checkmarx.com/learn/ai-cybersecurity/what-is-an-aibom.md)
- [What is Application Security – How Does It Work & Best Practices](https://checkmarx.com/learn/application-security/application-security-appsec.md)
- [What is CI/CD Security and How Does it Work?](https://checkmarx.com/learn/devsecops/what-is-cicd-security.md)
- [What is Cloud-native Application Security, and How Does It Work?](https://checkmarx.com/learn/cloud-security/what-is-cloud-native-appsec.md)
- [What is CNAPP?](https://checkmarx.com/learn/cloud-security/what-is-cnapp.md)
- [What is Common Vulnerability Scoring System (CVSS)](https://checkmarx.com/learn/open-source-security/what-is-common-vulnerability-scoring-system-cvss.md)
- [What Is DAST? Dynamic Application Security Testing Explained](https://checkmarx.com/learn/dast/what-is-dast.md)
- [What is DevSecOps? – Everything You Need To Know](https://checkmarx.com/learn/devsecops/devsecops.md)
- [What Is Dynamic Application Security Testing (DAST)? 2026 Guide](https://checkmarx.com/learn/dast/what-is-dynamic-application-security-testing-dast-2026-guide.md)
- [What Is IaC Security, and How Does It Work?](https://checkmarx.com/learn/infrastructure-as-a-code/what-is-iac-security.md)
- [What Is IAST and Is It Still Relevant in Modern AppSec?](https://checkmarx.com/learn/iast/what-is-iast-and-is-it-still-relevant-in-modern-appsec.md)
- [What is Reachability Analysis?](https://checkmarx.com/learn/software-composition-analysis/what-is-reachability-analysis.md)
- [What is Software Composition Analysis (SCA) & SCA Security?](https://checkmarx.com/learn/software-composition-analysis/software-composition-analysis-sca.md)
- [What is Software Supply Chain Security and How Does It Work?](https://checkmarx.com/learn/software-supply-chain-management/what-is-software-supply-chain-security.md)
- [What is SQL Injection, and How Can Today’s Organizations Prevent it with Application Security?](https://checkmarx.com/learn/application-security/sql-injection.md)
- [What is the National Vulnerability Database (NVD)?](https://checkmarx.com/learn/open-source-security/what-is-the-national-vulnerability-database-nvd.md)
- [What Is Vibe Coding and How to Get It Right: 9 Critical Practices](https://checkmarx.com/learn/vibe-coding/what-is-vibe-coding-and-how-to-get-it-right-9-critical-practices.md)
- [What Is Vulnerability Management? Lifecycle & Critical Components](https://checkmarx.com/learn/vulnerability-management/what-is-vulnerability-management.md)
- [Why AI-Generated Code May Be Less Secure – and How to Protect It](https://checkmarx.com/learn/ai-security/why-ai-generated-code-may-be-less-secure-and-how-to-protect-it.md)
- [Why Container Security Assessments Are Essential](https://checkmarx.com/learn/container-security/why-container-security-assessments-are-essential.md)
- [Why SAST is the Security Intelligence Layer Every AppSec Platform Needs](https://checkmarx.com/learn/appsec/why-sast-is-the-security-intelligence-layer-every-appsec-platform-needs.md)
- [Why Software Supply Chain Security Is Now a Boardroom Priority](https://checkmarx.com/learn/sast/why-software-supply-chain-security-is-now-a-boardroom-priority.md)
- [Why Today’s Best DAST Tools Are Crucial For Complete Application Security](https://checkmarx.com/learn/dast/why-todays-best-dast-tools-are-crucial-for-complete-application-security.md)
- [Why You Need Secret Scanning, Techniques, and Key Capabilities ](https://checkmarx.com/learn/secrets-detection/why-you-need-secret-scanning-techniques-and-key-capabilities.md)
- [Your Container Security Checklist: The Ultimate Guide to Container Security](https://checkmarx.com/learn/container-security/container-security-checklist-guide.md)

## Press releases

- [75% of Companies Ship Vulnerable Code, Despite a Startling Increase in Threat Velocity; “Agentic AppSec Unleashed ’26” Is Changing That](https://checkmarx.com/press-releases/75-of-companies-ship-vulnerable-code-despite-a-startling-increase-in-threat-velocity-agentic-appsec-unleashed-26-is-changing-that.md)
- [95% of CISOs Pressured to Suppress or Delay Compliance-Related Security Issues, Even as AI-Generated Code Multiplies Their Attack Surface](https://checkmarx.com/press-releases/95-of-cisos-pressured-to-suppress-or-delay-compliance-related-security-issues-even-as-ai-generated-code-multiplies-their-attack-surface.md)
- [AI‑Coding Becomes a Risky Norm as Use of AI-Coding Assistants Takes Off and More Than 80% of Organizations Ship Vulnerable Code](https://checkmarx.com/press-releases/checkmarx-launches-enhanced-mobile-application-security-allowing-developers-deliver-secure-mobile-apps.md)
- [Almost Half of UK Organisations Have Suffered Multiple Data Breaches Due to Vulnerable Applications](https://checkmarx.com/press-releases/almost-half-of-uk-organisations-have-suffered-multiple-data-breaches-due-to-vulnerable-applications.md)
- [Application Security Leader Checkmarx Appoints Yoshishige Nakamichi as Country Manager for Japan](https://checkmarx.com/press-releases/application-security-leader-checkmarx-appoints-yoshishige-nakamichi-as-country-manager-for-japan.md)
- [Application Security Leader Checkmarx Expands U.S. Footprint with New Atlanta Office](https://checkmarx.com/press-releases/application-security-leader-checkmarx-expands-u-s-footprint-new-atlanta-office-2.md)
- [Archipelo and Checkmarx Announce Partnership Connecting AppSec Detection with DevSPM](https://checkmarx.com/press-releases/archipelo-checkmarx-partnership.md)
- [As Malicious Open-Source Packages Proliferate, Checkmarx Announces Supply Chain Threat Intelligence for Faster, Easier Identification of Potential Threats](https://checkmarx.com/press-releases/as-malicious-open-source-packages-proliferate-checkmarx-announces-supply-chain-threat-intelligence-for-faster-easier-identification-of-potential-threats.md)
- [Brinqa Announces Strategic Partnership with Checkmarx Delivering the Industry’s Most Complete Application Security Solution](https://checkmarx.com/press-releases/brinqa-announces-strategic-partnership-with-checkmarx-delivering-the-industrys-most-complete-application-security-solution.md)
- [Checkmarx & Wiz Integrate to Accelerate Correlation, Prioritization and Remediation Cloud Security  Risks](https://checkmarx.com/press-releases/industry-first-checkmarx-and-wiz-integration-accelerates-ability-of-enterprise-security-teams-to-swiftly-correlate-prioritize-and-remediate-significant-risks-to-cloud-security.md)
- [Checkmarx Accelerates Growth of Cloud-native Application Security Platform as Enterprises Seek to Secure Applications from Code to Cloud](https://checkmarx.com/press-releases/checkmarx-accelerates-growth-of-cloud-native-application-security-platform-as-enterprises-seek-to-secure-applications-from-code-to-cloud.md)
- [Checkmarx Accelerates Vulnerability Remediation for Open-Source Code with New Software Composition Analysis Solution](https://checkmarx.com/press-releases/checkmarx-accelerates-vulnerability-remediation-for-open-source-code-with-new-software-composition-analysis-solution.md)
- [Checkmarx Achieves 50% YoY Revenue Growth in 2019](https://checkmarx.com/press-releases/checkmarx-achieves-50-yoy-revenue-growth-in-2019.md)
- [Checkmarx Achieves AWS Security Competency Status](https://checkmarx.com/press-releases/checkmarx-achieves-aws-security-competency-status.md)
- [Checkmarx Acquires Codebashing to Redefine Secure Coding Education – PR](https://checkmarx.com/press-releases/checkmarx-acquires-codebashing-redefine-secure-coding-education-4.md)
- [Checkmarx Acquires Custodela to Bring Enhanced Automation to DevSecOps Programs](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs.md)
- [Checkmarx Acquires Software Supply Chain Security Provider, Dustico](https://checkmarx.com/press-releases/checkmarx-acquires-software-supply-chain-security-provider-dustico.md)
- [Checkmarx Acquires Tromzo to Launch New Era of Agentic Application Security](https://checkmarx.com/press-releases/checkmarx-acquires-tromzo-to-launch-new-era-of-application-security.md)
- [Checkmarx and Carahsoft Partner to Deliver Prevention-First Approach to Application Security for Government Agencies](https://checkmarx.com/press-releases/checkmarx-and-carahsoft-partner-to-deliver-prevention-first-approach-to-application-security-for-government-agencies.md)
- [Checkmarx and DXC Technology Team Up to Deliver Scalable, Holistic Application Security Worldwide](https://checkmarx.com/press-releases/checkmarx-and-dxc-technology-team-up-to-deliver-scalable-holistic-application-security-worldwide.md)
- [Checkmarx and Fishtech Group Partner to Help Businesses Fight Software Exposure Risk](https://checkmarx.com/press-releases/checkmarx-fishtech-group.md)
- [Checkmarx and OWASP Launch First-ever Global Codebashing Learning Initiative](https://checkmarx.com/press-releases/checkmarx-and-owasp-launch-first-ever-global-codebashing-learning-initiative.md)
- [Checkmarx and Security Compass Announce Partnership to Integrate Checkmarx One with SD Elements](https://checkmarx.com/press-releases/checkmarx-and-security-compass-announce-partnership-to-integrate-checkmarx-one-with-sd-elements.md)
- [Checkmarx Announces Enhancements to Software Exposure Platform – Press Release](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-3-2.md)
- [Checkmarx Announces Exclusive Partnership with TOYO Corporation – PR](https://checkmarx.com/press-releases/checkmarx-announces-exclusive-partnership-toyo-corporation-integrating-checkmarx-cxsast-static-analysis-tools-toyos-existing-suite-advanced-measurement-offering.md)
- [Checkmarx Announces Federal Information Processing Standards (FIPS) Support](https://checkmarx.com/press-releases/checkmarx-announces-federal-information-processing-standards-fips-support-2.md)
- [Checkmarx Announces First GenAI-powered AppSec Platform, Empowering Developers and AppSec Teams to Find and Fix Vulnerabilities Faster](https://checkmarx.com/press-releases/ai-query-builder-for-sast.md)
- [Checkmarx Announces GitLab Integration to Streamline Users’ DevSecOps Workflows](https://checkmarx.com/press-releases/checkmarx-announces-gitlab-integration-to-streamline-users-devsecops-workflows.md)
- [Checkmarx Announces Groundbreaking CheckAI Plugin for ChatGPT to Detect and Prevent Attacks Against ChatGPT-Generated Code](https://checkmarx.com/press-releases/checkmarx-announces-checkai-with-groundbreaking-plugin-to-detect-and-prevent-attacks-against-chatgpt-generated-code.md)
- [Checkmarx Announces New GitHub Action to Empower Developers to Code More Securely](https://checkmarx.com/press-releases/checkmarx-announces-new-github-action-to-empower-developers-to-code-more-securely.md)
- [Checkmarx Announces New Integrations with ServiceNow](https://checkmarx.com/press-releases/checkmarx-announces-new-integrations-with-servicenow.md)
- [Checkmarx Announces Open Beta for Scala Programming Language Vulnerability Detection – PR](https://checkmarx.com/press-releases/checkmarx-announces-open-beta-scala-programming-language-vulnerability-detection-3.md)
- [Checkmarx Announces Partnership with Leading IT Provider TeraMach, a Pivot Company](https://checkmarx.com/press-releases/checkmarx-announces-partnership-leading-provider-teramach-pivot-company.md)
- [Checkmarx Announces Partnership with Wiz: Advancing AppSec through Code-to-Cloud Integration](https://checkmarx.com/press-releases/checkmarx-announces-partnership-with-wiz-advancing-appsec-through-code-to-cloud-integration.md)
- [Checkmarx Announces Strong Momentum in 2017, Fueled by Revenue and Customer Growth](https://checkmarx.com/press-releases/checkmarx-announces-strong-momentum-2017-fueled-revenue-customer-growth.md)
- [Checkmarx Announces Technology Partner Program to Enable the Industry’s Most Extensible, Code-to-Cloud Enterprise AppSec Ecosystem](https://checkmarx.com/press-releases/checkmarx-announces-technology-partner-program-to-enable-the-industrys-most-extensible-code-to-cloud-enterprise-appsec-ecosystem.md)
- [Checkmarx Announces Vulnerability Detection and Remediation Support for Swift Language](https://checkmarx.com/press-releases/checkmarx-announces-support-swift-programming-language-vulnerability-detection-remediation-2.md)
- [Checkmarx Applauded by Frost & Sullivan for Integrating Security into SDLCs via DevOps Security to Maintain Security While Pursuing Innovation](https://checkmarx.com/press-releases/checkmarx-applauded-by-frost-sullivan-for-integrating-security-into-sdlcs-via-devops-security-to-maintain-security-while-pursuing-innovation.md)
- [Checkmarx Appoints Kevin Hayes as Director of Federal Sales to Accelerate U.S. Federal Market Growth](https://checkmarx.com/press-releases/checkmarx-appoints-kevin-hayes-as-director-of-federal-sales-to-accelerate-u-s-federal-market-growth.md)
- [Checkmarx Appoints New Vice President of Worldwide Channels and Alliances](https://checkmarx.com/press-releases/checkmarx-appoints-new-vice-president-of-worldwide-channels-and-alliances.md)
- [Checkmarx Appoints Nitin Kumar Dang as Vice President for APAC, Middle East](https://checkmarx.com/press-releases/checkmarx-appoints-nitin-kumar-dang-as-vice-president-for-apac-middle-east.md)
- [Checkmarx Appoints Razi Sharir as Chief Product Officer](https://checkmarx.com/press-releases/checkmarx-appoints-razi-sharir-as-chief-product-officer.md)
- [Checkmarx Appoints Roman Tuma as Chief Revenue Officer](https://checkmarx.com/press-releases/checkmarx-appoints-ruman-tuma-as-chief-revenue-officer.md)
- [Checkmarx Appoints Ron Kormanek to Executive Management Team](https://checkmarx.com/press-releases/checkmarx-appoints-ron-kormanek-to-executive-management-team.md)
- [Checkmarx Appoints Sandeep Johri as CEO; Co-founder and CEO Emmanuel Benzaquen Continues to Serve on the Board of Directors](https://checkmarx.com/press-releases/checkmarx-appoints-sandeep-johri-as-ceo-co-founder-and-ceo-emmanuel-benzaquen-continues-to-serve-on-the-board-of-directors.md)
- [Checkmarx Asks Developers: “Are You #SecureDevAware?” to Mark National Cyber Security Awareness Month – PR](https://checkmarx.com/press-releases/checkmarx-asks-developers-securedevaware-mark-national-cyber-security-awareness-month.md)
- [Checkmarx Awarded NASA SEWP V Contract to Simplify Federal Procurement Processes](https://checkmarx.com/press-releases/checkmarx-awarded-nasa-sewp-v-contract-simplify-federal-procurement-processes-2.md)
- [Checkmarx CISO Study Finds 96% of CISOs Say Their Business Prospects Consider Their Organizations’ AppSec Maturity When Making Deal Decisions](https://checkmarx.com/press-releases/checkmarx-ciso-study-finds-96-of-cisos-say-their-business-prospects-consider-their-organizations-appsec-maturity-when-making-deal-decisions.md)
- [Checkmarx Closes 1H 2018 with Record Customer and Revenue Growth](https://checkmarx.com/press-releases/checkmarx-closes-1h-2018-with-record-customer-and-revenue-growth.md)
- [Checkmarx Continues Momentum with Record Growth in 2018](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-4.md)
- [Checkmarx Delivers Complete AI Asset Visibility and Governance for the Software Supply Chain, Closing the Shadow AI Gap](https://checkmarx.com/press-releases/checkmarx-delivers-complete-ai-asset-visibility-governance-software-supply-chain-closing-shadow-ai-gap.md)
- [Checkmarx Delivers Containerized AppSec Solution to DoD’s Platform One to Secure DevOps Initiatives](https://checkmarx.com/press-releases/checkmarx-delivers-containerized-appsec-solution-to-dods-platform-one-to-secure-devops-initiatives.md)
- [Checkmarx Dominates Growth and Innovation Indices in Frost Radar™: Application Security Posture Management, 2024](https://checkmarx.com/press-releases/checkmarx-dominates-growth-and-innovation-indices-in-frost-radar-application-security-posture-management-2024.md)
- [Checkmarx Earns Spot on Constellation ShortListTM for Application Security Testing (AST)](https://checkmarx.com/press-releases/checkmarx-earns-spot-on-constellation-shortlisttm-for-application-security-testing-ast.md)
- [Checkmarx Educates on Software Exposure at Key Industry Events in October](https://checkmarx.com/press-releases/checkmarx-educates-software-exposure.md)
- [Checkmarx EMEA Channel Program Accelerates with New U.K. and Ireland Partnerships](https://checkmarx.com/press-releases/checkmarx-emea-channel-program-accelerates-with-new-u-k-and-ireland-partnerships.md)
- [Checkmarx Enables Real-Time Code Security with Launch of Developer Assist Agent for AI-Native IDEs](https://checkmarx.com/press-releases/checkmarx-enables-real-time-code-security-with-launch-of-developer-assist-agent-for-ai-native-ides.md)
- [Checkmarx Enhances IDE-Native Agentic Application Security in Kiro](https://checkmarx.com/press-releases/checkmarx-enhances-ide-native-agentic-application-security-in-kiro.md)
- [Checkmarx Expands Auto-Remediation with New Mobb Integration for SAST](https://checkmarx.com/press-releases/checkmarx-expands-auto-remediation-with-new-mobb-integration-for-sast.md)
- [Checkmarx Expands CxCodebashing Developer Application Security Training With New Interactive Mobile Security Courses](https://checkmarx.com/press-releases/checkmarx-expands-codebashing-developer-application-security-training-new-interactive-mobile-security-courses.md)
- [Checkmarx Expands its U.S. Federal Government Cloud Service Offerings as it Initiates the Process for a FedRAMP Authorization](https://checkmarx.com/press-releases/checkmarx-expands-its-u-s-federal-government-cloud-service-offerings-as-it-initiates-the-process-for-a-fedramp-authorization.md)
- [Checkmarx Expands Software Supply Chain Security with Advanced Secrets Detection and Repository Health](https://checkmarx.com/press-releases/checkmarx-expands-software-supply-chain-security-with-advanced-secrets-detection-and-repository-health.md)
- [Checkmarx Featured on CRN’s 2022 Security 100 List](https://checkmarx.com/press-releases/checkmarx-featured-on-crns-2022-security-100-list.md)
- [Checkmarx Forges Secure Path to Accelerate AI Adoption in Application Security and Developer Workflows](https://checkmarx.com/press-releases/checkmarx-forges-secure-path-to-accelerate-ai-adoption-in-application-security-and-developer-workflows.md)
- [Checkmarx Fortifies Executive Team: Appoints Amit Daniel as CMO](https://checkmarx.com/press-releases/checkmarx-fortifies-executive-team-with-appointment-of-amit-daniel-as-global-chief-marketing-officer.md)
- [Checkmarx Fusion: Hybrid Scanning Delivers the Most Complete Vulnerability Detection Available](https://checkmarx.com/press-releases/checkmarx-fusion-delivers-most-complete-vulnerability-detection-available.md)
- [Checkmarx Integrates Sysdig Runtime Insights for Faster Prioritization of Cloud-Native Application Vulnerabilities](https://checkmarx.com/press-releases/checkmarx-integrates-sysdig-runtime-insights-for-faster-prioritization-of-cloud-native-application-vulnerabilities.md)
- [Checkmarx Introduces Advanced Container Security, Delivering Up to 40% Vulnerability Reduction and Significant Efficiency Gains](https://checkmarx.com/press-releases/checkmarx-introduces-advanced-container-security-delivering-up-to-40-vulnerability-reduction-and-significant-efficiency-gains.md)
- [Checkmarx Introduces Codebashing 2.0, the First AppSec Solution to Boost Developer Experience and Adoption with New Gamified User Interface](https://checkmarx.com/press-releases/checkmarx-introduces-codebashing-2-0-the-first-appsec-solution-to-boost-developer-experience-and-adoption-with-new-gamified-user-interface.md)
- [Checkmarx Introduces the Next Generation of Interactive Application Security Testing (IAST)](https://checkmarx.com/press-releases/checkmarx-introduces-next-generation-interactive-application-security-testing-iast.md)
- [Checkmarx is a 2023 Gartner® Peer Insights™ Customers’ Choice for Application Security Testing for Fifth Consecutive Year](https://checkmarx.com/press-releases/checkmarx-is-a-2023-gartner-peer-insights-customers-choice-for-application-security-testing-for-fifth-consecutive-year.md)
- [Checkmarx is a Customers’ Choice in Gartner® Peer Insights™ for Application Security Testing for Sixth Consecutive Year](https://checkmarx.com/press-releases/checkmarx-is-a-customers-choice-in-gartner-peer-insights-for-application-security-testing-for-sixth-consecutive-year.md)
- [Checkmarx is Named a Leader in the Gartner 2018 Magic Quadrant for Application Security Testing](https://checkmarx.com/press-releases/checkmarx-is-named-a-leader-in-the-gartner-2018-magic-quadrant-for-application-security-testing.md)
- [Checkmarx is the Number One Fastest Growing Cybersecurity Company in Israel Five Years in a Row](https://checkmarx.com/press-releases/checkmarx-number-one-fastest-growing-cybersecurity-company-israel-five-years-row.md)
- [Checkmarx Joins Anthropic’s Project Glasswing](https://checkmarx.com/press-releases/checkmarx-joins-anthropics-project-glasswing.md)
- [Checkmarx Joins Forces with ZAP to Supercharge Dynamic Application Security Testing (DAST) for the Enterprise and Enhance Community Growth](https://checkmarx.com/press-releases/checkmarx-joins-forces-with-zap-to-supercharge-dynamic-application-security-testing-dast-for-the-enterprise-and-enhance-community-growth.md)
- [Checkmarx Joins Israeli Cyber Companies Consortium (IC3) Led by IAI to Provide Industry-leading AppSec Capabilities to National Cyber Defense Organizations](https://checkmarx.com/press-releases/checkmarx-joins-israeli-cyber-companies-consortium-ic3-led-by-iai-to-provide-industry-leading-appsec-capabilities-to-national-cyber-defense-organizations.md)
- [Checkmarx KICS Integrated into GitLab 14.5 as Default IaC Code Scanner](https://checkmarx.com/press-releases/checkmarx-kics-integrated-into-gitlab-14-5-as-default-iac-code-scanner.md)
- [Checkmarx Launches Checkmarx One™ Application Security Platform in Singapore](https://checkmarx.com/press-releases/checkmarx-launches-checkmarx-one-ast-in-singapore.md)
- [Checkmarx Launches Global Managed Security Service Provider (MSSP) Program](https://checkmarx.com/press-releases/checkmarx-launches-global-managed-security-service-provider-mssp-program.md)
- [Checkmarx Launches Industry’s Most Comprehensive Supply Chain Security Solution to Help Organizations Block Previously Undetectable Malicious Open-Source Packages](https://checkmarx.com/press-releases/checkmarx-launches-industrys-most-comprehensive-supply-chain-security-solution-to-help-organizations-block-previously-undetectable-malicious-open-source-packages.md)
- [Checkmarx Launches Infrastructure as Code Scanning Solution to Secure Cloud-Native Applications](https://checkmarx.com/press-releases/checkmarx-launches-infrastructure-as-code-scanning-solution-to-secure-cloud-native-applications.md)
- [Checkmarx Launches New Global Partner Program](https://checkmarx.com/press-releases/checkmarx-launches-new-global-partner-program.md)
- [Checkmarx Launches Next-Gen SAST Engine for Ultra-Fast Scanning](https://checkmarx.com/press-releases/checkmarx-introduces-next-generation-enterprise-sast-engine-offering-both-maximum-risk-reduction-and-ultra-fast-scanning.md)
- [Checkmarx Makes SCA Market Waves with Enhanced Open-Source Security Offering](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-3-3-3.md)
- [Checkmarx Named ‘Black Unicorn’ Award Winner for Establishing Market Leadership and Vision in Software Security – PR](https://checkmarx.com/press-releases/checkmarx-named-black-unicorn-award-winner.md)
- [Checkmarx Named a 2020 Gartner Magic Quadrant Leader for Application Security Testing – PR](https://checkmarx.com/press-releases/checkmarx-named-a-2020-gartner-magic-quadrant-leader-for-application-security-testing.md)
- [Checkmarx Named a 2020 Gartner Peer Insights Customers’ Choice for Application Security Testing – PR](https://checkmarx.com/press-releases/checkmarx-named-a-2020-gartner-peer-insights-customers-choice-for-application-security-testing.md)
- [Checkmarx Named a 2021 Gartner Magic Quadrant Leader for Application Security Testing for Fourth Consecutive Year – PR](https://checkmarx.com/press-releases/checkmarx-named-2021-gartner-magic-quadrant-leader-for-ast-for-fourth-consecutive-year.md)
- [Checkmarx Named a 2021 Gartner Peer Insights Customers’ Choice for Application Security Testing](https://checkmarx.com/press-releases/checkmarx-named-a-2021-gartner-peer-insights-customers-choice-for-application-security-testing.md)
- [Checkmarx Named a June 2019 Gartner Peer Insights Customers’ Choice for Application Security Testing – PR](https://checkmarx.com/press-releases/checkmarx-named-a-june-2019-gartner-peer-insights-customers-choice-for-application-security-testing.md)
- [Checkmarx Named a Leader for Sixth Consecutive Year in the 2023 Gartner® Magic Quadrant™ for Application Security](https://checkmarx.com/press-releases/checkmarx-named-a-leader-for-sixth-consecutive-year-in-the-2023-gartner-magic-quadrant-for-application-security.md)
- [Checkmarx Named a Leader for the Fifth Straight Time in the 2022 Gartner® Magic Quadrant™ for Application Security Testing](https://checkmarx.com/press-releases/checkmarx-named-a-leader-for-the-fifth-straight-time-in-the-2022-gartner-magic-quadrant-for-application-security-testing.md)
- [Checkmarx Named a Leader in Gartner Magic Quadrant for Application Security Testing – PR](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-3-3-2.md)
- [Checkmarx Named a Leader in Static Application Security Testing](https://checkmarx.com/press-releases/checkmarx-named-a-leader-in-static-application-security-testing.md)
- [Checkmarx Named a Leader in Static Application Security Testing by Independent Research Firm](https://checkmarx.com/press-releases/checkmarx-named-a-leader-in-static-application-security-testing-by-independent-research-firm.md)
- [Checkmarx Named a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing for Seventh Time](https://checkmarx.com/press-releases/checkmarx-named-a-leader-in-the-2025-gartner-magic-quadrant.md)
- [Checkmarx Named a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security](https://checkmarx.com/press-releases/checkmarx-named-leader-2026-gartner-mq-sscs.md)
- [Checkmarx Named a Strong Performer in Software Composition Analysis by Leading Analyst Firm](https://checkmarx.com/press-releases/checkmarx-named-a-strong-performer-in-software-composition-analysis-by-leading-analyst-firm.md)
- [Checkmarx Named Leader in 2024 GigaOm Supply Chain Security Report](https://checkmarx.com/press-releases/checkmarx-positioned-as-a-leader-and-fast-mover-in-inaugural-2024-gigaom-radar-report-for-software-supply-chain-security.md)
- [Checkmarx Named Winner of the Esteemed Global InfoSec Awards](https://checkmarx.com/press-releases/checkmarx-named-winner-esteemed-global-infosec-awards.md)
- [Checkmarx Names Bernd Leger Chief Marketing Officer](https://checkmarx.com/press-releases/checkmarx-names-bernd-leger-chief-marketing-officer.md)
- [Checkmarx One Achieves ACN Level 2 Certification, Setting a New Standard for Software Security and Digital Sovereignty in Italy](https://checkmarx.com/press-releases/checkmarx-one-achieves-acn-level-2-certification-setting-a-new-standard-for-software-security-and-digital-sovereignty-in-italy.md)
- [Checkmarx One Achieves Industry’s Highest Scanning Fidelity, Outperforming Both Legacy Tools and AI Models](https://checkmarx.com/press-releases/checkmarx-one-achieves-industrys-highest-scanning-fidelity-outperforming-both-legacy-tools-and-ai-models.md)
- [Checkmarx One Achieves Unprecedented Enterprise Adoption and Over $150M ARR in Three Years Under New Leadership](https://checkmarx.com/press-releases/checkmarx-one-achieves-unprecedented-enterprise-adoption.md)
- [Checkmarx One Breaks the AppSec Barrier by Delivering ASPM Directly to Developers](https://checkmarx.com/press-releases/aspm-directly-to-developers.md)
- [Checkmarx One for Government Application Security Platform Achieves FedRAMP Ready Status at the High Impact Level](https://checkmarx.com/press-releases/checkmarx-one-for-government-application-security-platform-achieves-fedramp-ready-status-at-the-high-impact-level.md)
- [Checkmarx One for Government Application Security Platform Achieves FedRAMP® Moderate Certification](https://checkmarx.com/press-releases/checkmarx-one-for-government-application-security-platform-achieves-fedramp-moderate-certification.md)
- [Checkmarx One Named Best DevSecOps Solution in the 2024 DevOps Dozen Awards](https://checkmarx.com/press-releases/checkmarx-one-named-best-devsecops-solution-in-the-2024-devops-dozen-awards.md)
- [Checkmarx One Total Economic Impact Study Finds Return on Investment of 177% in Fewer Than Six Months and Gain of $7.13M in Benefits Over Three Years](https://checkmarx.com/press-releases/checkmarx-one-total-economic-impact-study-finds-return-on-investment-of-177-in-fewer-than-six-months-and-gain-of-7-13m-in-benefits-over-three-years.md)
- [Checkmarx Positioned as a Leader in the IDC MarketScape for Application Security Posture Management 2025](https://checkmarx.com/press-releases/checkmarx-positioned-as-a-leader-in-the-idc-marketscape-for-application-security-posture-management-2025.md)
- [Checkmarx Provides Codebashing Training and Cybersecurity Curriculum Advisor to the Vilnius Coding School to Train the Next Generation of Developers on Advanced Application Security](https://checkmarx.com/press-releases/checkmarx-provides-codebashing-training-and-cybersecurity-curriculum-advisor-to-the-vilnius-coding-school-to-train-the-next-generation-of-developers-on-advanced-application-security.md)
- [Checkmarx Recognized as a Top Security Organization in 2022 Stratus Awards](https://checkmarx.com/press-releases/checkmarx-recognized-as-a-top-security-organization-in-2022-stratus-awards.md)
- [Checkmarx Recognized as AWS Provider of Application Security Testing Solutions for Public Sector](https://checkmarx.com/press-releases/checkmarx-recognized-as-aws-provider-of-application-security-testing-solutions-for-public-sector.md)
- [Checkmarx Recognized By Deloitte Israel Technology Fast 50 2016 As Israel’s Fastest Growing Cybersecurity Company – PR](https://checkmarx.com/press-releases/checkmarx-recognized-deloitte-israel-technology-fast-50-2016-israels-fastest-growing-cybersecurity-company-3.md)
- [Checkmarx Redefines Application Security for the Age of Agentic Development](https://checkmarx.com/checkmarx-redefines-application-security-for-the-age-of-agentic-development.md)
- [Checkmarx Releases Version 3.0 of AI-Powered Checkmarx One™ Enterprise AppSec Platform](https://checkmarx.com/press-releases/checkmarx-releases-version-3-0-of-ai-powered-checkmarx-one-enterprise-appsec-platform.md)
- [Checkmarx SAST Awarded SLSA for Canadian Federal Government](https://checkmarx.com/press-releases/checkmarx-awarded-software-licensing-supply-arrangement-slsa-bring-static-application-security-testing-canadian-federal-government-2.md)
- [Checkmarx SCA Now Available as Native Integration within JetBrains IntelliJ IDEA Ultimate](https://checkmarx.com/press-releases/checkmarx-sca-now-available-as-native-integration-within-jetbrains-intellij-idea-ultimate.md)
- [Checkmarx Scores Highest for DevOps/DevSecOps Use Case in 2020 Gartner Critical Capabilities for Application Security Testing Report](https://checkmarx.com/press-releases/checkmarx-scores-highest-for-devops-devsecops-use-case-in-2020-gartner-critical-capabilities-for-application-security-testing-report.md)
- [Checkmarx Secures Three Global Infosec Awards Recognizing Product Innovation and Market Leadership](https://checkmarx.com/press-releases/checkmarx-secures-three-global-infosec-awards-recognizing-product-innovation-and-market-leadership.md)
- [Checkmarx Simplifies Automation of Application Security Testing for Modern Development and DevOps Environments](https://checkmarx.com/press-releases/checkmarx-simplifies-automation-of-application-security-testing-for-modern-development-and-devops-environments.md)
- [Checkmarx Streamlines AppSec Remediation in ServiceNow Dash](https://checkmarx.com/press-releases/checkmarx-streamlines-prioritization-and-remediation-of-application-vulnerabilities-within-the-servicenow-vulnerability-dashboard.md)
- [Checkmarx Survey Finds Only Eight Percent of Organizations Have Effective DevSecOps Practices](https://checkmarx.com/press-releases/checkmarx-to-present-at-bsideslv-and-def-con-2018-exhibiting-at-black-hat-2018-at-booth-1202-2.md)
- [Checkmarx To Host 2021 Global Customer Conference “Checkmate”](https://checkmarx.com/press-releases/checkmarx-to-host-2021-global-customer-conference-checkmate.md)
- [Checkmarx to Present at BSidesLV and DEF CON 2018; Exhibiting at Black Hat 2018 at Booth #1202](https://checkmarx.com/press-releases/checkmarx-to-present-at-bsideslv-and-def-con-2018-exhibiting-at-black-hat-2018-at-booth-1202.md)
- [Checkmarx to Secure Software Development at DOE National Laboratory – PR](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-3.md)
- [Checkmarx to Unveil Autonomous AppSec in Action During Highly Anticipated Agentic AI Summit](https://checkmarx.com/press-releases/checkmarx-agentic-ai-summit-autonomous-appsec.md)
- [Checkmarx Unveils Context-aware Checkmarx Fusion with Industry’s First Holistic View and Cross-component Prioritization of Application Vulnerabilities](https://checkmarx.com/press-releases/checkmarx-unveils-context-aware-checkmarx-fusion-with-industrys-first-holistic-view-and-cross-component-prioritization-of-application-vulnerabilities.md)
- [Checkmarx Unveils Fusion 2.0 with First-to-Market, Consolidated Application Risk Management at Gartner® Security & Risk Management Summit 2023](https://checkmarx.com/press-releases/checkmarx-unveils-fusion-2-0-with-first-to-market-consolidated-application-risk-management-at-gartner-security-risk-management-summit-2023.md)
- [Checkmarx Unveils Self-Healing Application Security in Assist Agent Family](https://checkmarx.com/press-releases/checkmarx-unveils-self-healing-application-security-in-assist-agent-family.md)
- [Checkmarx Unveils the Integrated Cloud Platform for Application Security](https://checkmarx.com/press-releases/checkmarx-unveils-the-integrated-cloud-platform-for-application-security.md)
- [Checkmarx Welcomes Technology Leader Inbal Shani to Its Board of Directors](https://checkmarx.com/press-releases/checkmarx-welcomes-technology-leader-inbal-shani-to-its-board-of-directors.md)
- [Checkmarx Wins 2023 DEVIES Award in DevSecOps Category](https://checkmarx.com/press-releases/checkmarx-wins-2023-devies-award-in-devsecops-category.md)
- [Checkmarx Wins Best Application Security Solution in the 2022 Tech Ascension Awards](https://checkmarx.com/press-releases/checkmarx-wins-best-application-security-solution-in-the-2022-tech-ascension-awards.md)
- [Checkmarx Zero Launches Collaborative AppSec Threat Research Hub](https://checkmarx.com/press-releases/checkmarx-launches-collaborative-checkmarx-zero-research-hub-to-share-application-security-and-software-supply-chain-threat-intelligence.md)
- [Checkmarx’ Ana Lucia Amaral Honored as a CRN 2022 Woman of the Channel](https://checkmarx.com/press-releases/checkmarx-ana-lucia-amaral-honored-as-a-crn-2022-woman-of-the-channel.md)
- [Checkmarx’ Global Pulse on AppSec Study Finds 88% of AppSec Managers Surveyed Experienced at least One Breach in Prior Year as a Direct Result of Vulnerable Application Code](https://checkmarx.com/press-releases/checkmarx-global-pulse-of-appsec-study-finds-88-of-appsec-managers-surveyed-experienced-at-least-one-breach-in-prior-year-as-a-direct-result-of-vulnerable-application-code.md)
- [CRN Recognizes Checkmarx Channel Leaders Jennifer Taylor, Ana Lucia Amaral and Nina Abbasi-Beard on the 2024 Women of the Channel List](https://checkmarx.com/press-releases/crn-recognizes-checkmarx-channel-leaders-jennifer-taylor-ana-lucia-amaral-and-nina-abbasi-beard-on-the-2024-women-of-the-channel-list.md)
- [CRN’s 2023 Women of the Channel Honors Ana Lucia Amaral and Vivien Lim of Checkmarx](https://checkmarx.com/press-releases/crns-2023-women-of-the-channel-honors-ana-lucia-amaral-and-vivien-lim-of-checkmarx.md)
- [Deloitte Germany Partners with Checkmarx to Include Application Security Testing Technologies in the Deloitte Big Data Analytics Platforms and Services](https://checkmarx.com/press-releases/deloitte-germany-partners-checkmarx-include-application-security-testing-technologies-deloitte-big-data-analytics-platforms-services-2.md)
- [Equixly partners with Checkmarx to bring Continuous Penetration Testing to Application Security](https://checkmarx.com/press-releases/equixly-partners-with-checkmarx.md)
- [Frost & Sullivan Honor Checkmarx as Competitive Strategy Leader in the Global Application Security Posture Management (ASPM) Industry](https://checkmarx.com/press-releases/frost-sullivan-honor-checkmarx-as-competitive-strategy-leader-in-the-global-application-security-posture-management-aspm-industry.md)
- [Global Checkmarx Study Finds Vulnerabilities in Applications Developed In-house Were the Cause of Breaches at 92% of Companies Surveyed](https://checkmarx.com/press-releases/global-checkmarx-study-finds-vulnerabilities-in-applications-developed-in-house-were-the-cause-of-breaches-at-92-of-companies-surveyed.md)
- [Global Checkmarx Study Reveals 63% of Participating Organizations Have Fallen Victim to a Software Supply Chain Attack in Past Two Years](https://checkmarx.com/press-releases/global-checkmarx-study-reveals-63-of-participating-organizations-have-fallen-victim-to-a-software-supply-chain-attack-in-past-two-years.md)
- [Global Checkmarx Study Reveals Developers are Growing More Confident in Application Security Knowledge, Still Hampered by Time Spent on Security](https://checkmarx.com/press-releases/global-checkmarx-study-reveals-developers-are-growing-more-confident-in-application-security-knowledge-still-hampered-by-time-spent-on-security.md)
- [Hellman & Friedman Completes Acquisition of Checkmarx](https://checkmarx.com/press-releases/hellman-friedman-completes-acquisition-of-checkmarx.md)
- [Hellman & Friedman to Acquire Cybersecurity Leader Checkmarx at a $1.15B Valuation](https://checkmarx.com/press-releases/hellman-friedman-to-acquire-cybersecurity-leader-checkmarx-at-a-1-15b-valuation.md)
- [Inaugural INTENT Summit Brings Together the Global Security Research Community](https://checkmarx.com/press-releases/inaugural-intent-summit-brings-together-the-global-security-research-community.md)
- [IT Central Station Announces The Top Application Security Solutions of Q1 2017 Based On Real User Reviews](https://checkmarx.com/press-releases/it-central-station-announces-the-top-application-security-solutions-of-q1-2017-based-on-real-user-reviews.md)
- [Jonathan Rende Joins Checkmarx as Chief Product Officer](https://checkmarx.com/press-releases/jonathan-rende-cpo.md)
- [Large Financial Services Firm Gains 393% ROI with Checkmarx Application Security Testing Solutions](https://checkmarx.com/press-releases/large-financial-services-firm-gains-393-roi-with-checkmarx-application-security-testing-solutions.md)
- [Leading Global Bank Implements Checkmarx Source Code Analysis to Strengthen Security – PR](https://checkmarx.com/press-releases/leading-global-bank-implements-checkmarx-source-code-analysis-strengthen-security-3.md)
- [MEDIA ALERT: Checkmarx to Host Software Security Webinar, “Better Together: SAST and IAST”](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-2.md)
- [Nearly Half of Development Teams Now “Own” Application Security, Checkmarx Global Survey Finds](https://checkmarx.com/press-releases/development-teams-now-own-application-security.md)
- [New Checkmarx API Security Empowers the Developer/AppSec Partnership to Secure the Entire API and Software Development Lifecycle](https://checkmarx.com/press-releases/new-checkmarx-api-security-empowers-the-developer-appsec-partnership-to-secure-the-entire-api-and-software-development-lifecycle.md)
- [New Checkmarx Application Security Posture Management and Cloud Insights Offer Enterprises Code-to-cloud Visibility and Analysis of Cloud-native AppSec Risk](https://checkmarx.com/press-releases/new-checkmarx-application-security-posture-management-and-cloud-insights-offer-enterprises-code-to-cloud-visibility-and-analysis-of-cloud-native-appsec-risk.md)
- [New Checkmarx Study Uncovers Alarming Trends in Breaches, Supply Chain Loopholes and Security Confidence](https://checkmarx.com/press-releases/new-checkmarx-study-uncovers-alarming-trends-in-breaches-supply-chain-loopholes-and-security-confidence.md)
- [Ninety-nine Percent of Development Teams Use AI for Code Generation While Eighty Percent are Worried About Security Threats Stemming from Developers Using AI, Checkmarx Study Reveals](https://checkmarx.com/press-releases/ninety-nine-percent-of-development-teams-use-ai-for-code-generation-while-eighty-percent-are-worried-about-security-threats-stemming-from-developers-using-ai-checkmarx-study-reveals.md)
- [Press Release: Customers Have Spoken: Checkmarx is a 2022 Gartner® Peer Insights™ Customers’ Choice for Application Security Testing for Fourth Consecutive Year – Checkmarx](https://checkmarx.com/press-releases/customers-have-spoken-checkmarx-is-a-2022-gartner-peer-insights-customers-choice-for-application-security-testing-for-fourth-consecutive-year.md)
- [Project Hosts Deploys Checkmarx Solutions on FedRAMP.gov](https://checkmarx.com/press-releases/checkmarx-acquires-custodela-to-bring-enhanced-automation-to-devsecops-programs-3-3.md)
- [Scott Gainey Joins Checkmarx as Chief Marketing Officer to Spearhead New Growth Strategies](https://checkmarx.com/press-releases/scott-gainey-joins-checkmarx-as-chief-marketing-officer-to-spearhead-new-growth-strategies.md)
- [The U.S. Navy’s NIWC Pacific Selects Checkmarx to Accelerate Application Development, Bolstering Nation’s Security Posture Against Adversaries](https://checkmarx.com/press-releases/the-u-s-navys-niwc-pacific-selects-checkmarx-to-accelerate-application-development-bolstering-nations-security-posture-against-adversaries.md)
- [U.S. Air Force Directorate Selects Checkmarx to Enable Software Cyber Resiliency](https://checkmarx.com/press-releases/u-s-air-force-directorate-selects-checkmarx-to-enable-software-cyber-resiliency.md)
- [Zack Bentolila of Checkmarx Recognized as 2024 CRN® Channel Chief](https://checkmarx.com/press-releases/zack-bentolila-of-checkmarx-recognized-as-2024-crn-channel-chief.md)

## Series Locations

- [Checkmate the Tour: Boston](https://checkmarx.com/checkmate-tour-series/boston-2026.md)
- [Checkmate the Tour: London](https://checkmarx.com/checkmate-tour-series/london-2026.md)
- [Checkmate the Tour: New York](https://checkmarx.com/checkmate-tour-series/new-york-2026.md)
- [Checkmate the Tour: Paris](https://checkmarx.com/checkmate-tour-series/paris-2026.md)
- [Mumbai](https://checkmarx.com/series/mumbai.md)
- [Singapore](https://checkmarx.com/series/singapore.md)
- [Washington D.C.](https://checkmarx.com/series/washington-d-c.md)

## Podcasts

- [Shift Left, Stay Secure: AI’s Impact on the Development Lifecycle](https://checkmarx.com/podcasts/shift-left-stay-secure.md)
- [The Hidden Blind Spots of AI: A CTO’s Perspective](https://checkmarx.com/podcast/the-hidden-blind-spots-of-ai-a-ctos-perspective.md)
- [The Rise of Agentic AI Security](https://checkmarx.com/podcast/the-rise-of-agentic-ai-security.md)

## Pages

- [ Get Ready to Run
at the Gartner Summit – LP](https://checkmarx.com/gartner-srm-summit-us.md)
- [10 AI Supply Chain Risks Hiding in Your Codebase, and How to Get Ahead of Them ](https://checkmarx.com/resources/10-ai-supply-chain-risks-hiding-in-your-codebase.md)
- [10 Considerations for Best SAST Tools – Gated](https://checkmarx.com/sast-ebook-10-key-considerations.md)
- [2024 AI Survey – AppSec](https://checkmarx.com/7-steps-genai-survey-appsec.md)
- [2024 AI Survey – CISO](https://checkmarx.com/7-steps-genai-survey-ciso.md)
- [2024 AI Survey – General](https://checkmarx.com/7-steps-genai-survey-gen.md)
- [2024 Code to Cloud Checklist – Gated](https://checkmarx.com/2024-code-to-cloud-checklist-g.md)
- [2024 Frost & Sullivan ASPM Report – Gated](https://checkmarx.com/2024-frost-sullivan-aspm-report-g.md)
- [2024 TEI Report – General – Gated](https://checkmarx.com/tei-forrester-report.md)
- [2024 Top 6 Considerations for Container Security – CISO](https://checkmarx.com/6-key-considerations-for-container-security-ciso.md)
- [2024 Top 6 Considerations for Container Security – General](https://checkmarx.com/6-key-considerations-for-container-security.md)
- [2025 – 7 Proven Strategies to Unlock Developer Adoption of AppSec](https://checkmarx.com/2025-7-proven-strategies-to-unlock-developer-adoption-of-appsec.md)
- [2025 – 7 Steps to Prioritizing AppSec for Greater Impact](https://checkmarx.com/7-steps-prioritizing-appsec-greater-impact.md)
- [2025 – The Ultimate AppSec RFP Checklist and Guide](https://checkmarx.com/ultimate-appsec-rfp-guide.md)
- [A CISO’s Guide to Steering AppSec in the Era of DevSecOps](https://checkmarx.com/ciso-guide-to-steering-appsec-in-the-era-of-devsecops.md)
- [About us](https://checkmarx.com/company/about-checkmarx.md)
- [Agentic AI That Works at Dev Speed](https://checkmarx.com/video/agentic-ai-that-works-at-dev-speed.md)
- [Agentic AppSec in Action – WEBINAR](https://checkmarx.com/agentic-appsec-in-action-webinar.md)
- [AI APMA Assessment ECB](https://checkmarx.com/ai-apma-assessment-ecb.md)
- [AI Supply Chain Security](https://checkmarx.com/solutions/ai-supply-chain-security.md)
- [AI-BOM](https://checkmarx.com/ai-bom.md)
- [API Security](https://checkmarx.com/product/api-security.md)
- [APMA Lobby](https://checkmarx.com/apma-appsec-maturity-methodology-assessment.md)
- [Application Security Glossary](https://checkmarx.com/glossary.md)
- [Application Security Guide for Software Engineering Leaders – LP](https://checkmarx.com/application-security-guide-for-software-engineering-leaders.md)
- [AppSec for Financial Services](https://checkmarx.com/fusion-triage-remediation-financial-services.md)
- [AppSec in the Age of Mythos](https://checkmarx.com/appsec-age-of-mythos.md)
- [AppSec in the Fast Lane: F1 Arcade – EVENT](https://checkmarx.com/appsec-in-the-fast-lane-f1-arcade-event.md)
- [AppSec Manager Kit – April 2025](https://checkmarx.com/ready-to-run-appsec-manager.md)
- [AppSec Services](https://checkmarx.com/appsec-services.md)
- [ASPM](https://checkmarx.com/product/aspm.md)
- [Awards & Industry Recognition](https://checkmarx.com/company/awards-and-industry-recognition.md)
- [Awards & Recognition](https://checkmarx.com/company/awards.md)
- [AWS Partner](https://checkmarx.com/aws-partner.md)
- [Best Practices to Mitigate Security Risks With Agentic Coding Tools by Gartner®](https://checkmarx.com/best-practices-to-mitigate-security-risks-with-agentic-coding-tools-by-gartner.md)
- [Black duck Synopsys](https://checkmarx.com/black-duck-synopsys.md)
- [BLACK HAT 2025](https://checkmarx.com/black-hat-2025.md)
- [Blog](https://checkmarx.com/blog.md)
- [Brand Kit](https://checkmarx.com/brand-kit.md)
- [BSidesSF Afterparty @ Sandbox VR](https://checkmarx.com/event/bsidessfafterpartysandbox-vr.md)
- [Capability Without Security: Measuring the Functionality-Security Gap in AI-Generated Code](https://checkmarx.com/capability-without-security-measuring-functionality-security-gap-ai-generated-code.md)
- [Careers](https://checkmarx.com/company/careers.md)
- [Checkmarx – Ready For AppSec Your Devs Can Run With? ](https://checkmarx.com/ready-to-run-devsec.md)
- [Checkmarx Developer Assist](https://checkmarx.com/product/developer-assist.md)
- [Checkmarx FedRAMP](https://checkmarx.com/checkmarx-fedramp.md)
- [Checkmarx Fusion](https://checkmarx.com/platform/checkmarx-fusion.md)
- [CHECKMARX LEGAL AGREEMENTS](https://checkmarx.com/legal/terms.md)
- [Checkmarx MCP](https://checkmarx.com/solutions/checkmarx-mcp.md)
- [Checkmarx mend whitesource](https://checkmarx.com/checkmarx-mend-whitesource.md)
- [Checkmarx One](https://checkmarx.com/product/application-security-platform.md)
- [CHECKMARX ONE LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/checkmarx-one-license-types-and-restrictions.md)
- [CHECKMARX ONE LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/cxone-cloud-license-types-and-restrictions.md)
- [CHECKMARX ONE LICENSE TYPES AND RESTRICTIONS – V2022.08](https://checkmarx.com/legal/cxone-cloud-license-types-and-restrictions/v202208.md)
- [CHECKMARX ONE LICENSE TYPES AND RESTRICTIONS V2024.02](https://checkmarx.com/legal/checkmarx-one-license-types-and-restrictions-v202402.md)
- [checkmarx one-assist](https://checkmarx.com/product/checkmarx-one-assist.md)
- [CHECKMARX PRIVACY POLICY](https://checkmarx.com/legal/privacy-policy.md)
- [CHECKMARX SAST LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/software-license-types-and-restrictions.md)
- [CHECKMARX TERMS OF SERVICE](https://checkmarx.com/legal-agreement/terms-of-service.md)
- [CHECKMARX TERMS OF SERVICE – Australia](https://checkmarx.com/legal-agreement/local-country-addendum-australia.md)
- [CHECKMARX TERMS OF SERVICE – France](https://checkmarx.com/legal-agreement/local-country-addendum-france.md)
- [CHECKMARX TERMS OF SERVICE – Germany](https://checkmarx.com/legal-agreement/local-country-addendum-germany.md)
- [CHECKMARX TERMS OF SERVICE – India](https://checkmarx.com/legal-agreement/local-country-addendum-india.md)
- [CHECKMARX TERMS OF SERVICE – United Kingdom and Ireland](https://checkmarx.com/legal-agreement/local-country-addendum-uk.md)
- [Checkmarx University](https://checkmarx.com/customer-enablement/checkmarx-university.md)
- [Checkmarx vs Competition](https://checkmarx.com/checkmarx-vs-competition.md)
- [Checkmarx vs SonarQube: SAST Alternatives](https://checkmarx.com/checkmarx-sonarqube.md)
- [Checkmarx vs. Mend.io (formerly WhiteSource): Mend Alternative](https://checkmarx.com/checkmarx-mend-whitesource.md)
- [Checkmarx vs. Veracode](https://checkmarx.com/veracode.md)
- [Checkmarx Zero](https://checkmarx.com/zero.md)
- [Checkmate the Tour: Lobby Page](https://checkmarx.com/checkmate-the-tour.md)
- [Code to Cloud](https://checkmarx.com/solutions/code-to-cloud.md)
- [Codebashing](https://checkmarx.com/product/codebashing-secure-code-training.md)
- [CODEBASHING LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/codebashing-license-types-and-restrictions.md)
- [Company](https://checkmarx.com/company.md)
- [Contact Us](https://checkmarx.com/contact.md)
- [Container Security](https://checkmarx.com/product/container-security.md)
- [Coverity](https://checkmarx.com/coverity.md)
- [Coverity vs Checkmarx SAST](https://checkmarx.com/coverity.md)
- [Customer Enablement](https://checkmarx.com/customer-enablement.md)
- [Customer Stories](https://checkmarx.com/why-checkmarx/customer-stories.md)
- [CXIAST LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/cxiast-license-types-and-restrictions.md)
- [CxSAST on prem](https://checkmarx.com/product/cxsast-on-prem-source-code-scanning.md)
- [CXSCA LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/cxsca-license-types-and-restrictions.md)
- [CXSCS LICENSE TYPES AND RESTRICTIONS](https://checkmarx.com/legal/cxscs-license-types-and-restrictions.md)
- [DAST](https://checkmarx.com/checkmarx-dast.md)
- [Developer Assist](https://checkmarx.com/product/developer-assist.md)
- [Developer Assist Free Trial](https://checkmarx.com/free-trial.md)
- [Developer Assist Free Trial ](https://checkmarx.com/developer-assist-free-trial.md)
- [Developer Experience](https://checkmarx.com/solutions/developer-experience.md)
- [DevOps Security](https://checkmarx.com/security-devops.md)
- [DevSecOps](https://checkmarx.com/solutions/devsecops.md)
- [DevSecOps Evolution 2025 Research Report](https://checkmarx.com/evolution-devsecops.md)
- [Disclosure Policy](https://checkmarx.com/zero/disclosure-policy.md)
- [Dora WP](https://checkmarx.com/be-ready-cybersecurity-compliance-era.md)
- [ECB AI Security Mandate ](https://checkmarx.com/ecb-ai-security-mandate.md)
- [Endor labs](https://checkmarx.com/endor-labs.md)
- [ESG at Checkmarx](https://checkmarx.com/environmental-social-governance-mission.md)
- [Events](https://checkmarx.com/company/events.md)
- [Financial Services](https://checkmarx.com/financial-services.md)
- [Find a Partner](https://checkmarx.com/company/find-a-partner.md)
- [FOA Report](https://checkmarx.com/foa-report.md)
- [FOA Report French](https://checkmarx.com/foa-report-fr.md)
- [FOA Report German](https://checkmarx.com/foa-report-de.md)
- [FOA Report Paid Ad](https://checkmarx.com/foa-report-2.md)
- [Fortify](https://checkmarx.com/fortify.md)
- [From Chaos to Clarity ](https://checkmarx.com/chaos-to-clarity.md)
- [From Finding to Fixing: Triage & Remediation Assist Reduce AppSec Friction at Scale – WEBINAR](https://checkmarx.com/from-finding-to-fixing.md)
- [Frost Sullivan Award](https://checkmarx.com/award-frost-sullivan.md)
- [Fusion and Triage & Remediation – Campaign Page](https://checkmarx.com/fusion-triage-remediation-assist-campaign.md)
- [Future of Application Security Report – Ungated](https://checkmarx.com/2024-future-appsec-report.md)
- [Gartner MQ SSCS Landing Page ](https://checkmarx.com/checkmarx-named-a-leader-in-the-2026-gartner-magic-quadrant-for-software-supply-chain-security.md)
- [Gartner SRM 2026 – BLP](https://checkmarx.com/gartner-srm-2026.md)
- [Gartner® Magic Quadrant™ – SSCS EU](https://checkmarx.com/gartner-quadrant-sscs-eu.md)
- [GCC](https://checkmarx.com/gcc.md)
- [GigaOM 2024 SSCS Radar Report](https://checkmarx.com/gigaom-supply-chain-security-radar-report.md)
- [Github](https://checkmarx.com/github.md)
- [Global Capability Centers](https://checkmarx.com/global-capability-centers.md)
- [HCL AppScan vs Checkmarx SAST](https://checkmarx.com/checkmarx-hcl-appscan.md)
- [Healthcare](https://checkmarx.com/healthcare.md)
- [Home](https://checkmarx.com/index.md)
- [How ASPM and AI Are Reshaping AppSec](https://checkmarx.com/how-aspm-and-ai-are-reshaping-appsec.md)
- [IaC Security](https://checkmarx.com/product/iac-security.md)
- [Insurance](https://checkmarx.com/insurance.md)
- [Integrations](https://checkmarx.com/why-checkmarx/integrations.md)
- [It Sa 2025](https://checkmarx.com/it-sa-2025.md)
- [KICS](https://checkmarx.com/product/kics.md)
- [Knowledge Hub](https://checkmarx.com/learn.md)
- [Languages](https://checkmarx.com/languages.md)
- [Latest Innovations](https://checkmarx.com/latest-innovations.md)
- [Latest Innovations](https://checkmarx.com/latest-innovations.md)
- [Leadership](https://checkmarx.com/leadership.md)
- [Life Sciences](https://checkmarx.com/life-sciences.md)
- [Live Webinar: Amdocs’ Secret to Success: Embedding AppSec Early](https://checkmarx.com/amdocs-success-embedding-appsec-early.md)
- [Live Webinar: Tomorrow with Checkmarx – February 2026](https://checkmarx.com/live-webinar-tomorrow-with-checkmarx-february-2026.md)
- [Live Webinar: Tomorrow with Checkmarx – January 2026](https://checkmarx.com/live-webinar-tomorrow-with-checkmarx-january-2026.md)
- [Live Webinar: Tomorrow with Checkmarx – March 2026](https://checkmarx.com/live-webinar-tomorrow-with-checkmarx-march-2026.md)
- [LLM Application Security: Governing AI-Driven Risk Across the Software Lifecycle](https://checkmarx.com/llm-application-security-governing-ai-driven-risk.md)
- [LLM Scanner](https://checkmarx.com/platform/llm-scanner.md)
- [LP – How Mature is Your Application Security Program?  ](https://checkmarx.com/how-mature-is-your-application-security-program.md)
- [LP – The AppSec Regulatory Review and Assessment Guide ](https://checkmarx.com/the-appsec-regulatory-review-and-assessment-guide.md)
- [LP – Tolly Report 2025](https://checkmarx.com/the-tolly-report-ghas.md)
- [Malicious Package Protection](https://checkmarx.com/product/malicious-packages.md)
- [Malicious Packages Identification API (MPIAPI)](https://checkmarx.com/malicious-packages-identification-api.md)
- [News](https://checkmarx.com/company/news.md)
- [OLD VERSION – Live Webinar: Amdocs’ Secret to Success: Embedding AppSec Early](https://checkmarx.com/amdocs-success-embedding-appsec-early-old.md)
- [On Demand Webinar: Understanding Europe’s Most Extensive Cybersecurity Directive](https://checkmarx.com/od-webinar-europe-cybersecurity-directive.md)
- [Open-Source and Free Tools ](https://checkmarx.com/open-source-and-free-tools.md)
- [Our Partner Programs](https://checkmarx.com/company/checkmarx-appsec-partner-program.md)
- [Packaging](https://checkmarx.com/packaging.md)
- [Patrick Debois Webinar – OD Video Series](https://checkmarx.com/patrick-debois-webinar.md)
- [Player Page: IDE: Integrating With Checkmarx One](https://checkmarx.com/player-demo-ide-integrating-with-checkmarx-one.md)
- [Player Page: In IDE-JIRA Integration](https://checkmarx.com/player-demo-in-ide-jira-integration.md)
- [Player Page: Migration Explainer Video](https://checkmarx.com/player-migration-easier-than-think.md)
- [Player Page: Policy Management: Breaking the Build](https://checkmarx.com/player-demo-policy-management-with-checkmarx.md)
- [Plugins](https://checkmarx.com/plugins.md)
- [Podcasts](https://checkmarx.com/podcasts.md)
- [Position Paper – Code at Risk ](https://checkmarx.com/position-paper-code-at-risk.md)
- [Premium Support](https://checkmarx.com/support.md)
- [Press Releases](https://checkmarx.com/press-releases.md)
- [Pricing](https://checkmarx.com/pricing.md)
- [Promotional Email LP – Meeting Scheduler](https://checkmarx.com/book-a-meeting-scheduler-jan25.md)
- [Public Sector](https://checkmarx.com/company/public-sector.md)
- [Report – Forrester Wave 2025](https://checkmarx.com/forrester-wave-2025.md)
- [Report – Future of AppSec 2025](https://checkmarx.com/report-future-of-appsec-2025.md)
- [Report – IDC MarketScape for ASPM 2025](https://checkmarx.com/report-idc-marketscape-for-aspm-2025.md)
- [Report – Keeping Bad Vibes Out ](https://checkmarx.com/report-keeping-bad-vibes-out.md)
- [Report a Vulnerabilitiy](https://checkmarx.com/zero/report-a-vulnerability.md)
- [Repository Health](https://checkmarx.com/product/repository-health.md)
- [Request a demo](https://checkmarx.com/request-a-demo.md)
- [Research](https://checkmarx.com/zero/research.md)
- [Resources](https://checkmarx.com/resources.md)
- [RSA 2025](https://checkmarx.com/rsa-2025.md)
- [RSA CAB 2025](https://checkmarx.com/checkmarx-cab-rsa-2025.md)
- [RSA Media Round Table 2025](https://checkmarx.com/checkmarx-mediaroundtable-rsa-2025.md)
- [SAST](https://checkmarx.com/cxsast-source-code-scanning.md)
- [SBOM](https://checkmarx.com/product/sbom.md)
- [SCA](https://checkmarx.com/cxsca-open-source-scanning.md)
- [Secrets Detection](https://checkmarx.com/product/secrets-detection.md)
- [Secure by Design: Embedding Agentic AppSec into AI-Native Development on Windsurf](https://checkmarx.com/vibe-safe-embedding-agentic-appsec-into-windsurf.md)
- [Securing what’s Next: Leadership Dialog on the Agentic Future – RSA 2026](https://checkmarx.com/securing-whats-next-rsa.md)
- [Security Can’t Keep Up With AI But DAST Closes the Gap – WEBINAR](https://checkmarx.com/security-cant-keep-up-with-ai-but-dast-closes-the-gap.md)
- [Semgrep](https://checkmarx.com/semgrep.md)
- [SERVICE LEVEL AGREEMENT FOR CLOUD SERVICES](https://checkmarx.com/legal/cloud-services-sla.md)
- [Shadow AI in the SDLC – WEBINAR](https://checkmarx.com/shadow-ai-in-the-sdlc.md)
- [Snyk](https://checkmarx.com/snyk.md)
- [SOFTWARE MAINTENANCE, UPGRADES AND SUPPORT](https://checkmarx.com/cxast-legal-agreements/software-sla.md)
- [SSCS](https://checkmarx.com/solutions/software-supply-chain-security.md)
- [Synopsys](https://checkmarx.com/black-duck-synopsys.md)
- [Synopsys](https://checkmarx.com/synopsys.md)
- [Technology](https://checkmarx.com/technology.md)
- [Terms of use](https://checkmarx.com/legal/terms-of-use.md)
- [Thank you!_EN](https://checkmarx.com/opted-out-thank-you.md)
- [The 2025 Gartner® Magic Quadrant™ for Application Security Testing  ](https://checkmarx.com/gartner_magic_quadrant_2025_report.md)
- [The Agentic AI Buyer’s Guide ](https://checkmarx.com/the-agentic-ai-buyers-guide.md)
- [The AppSec Imperative](https://checkmarx.com/the-appsec-imperative.md)
- [The Future of Application Security in the Era of AI   ](https://checkmarx.com/future-of-application-security-in-the-era-of-ai-report.md)
- [The Hidden Threat of Malicious Open-Source Packages – eBook](https://checkmarx.com/the-hidden-threat-of-malicious-open-source-packages.md)
- [The Road to DevSecOps White Paper – LP](https://checkmarx.com/whitepaper-dso-road-to-devsecops.md)
- [The Security Trends Shaping the Year Ahead](https://checkmarx.com/security-trends-shaping-year-ahead.md)
- [The Velocity Trap](https://checkmarx.com/the-velocity-trap.md)
- [Too Many Secrets](https://checkmarx.com/product/2ms.md)
- [Tools](https://checkmarx.com/zero/tools.md)
- [Top 6 Considerations for Container Security – AppSec](https://checkmarx.com/6-key-considerations-for-container-security-appsec.md)
- [Triage and Remediation](https://checkmarx.com/product/triage-and-remediation.md)
- [Triage Assist & Remediation Assist Program](https://checkmarx.com/triage-remediation-trial.md)
- [Trust](https://checkmarx.com/trust.md)
- [Two Fronts, One Risk – WEBINAR](https://checkmarx.com/two-fronts-one-risk.md)
- [V2022.07](https://checkmarx.com/legal/cxone-cloud-license-types-and-restrictions/v2022-07.md)
- [Vorpal](https://checkmarx.com/product/vorpal.md)
- [vs CNAPP](https://checkmarx.com/cnapp-limitations.md)
- [Vulnerabilities](https://checkmarx.com/zero/vulnerabilities.md)
- [Webinar – The Future of DAST](https://checkmarx.com/the-future-of-dast.md)
- [Webinar de Checkmarx One Developer Assist](https://checkmarx.com/webinar-de-checkmarx-one-developer-assist.md)
- [WEBINAR: AppSec in the Era of Agentic AI \[FoA\]](https://checkmarx.com/webinar-appsec-in-the-era-of-agentic-ai.md)
- [Webinar: Amplifying Agentic AI: Speed Meets Security](https://checkmarx.com/amplifying-agentic-ai-speed-meets-security.md)
- [WEBINAR: Bridging the DevSec Divide ](https://checkmarx.com/webinar-bridging-the-devsec-divide.md)
- [WEBINAR: Checkmarx One Assist: Say Hello to the Future](https://checkmarx.com/webinar-checkmarx-one-assist-say-hello-to-the-future.md)
- [WEBINAR: Checkmarx One Extra: a Deeper Look at Our AppSec Platform](https://checkmarx.com/webinar-checkmarx-one-extra.md)
- [WEBINAR: Driving Cultural and Technological Change \[Patrick Debois\]](https://checkmarx.com/webinar-driving-cultural-and-technological-change-patrick-debois.md)
- [WEBINAR: Game On: Agentic AI for Dev & AppSec](https://checkmarx.com/webinar-game-on-agentic-ai-for-dev-and-appsec.md)
- [WEBINAR: GenAI Code Under the Microscope](https://checkmarx.com/webinar-genai-code-under-the-microscope.md)
- [WEBINAR: Intro to Checkmarx One; The AppSec Platform for the AI Era](https://checkmarx.com/webinar-intro-to-checkamrx-one.md)
- [WEBINAR: Lessons Learned in DevSecOps and Vibe Coding](https://checkmarx.com/webinar-lessons-learned-in-devsecops-and-vibe-coding.md)
- [Webinar: Modernizing Application Security with Checkmarx One and AWS](https://checkmarx.com/live-webinar-modernizing-application-security.md)
- [WEBINAR: Rise of Agentic AI: Dev & AppSec Impact](https://checkmarx.com/checkmarx-webinar-rise-of-agentic-ai-dev-appsec-impact.md)
- [WEBINAR: Secure Early, Ship Fast: Smarter Container Security ](https://checkmarx.com/webinar-smarter-container-security.md)
- [WEBINAR: Shaping Secure DevOps](https://checkmarx.com/webinar-shaping-secure-devops.md)
- [WEBINAR: Stay in Flow, Code Safe with Agentic](https://checkmarx.com/webinar-stay-in-flow-code-safe-with-agentic.md)
- [WEBINAR: Turning Devs Into Security Champs ](https://checkmarx.com/webinar-turning-devs-into-security-champs.md)
- [WEBINAR: Using Security to Speed up Development](https://checkmarx.com/webinar-dora-using-security-to-speed-up-development.md)
- [Webinars](https://checkmarx.com/webinars.md)
- [Webinars](https://checkmarx.com/webinars.md)
- [Whitepaper – Securing Agentic AI-driven Development ](https://checkmarx.com/securing-agentic-ai-driven-development.md)
- [Why Checkmarx](https://checkmarx.com/why-checkmarx.md)
- [WIZ](https://checkmarx.com/wiz.md)
- [Zed Attack Proxy](https://checkmarx.com/product/zap.md)
- [Zero Subscription](https://checkmarx.com/zero-subscription.md)

## Posts

- [“CuteBoi” Detected Preparing a Large-Scale Crypto Mining Campaign on NPM Users](https://checkmarx.com/blog/cuteboi-detected-preparing-a-large-scale-crypto-mining-campaign-on-npm-users.md)
- [“Stranger Things” Happen With Today’s Software  ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/stranger-things-happen-with-todays-software.md): Today’s software stack looks like the Upside Down: complex, unpredictable, and full of hidden risk. Developers are the new defenders. Discover how a developer-  first application security approach, powered by agentic AI, helps secure code as it’s created. 
- [“Vulnerable by Design”: The Boldest Takes From Our Live Panel on AppSec in the Agentic AI Era ](https://checkmarx.com/blog/vulnerable-by-design-appsec-in-the-agentic-ai-era.md): Highlights from our expert panel on the future of AppSec in the era of AI.
- [2023: A Year in Review](https://checkmarx.com/blog/2023-a-year-in-review.md)
- [3 Financial Services Trends and How They Affect Your Application Security](https://checkmarx.com/blog/3-financial-services-trends-and-how-they-affect-your-application-security.md)
- [4 Common Container Security Misconceptions (and How to Avoid Them) ](https://checkmarx.com/blog/4-common-container-security-misconceptions-and-how-to-avoid-them.md)
- [4 Essential Security Skills for Modern Application Development](https://checkmarx.com/blog/4-essential-security-skills-for-modern-application-development.md)
- [5 Tips to Build an Impactful AppSec Program: Real World Insights from APMA Assessments](https://checkmarx.com/blog/5-tips-to-build-an-impactful-appsec-program-real-world-insights-from-apma-assessments.md)
- [99% Unpatched: What Mythos, Gartner, and a Nine-Second Disaster Tell Us About the Future of AppSec ](https://checkmarx.com/blog/99-unpatched-what-mythos-gartner-and-a-nine-second-disaster-tell-us-about-the-future-of-appsec.md)
- [A Developer’s Guide to Managing Open-Source Risks](https://checkmarx.com/blog/a-developers-guide-to-managing-open-source-risks.md)
- [A Developer’s List of Infrastructure as Code (IaC) Risks](https://checkmarx.com/blog/a-developers-list-of-infrastructure-as-code-iac-risks.md)
- [A Developer’s List of Key Container Security Risks](https://checkmarx.com/blog/a-developers-list-of-key-container-security-risks.md)
- [A Developer’s List of Microservices Risks](https://checkmarx.com/blog/a-developers-list-of-microservices-risks.md)
- [A Developer’s View: What Exactly Is Modern Application Development?](https://checkmarx.com/blog/a-developers-view-what-exactly-is-modern-application-development.md)
- [A Developer’s View: What Kind of AST Event Correlation Is Needed in MAD?](https://checkmarx.com/blog/a-developers-view-what-kind-of-ast-event-correlation-is-needed-in-mad.md)
- [A DevOps Architect’s Guide to Developer-Friendly AppSec Tools](https://checkmarx.com/blog/devops-architects-guide-to-developer-friendly-appsec-tools.md)
- [A New North Korean Group Emerges, Disrupting the Open-Source Ecosystem ](https://checkmarx.com/blog/a-new-north-korean-group-emerges-disrupting-the-open-source-ecosystem.md)
- [A new, stealthier type of Typosquatting attack spotted targeting NPM  ](https://checkmarx.com/blog/a-new-stealthier-type-of-typosquatting-attack-spotted-targeting-npm.md)
- [A3Sec](https://checkmarx.com/emea/a3sec.md)
- [AA consulting](https://checkmarx.com/emea/aa-consulting.md)
- [Ackcent](https://checkmarx.com/emea/ackcent.md)
- [AdCare](https://checkmarx.com/emea/adcare.md)
- [AI Agents and Secure Software Engineering](https://checkmarx.com/blog/ai-agents-and-secure-software-engineering.md)
- [AI Code Needs AI Security: Why Claude’s Announcement Signals a Bigger Shift ](https://checkmarx.com/blog/ai-code-needs-ai-security-why-claudes-announcement-signals-a-bigger-shift.md): Claude Code Security marks a shift toward AI-native vulnerability detection. Explore why AI-generated code demands enterprise-grade, agentic AppSec at scale.
- [AI is Writing Your Code – Who’s Keeping It Secure? ](https://checkmarx.com/blog/ai-is-writing-your-code-whos-keeping-it-secure.md)
- [AI Query Builder for SAST: Now Generally Available ](https://checkmarx.com/blog/ai-query-builder-for-sast-now-generally-available.md)
- [AI Speed vs. Software Security: A Conversation with Checkmarx CEO Sandeep Johri and IDC’s Katie Norton ](https://checkmarx.com/blog/ai-speed-vs-software-security-a-conversation-with-checkmarx-ceo-sandeep-johri-and-idcs-katie-norton.md): The future of application security will not be defined by how fast we build, but by how confidently we secure what we build.
- [AKIS Management Ltd](https://checkmarx.com/emea/akis-management-ltd.md)
- [Alias and Directive Overloading in GraphQL](https://checkmarx.com/blog/alias-and-directive-overloading-in-graphql.md)
- [Always Ready to Run: How CISOs Can Finally Get Ahead of Application Risk](https://checkmarx.com/blog/how-cisos-can-finally-get-ahead-of-application-risk.md)
- [Analysis of OpenSSL CVE-2022-3786 and CVE-2022-3602](https://checkmarx.com/blog/analysis-of-openssl-cve-2022-3786-and-cve-2022-3602.md)
- [Android WebView: Are Secure Coding Practices Being Followed?](https://checkmarx.com/blog/android-webview-secure-coding-practices-2.md)
- [Announcing DevGrid + Checkmarx Partnership: A New Era of Secure Engineering](https://checkmarx.com/blog/announcing-devgrid-checkmarx-partnership-a-new-era-of-secure-engineering.md)
- [Announcing the Checkmarx Tech Partnership Program](https://checkmarx.com/blog/checkmarx-tech-partnership-program.md)
- [API Security Is the New Endpoint Security](https://checkmarx.com/blog/api-security-is-the-new-endpoint-security-2.md)
- [API Security: Exposed API Endpoint Leaks Over 11 Million Telco Customers’ Data](https://checkmarx.com/blog/api-security-exposed-api-endpoint-leaks-over-11-million-telco-customers-data.md)
- [APMA Digital: A New Way to Develop AppSec Maturity](https://checkmarx.com/blog/apma-digital-a-new-way-to-develop-appsec-maturity.md)
- [APMA: THE NEW APPSEC MATURITY MODEL WITH YOUR SUCCESS IN MIND](https://checkmarx.com/blog/apma-the-new-appsec-maturity-model-with-your-success-in-mind.md)
- [Arobis](https://checkmarx.com/emea/arobis.md)
- [ASM Technologies](https://checkmarx.com/emea/asm-technologies.md)
- [ASPM is for Everyone](https://checkmarx.com/blog/aspm-is-for-everyone.md)
- [Atlantica](https://checkmarx.com/emea/atlantica.md)
- [Attackability: Why Context, Not Reachability, Should Drive Remediation ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/reachability-was-a-breakthrough-but-now-its-not-enough.md): Reachability is not exploitability. Modern software development requires more than execution analysis.
- [Attacker Caught Hijacking Packages Using Multiple Techniques to Steal AWS Credentials](https://checkmarx.com/blog/attacker-caught-hijacking-packages-using-multiple-techniques-to-steal-aws-credentials.md)
- [Attacker Uses a Popular TikTok Challenge to Lure Users Into Installing Malicious Package](https://checkmarx.com/blog/attacker-uses-a-popular-tiktok-challenge-to-lure-users-into-installing-malicious-package.md)
- [Attacking the Software Supply Chain with a Simple Rename](https://checkmarx.com/blog/attacking-the-software-supply-chain-with-a-simple-rename.md)
- [Automatic Execution of Code Upon Package Download on Python Package Manager](https://checkmarx.com/blog/automatic-execution-of-code-upon-package-download-on-python-package-manager.md)
- [Automating vulnerability remediation with Checkmarx One and Mobb.ai](https://checkmarx.com/blog/automating-vulnerability-remediation-with-checkmarx-one-and-mobb-ai.md)
- [AWS and Checkmarx: Security at Cloud Scale](https://checkmarx.com/blog/aws-and-checkmarx-security-at-cloud-scale.md)
- [Bakotech](https://checkmarx.com/emea/bakotech.md)
- [Balidea](https://checkmarx.com/emea/balidea.md)
- [Best Fix Location: Minimize Fix Time and Maximize Security](https://checkmarx.com/blog/best-fix-location-minimize-fix-time-and-maximize-security.md)
- [Breaking Down the OWASP API Security Top 10 (Part 1)](https://checkmarx.com/blog/breaking-down-owasp-api-security-top10-part1.md)
- [Breaking Down the OWASP API Security Top 10 (Part 2)](https://checkmarx.com/blog/breaking-down-owasp-api-security-top-10-part-2.md)
- [Breaking the Bottleneck: How AppSec Managers Can Reduce Risk Without Slowing Down Development](https://checkmarx.com/blog/breaking-bottleneck-how-appsec-reduce-risk-without-slowing-development.md)
- [Bringing IDE-Native AppSec to Kiro with Checkmarx Developer Assist](https://checkmarx.com/blog/bringing-ide-native-appsec-to-kiro-with-checkmarx-one-assist.md)
- [Building an AI Security Agent Is Easy. Operating One Is Harder.](https://checkmarx.com/blog/building-an-ai-security-agent-is-easy-operating-one-is-harder.md): A technical guide on building and operating AI security agents.
- [Can you please describe your product architecture?](https://checkmarx.com/blog/can-you-please-describe-your-product-architecture.md)
- [CDM Media CISO Summit](https://checkmarx.com/blog/cdm-media-ciso-summit.md)
- [Celebrating Excellence: Checkmarx Americas Partner Summit 2023 Awards ](https://checkmarx.com/blog/celebrating-excellence-checkmarx-americas-partner-summit-2023-awards.md)
- [Celebrating Pride Today and Every Day](https://checkmarx.com/blog/celebrating-pride-today-and-every-day.md)
- [Checkmarx + Vulcan Cyber: Enabling Customers to Mitigate AI Vulnerabilities](https://checkmarx.com/blog/checkmarx-vulcan-cyber-enabling-customers-to-mitigate-ai-vulnerabilities.md)
- [Checkmarx + Wiz: Advancing AppSec with Code to Cloud Integration](https://checkmarx.com/blog/checkmarx-wiz-advancing-appsec-with-code-to-cloud-integration.md): Checkmarx and Wiz have partnered to help enhance your enterprise’s security and provide comprehensive, code to cloud protection.
- [Checkmarx Advances Software Supply Chain Security](https://checkmarx.com/blog/checkmarx-advances-software-supply-chain-security.md)
- [Checkmarx and the AI Revolution: Charting the Future of Application Security](https://checkmarx.com/blog/checkmarx-and-the-ai-revolution-charting-the-future-of-application-security.md)
- [Checkmarx Application Security Guide to Claude Mythos](https://checkmarx.com/blog/checkmarx-application-security-guide-to-claude-mythos.md): Claude Mythos highlights a new era of dynamic, AI-driven applications, and the growing security blind spots they create. Securing them requires agentic AppSec that combines deterministic precision with probabilistic intelligence, delivering full AI visibility and high-fidelity, low-noise results.
- [Checkmarx DAST for the AI Coding Era: Runtime Security at Machine Speed](https://checkmarx.com/blog/checkmarx-dast-for-the-ai-coding-era.md): The question is no longer whether to implement DAST. It is whether your DAST can keep pace with how fast your teams are building.
- [Checkmarx Influencer 2026 Predictions](https://checkmarx.com/blog/checkmarx-influencer-2026-predictions.md)
- [Checkmarx Named 2024 Customers’ Choice for App Security Testing by Gartner®. Again.](https://checkmarx.com/blog/checkmarx-once-again-recognized-as-a-2024-customers-choice-for-application-security-testing-by-gartner-peer-insights.md)
- [Checkmarx Named a Leader for the 7th Time in the 2025 Gartner® Magic Quadrant™ for Application Security Testing](https://checkmarx.com/blog/checkmarx-named-a-leader-for-the-7th-time-in-the-2025-gartner-magic-quadrant-for-application-security-testing.md)
- [Checkmarx Named a Leader in 2025 IDC MarketScape for Application Security Posture Management (ASPM)](https://checkmarx.com/blog/checkmarx-named-a-leader-in-2025-idc-aspm-report.md): Checkmarx is a strong fit for organizations seeking an ASPM solution embedded in a developer-focused AppSec platform.
- [Checkmarx Named a Leader in Inaugural 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security](https://checkmarx.com/blog/checkmarx-named-a-leader-in-inaugural-2026-gartner-magic-quadrant-for-software-supply-chain-security.md)
- [Checkmarx Named a Leader in the 2023 Forrester Wave™ for Static Application Security Testing ](https://checkmarx.com/blog/checkmarx-named-a-leader-in-the-2023-forrester-wave-for-static-application-security-testing.md)
- [Checkmarx named a Leader in The Forrester Wave™: Static Application Security Testing Solutions, Q3 2025 ](https://checkmarx.com/blog/checkmarx-named-a-leader-in-the-forrester-wave-static-application-security-testing-solutions-q3-2025.md): Checkmarx scores highest in Current Offering category across ten evaluated vendors.
- [Checkmarx Named as a Leader in Software Supply Chain Security (SSCS)](https://checkmarx.com/blog/checkmarx-named-as-a-leader-in-software-supply-chain-security-sscs.md)
- [Checkmarx One + Harness STO: Orchestrating Security Scanning in your CI Pipeline](https://checkmarx.com/blog/checkmarx-one-harness-sto-orchestrating-security-scanning-in-your-ci-pipeline.md)
- [Checkmarx One for Government Achieves FedRAMP Moderate Certification](https://checkmarx.com/blog/checkmarx-one-for-government-achieves-fedramp-moderate-certification.md): A new standard for secure-by-design in the public sector.
- [Checkmarx One Named Best DevSecOps Solution in the 2024 DevOps Dozen Awards](https://checkmarx.com/blog/checkmarx-one-named-best-devsecops-solution-in-the-2024-devops-dozen-awards.md)
- [Checkmarx SCA Now Supports the Ruby Language](https://checkmarx.com/blog/checkmarx-sca-now-supports-the-ruby-language.md)
- [Checkmarx Security Champion Program: Elevate Your Security Posture](https://checkmarx.com/blog/championing-security-in-a-changing-world-elevate-your-security-posture-with-the-checkmarx-security-champion-program.md)
- [Checkmarx Security, Delivered Through Every AI Tool Your Team Already Uses](https://checkmarx.com/blog/checkmarx-security-delivered-through-every-ai-tool-your-team-already-uses.md)
- [Checkmarx Solutions Now Available for Purchase on AWS Marketplace](https://checkmarx.com/blog/checkmarx-solutions-now-available-for-purchase-on-aws-marketplace.md)
- [Checkmarx Supply Chain Threat Intelligence: The Next Level of Defense for Open-Source Security](https://checkmarx.com/blog/checkmarx-supply-chain-threat-intelligence-the-next-level-of-defense-for-open-source-security.md)
- [Checkmarx: 2023 Customers Choice for AppSec Testing by Gartner® Peer Insights](https://checkmarx.com/blog/checkmarx-has-been-recognized-as-a-2023-customers-choice-for-application-security-testing-by-gartner-peer-insights.md)
- [Checkmarx’s Approach to Software Supply Chain Security](https://checkmarx.com/blog/checkmarx-approach-to-software-supply-chain-security.md)
- [Citel Group](https://checkmarx.com/emea/citel-group.md)
- [Claranet](https://checkmarx.com/emea/claranet.md)
- [Cloudbees](https://checkmarx.com/technical-partners/cloudbees.md)
- [CNS Outsourcing IT](https://checkmarx.com/emea/cns-outsourcing-it.md)
- [CocoaPods Subdomain Hijacked: This is How](https://checkmarx.com/blog/cocoapods-subdomain-hijacked-this-is-how.md)
- [Code Exposure: The Vulnerabilities in Your Code & Where They Originate](https://checkmarx.com/blog/code-exposure-vulnerabilities-in-your-code.md)
- [Codemender, Aardvark, and the Rise of Agentic AppSec: What Developers Need to Know ](https://checkmarx.com/blog/codemender-aardvark-and-the-rise-of-agentic-appsec-what-developers-need-to-know.md)
- [Compliance Control Limited](https://checkmarx.com/emea/compliance-control-limited.md)
- [Confident Developers Are the New Security Risk ](https://checkmarx.com/blog/confident-developers-are-the-new-security-risk.md): Teams are shipping more code, faster than ever. It looks polished, it runs smoothly, and it works - so developers trust it. That's the problem.
- [Confronting Insecure Shadow AI: Six Must-Have Capabilities](https://checkmarx.com/blog/confronting-insecure-shadow-ai-six-must-have-capabilities.md)
- [Consoft Sistemi](https://checkmarx.com/emea/consoft-sistemi.md)
- [Container runtime insights to prioritize what matters most  ](https://checkmarx.com/blog/container-runtime-insights-to-prioritize-what-matters-most.md)
- [Converge Technologies](https://checkmarx.com/emea/converge-technologies.md)
- [Cursor Is Changing How Developers Build. Security Has to Change Too.](https://checkmarx.com/blog/cursor-is-changing-how-developers-build-security-has-to-change-too.md)
- [Customer Spotlight: Pismo Builds Strong Security Culture   ](https://checkmarx.com/blog/customer-spotlight-pismo-builds-strong-security-culture.md)
- [CVE-2021-33420: NPM Replicator Remote Code Execution Deserialization](https://checkmarx.com/blog/npm-replicator-remote-code-execution-deserialization.md)
- [CVE-2022-37734: graphql-java Denial-of-Service](https://checkmarx.com/blog/cve-2022-37734-graphql-java-denial-of-service.md)
- [CVE-2022-42889: Text4shell Vulnerability Breakdown](https://checkmarx.com/blog/cve-2022-42889-text4shell-vulnerability-breakdown.md)
- [CVSS v4.0: What You Need to Know about the Latest Version](https://checkmarx.com/blog/cvss4-what-you-need-to-know-about-the-latest-version.md)
- [CVSS Was Built for Code, Not AI Agents. Now AIVSS Closes the Gap ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/cvss-was-built-for-code-not-ai-agents-now-aivss-closes-the-gap.md)
- [CxSAST for Amazon Web Services](https://checkmarx.com/technical-partners/amazon-aws-checkmarx.md)
- [Deliver Secure Software from Home: Checkmarx Offers Free 45-Day Codebashing Trial](https://checkmarx.com/blog/deliver-secure-software-from-home-checkmarx-offers-free-codebashing-trial.md)
- [Demystifying Code to Cloud: What You Need to Know](https://checkmarx.com/blog/demystifying-code-to-cloud-what-you-need-to-know.md)
- [Demystifying Infrastructure as Code Security: A Technical Deep Dive](https://checkmarx.com/blog/demystifying-infrastructure-as-code-security-a-technical-deep-dive.md)
- [Developer Training in the Context of Regulatory Compliance](https://checkmarx.com/blog/developer-training-in-the-context-of-regulatory-compliance.md)
- [Developers’ Work Just Got Much Simpler with Latest Checkmarx Update  ](https://checkmarx.com/blog/dev-work-got-simpler-with-april25-checkmarx-update.md)
- [Devoteam](https://checkmarx.com/emea/devoteam.md)
- [DevSecOps: What DevOps NEEDS to Be When It Grows Up](https://checkmarx.com/blog/devsecops-what-devops-needs-to-be-when-it-grows-up.md)
- [Didn’t Notice Your Rate Limiting: GraphQL Batching Attack](https://checkmarx.com/blog/didnt-notice-your-rate-limiting-graphql-batching-attack.md)
- [Diving Deep into Regular Expression Denial of Service (ReDoS) in Go](https://checkmarx.com/blog/redos-go.md)
- [Dizengoff House](https://checkmarx.com/emea/dizengoff-house.md)
- [Do I have to rescan my entire code base every time?](https://checkmarx.com/blog/do-i-have-to-rescan-my-entire-code-base-every-time.md)
- [DXC Technology + Checkmarx Jointly Deliver Enterprise AppSec Success](https://checkmarx.com/blog/dxc-technology-checkmarx-teaming-for-enterprise-appsec-success.md)
- [Elevating Code Security: The Shift-Left Approach with Vorpal by Checkmarx](https://checkmarx.com/blog/elevating-code-security-the-shift-left-approach-with-vorpal-by-checkmarx.md)
- [Embracing ASPM: Enabling Enterprise Security Excellence](https://checkmarx.com/blog/embracing-aspm-enabling-enterprise-security-excellence.md)
- [Empower Your Developers Through Gamified Learning With Checkmarx Codebashing ](https://checkmarx.com/blog/empower-your-developers-through-gamified-learning-with-checkmarx-codebashing.md)
- [Ericsson Sensitive Data Exposure via Trace.axd ](https://checkmarx.com/blog/ericsson-sensitive-data-exposure-via-trace-axd.md)
- [ESG Highlights Software Supply Chain Security](https://checkmarx.com/blog/esg-highlights-software-supply-chain-security.md)
- [Expanding AppSec Coverage with PII Leak Detection with Checkmarx + HoundDog.ai](https://checkmarx.com/blog/expanding-appsec-coverage-with-pii-leak-detection-with-checkmarx-hounddog-ai.md)
- [Exploitable Path – Advanced Topics](https://checkmarx.com/blog/exploitable-path-advanced-topics.md)
- [Exploitable Path – How to Solve a Static Analysis Nightmare](https://checkmarx.com/blog/exploitable-path-how-to-solve-a-static-analysis-nightmare.md)
- [Exploiting GraphQL Query Depth](https://checkmarx.com/blog/exploiting-graphql-query-depth.md)
- [Find and prioritize application vulnerabilities with ServiceNow and Checkmarx](https://checkmarx.com/blog/find-and-prioritize-application-vulnerabilities-with-servicenow-and-checkmarx.md)
- [First Known Phishing Attack Against PyPi Users](https://checkmarx.com/blog/first-known-phishing-attack-against-pypi-users.md)
- [Foresight Tech Group LTD](https://checkmarx.com/emea/foresight-tech-group-ltd.md)
- [From Doers to Decision Makers: Engineering’s Shift in the Age of Agentic AI ](https://checkmarx.com/blog/from-doers-to-decision-makers-engineerings-shift-in-the-age-of-agentic-ai.md)
- [From Lines of Code to Cloud Security: Navigating the Future of Secure Development ](https://checkmarx.com/blog/from-lines-of-code-to-cloud-security-navigating-the-future-of-secure-development.md)
- [From Zero to AppSec Anti-Hero: How AI Brings More Security Issues Than It Fixes](https://checkmarx.com/blog/from-zero-to-appsec-anti-hero-how-ai-brings-more-security-issues-than-it-fixes.md)
- [Future of DAST: Why AI-Generated Code Demands a New Strategy ](https://checkmarx.com/blog/future-of-dast-why-ai-generated-code-demands-a-new-strategy.md)
- [GenAI Software Supply Chain Security Gap: Why Traditional AppSec Can’t Keep Up](https://checkmarx.com/blog/genai-software-supply-chain-security-gap-why-traditional-appsec-cant-keep-up.md)
- [Gene Kim on Vibe Coding—and Why DevSecOps Must Be Ready for What’s Coming ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/gene-kim-on-vibe-coding-and-why-devsecops-must-be-ready-for-whats-coming.md)
- [Getting to DevSecOps: How to Change Culture ](https://checkmarx.com/blog/getting-to-devsecops-how-to-change-culture.md)
- [GitHub RepoJacking Weakness Exploited in the Wild by Attackers](https://checkmarx.com/blog/github-repojacking-weakness-exploited-in-the-wild-by-attackers.md)
- [Goodbye SDLC, Hello ADLC: How Will AppSec Adapt? ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/goodbye-sdlc-hello-adlc-how-will-appsec-adapt.md)
- [Guardrails for Agentic Development](https://checkmarx.com/blog/guardrails-for-agentic-development.md): Securing AI-generated code at machine speed without slowing the business.
- [How 140k NuGet, NPM, and PyPi Packages Were Used to Spread Phishing Links](https://checkmarx.com/blog/how-140k-nuget-npm-and-pypi-packages-were-used-to-spread-phishing-links.md)
- [How Checkmarx Defends Against the Shai-Hulud Second Coming Malicious Package Campaign](https://checkmarx.com/blog/how-checkmarx-defends-against-the-shai-hulud-second-coming-malicious-package-campaign.md)
- [How NPM Packages Were Used to Spread Phishing Links](https://checkmarx.com/blog/how-npm-packages-were-used-to-spread-phishing-links.md)
- [How to Prevent Secrets from Leaking out of your Dev Pipeline ](https://checkmarx.com/blog/how-to-prevent-secrets-from-leaking-out-of-your-dev-pipeline.md)
- [How to Use Infrastructure as Code Securely and Avoid Cloud Misconfigurations](https://checkmarx.com/blog/how-to-use-infrastructure-as-code-securely-and-avoid-cloud-misconfigurations.md)
- [How We Created an API Security CTF](https://checkmarx.com/blog/how-we-created-an-api-security-ctf.md)
- [IDC Commentary on AI-Assisted Development is a Wake-Up Call for AppSec Leaders ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/idc-commentary-on-ai-assisted-development-is-a-wake-up-call-for-appsec-leaders.md)
- [IFASEC GmbH](https://checkmarx.com/emea/ifasec-gmbh.md)
- [IndigoCube](https://checkmarx.com/emea/indigocube.md)
- [Injection Vulnerabilities – 20 Years and Counting](https://checkmarx.com/blog/injection-vulnerabilities-20-years-and-counting.md)
- [Integrating Checkmarx Security Results within GitLab](https://checkmarx.com/blog/integrating-checkmarx-security-results-within-gitlab.md)
- [Introducing AI Query Builder for SAST ](https://checkmarx.com/blog/introducing-ai-query-builder-for-sast.md)
- [Introducing AI Security Champion with Auto-remediation for SAST](https://checkmarx.com/blog/introducing-ai-security-champion-with-auto-remediation-for-sast.md)
- [Introducing AI-guided Remediation for IaC Security / KICS ](https://checkmarx.com/blog/introducing-ai-guided-remediation-for-iac-security-kics.md)
- [Introducing Checkmarx API Security](https://checkmarx.com/blog/introducing-checkmarx-api-security.md)
- [Introducing Real Time IDE Scanning – More Secure Code in Real Time](https://checkmarx.com/blog/introducing-real-time-ide-scanning-more-secure-code-in-real-time.md)
- [Introducing the Checkmarx Docker Desktop Extension](https://checkmarx.com/blog/introducing-the-checkmarx-docker-desktop-extension.md)
- [Introducing the Checkmarx One Query Editor](https://checkmarx.com/blog/introducing-the-checkmarx-one-query-editor.md)
- [Introducing the Future of Cloud-Native Security](https://checkmarx.com/blog/introducing-the-future-of-cloud-native-security.md)
- [It’s Here: The Global Pulse on Application Security Report](https://checkmarx.com/blog/its-here-the-global-pulse-on-application-security-report.md)
- [ITD Group](https://checkmarx.com/emea/itd-group.md)
- [Ixel-International SAS](https://checkmarx.com/emea/ixel-international-sas.md)
- [Joining Forces with ZAP to Enhance DAST](https://checkmarx.com/blog/expanding-checkmarx-dast-capabilities-with-zap.md)
- [Juno Media GmbH](https://checkmarx.com/emea/juno-media-gmbh.md)
- [Just Launched: Checkmarx AI Security](https://checkmarx.com/blog/just-launched-checkmarx-ai-security.md): Checkmarx AI Security Description: AI is transforming app development and AppSec teams need the right tools to keep up. See how Checkmarx's AI tools integrate directly into your AppSec.
- [Just Launched: The Future of Application Security in the Era of AI – 2027 Industry Outlook ](https://checkmarx.com/blog/just-launched-the-future-of-application-security-in-the-era-of-ai-2027-industry-outlook.md)
- [Just Released: “The Future of AppSec in the Era of AI” 2026 Industry Outlook](https://checkmarx.com/blog/ai-llm-tools-in-application-security/just-released-the-future-of-appsec-in-the-era-of-ai-2026-industry-outlook.md)
- [Key Considerations for Building a Proper AppSec Program for Modern Application Development](https://checkmarx.com/blog/key-considerations-for-building-a-proper-appsec-program-for-modern-application-development.md)
- [KICS – From IaC Security to Cloud Security Posture and Drift Control](https://checkmarx.com/blog/kics-from-iac-security-to-cloud-security-posture-and-drift-control.md)
- [KICS – How We Made It](https://checkmarx.com/blog/kics-how-we-made-it.md)
- [KICS: First Open-Source Project to Achieve CIS Level 2 Certification](https://checkmarx.com/blog/kics-first-open-source-project-to-achieve-cis-level-2-certification.md)
- [Kotlin Guide: Why We Need Mobile Application Secure Coding Practices](https://checkmarx.com/blog/kotlin-guide-mobile-app-secure-coding-practices.md)
- [KPIs in QA and AppSec – You Call it Bug, We Call it Vulnerability](https://checkmarx.com/blog/kpis-in-qa-and-appsec-you-call-it-bug-we-call-it-vulnerability.md)
- [Large Scale Campaign Created Fake GitHub Projects Clones with Fake Commit Added Malware](https://checkmarx.com/blog/large-scale-campaign-created-fake-github-projects-clones-with-fake-commit-added-malware.md)
- [Leading the Shift to a Continuous Agentic AppSec: Checkmarx Acquires Tromzo](https://checkmarx.com/blog/leading-the-shift-to-a-continuous-agentic-appsec-checkmarx-acquires-tromzo.md)
- [Learn How You Can Get a Running Start with DevSecOps](https://checkmarx.com/blog/running-start-devsecops.md)
- [Learnings From Checkmarx Agentic AppSec Unleashed ‘26](https://checkmarx.com/blog/learnings-from-checkmarx-agentic-appsec-unleashed-26.md): Deterministic Meets Frontier: The New Blueprint for AppSec
- [Level Up Your Container Security](https://checkmarx.com/blog/level-up-your-container-security.md)
- [LofyGang – Software Supply Chain Attackers; Organized, Persistent, and Operating for Over a Year](https://checkmarx.com/blog/lofygang-software-supply-chain-attackers-organized-persistent-and-operating-for-over-a-year.md)
- [Magix Security](https://checkmarx.com/emea/magix-security.md)
- [Make Better Decisions with Checkmarx One](https://checkmarx.com/blog/make-better-decisions-with-checkmarx-one.md)
- [Malicious Open-Source Packages: The Imminent AppSec Threat for which Most Enterprises are Underprepared](https://checkmarx.com/blog/malicious-open-source-packages-the-imminent-appsec-threat-for-which-most-enterprises-are-underprepared.md)
- [Malicious PyPi User Strikes Again with Typosquatting, StarJacking and Unpacks Tailor-made Malware written in C#](https://checkmarx.com/blog/malicious-pypi-user-strikes-again-with-typosquatting-starjacking-and-unpacks-tailor-made-malware-written-in-c.md)
- [Manual triage is where backlogs are born. Checkmarx Triage & Remediation Assist is how they’re cleared. ](https://checkmarx.com/inside-checkmarx-triage-remediation-assist.md)
- [Modernizing AppSec: The Shift from On-Prem SAST to a Cloud-Native Platform ](https://checkmarx.com/blog/modernizing-appsec-the-shift-from-on-prem-sast-to-a-cloud-native-platform.md)
- [Most Dangerous CWEs of 2021](https://checkmarx.com/blog/most-dangerous-cwes-of-2021.md)
- [Move Over Verbose Error Messages, GraphQL APIs are Here](https://checkmarx.com/blog/move-over-verbose-error-messages-graphql-apis-are-here.md)
- [MTP](https://checkmarx.com/emea/mtp.md)
- [Multi-Agent Networks in AppSec: The Future of Collaborative, Autonomous Security ](https://checkmarx.com/blog/multi-agent-networks-in-appsec-the-future-of-collaborative-autonomous-security.md)
- [National Cybersecurity Strategy – GAME ON!](https://checkmarx.com/blog/national-cybersecurity-strategy-game-on.md)
- [Navigating the Microservices Maze: Understanding the Pros and Cons of Microservices Architectures](https://checkmarx.com/blog/navigating-the-microservices-maze-understanding-the-pros-and-cons-of-microservices-architectures.md)
- [New Technique Used by Attackers in NPM to Avoid Detection](https://checkmarx.com/blog/new-technique-used-by-attackers-in-npm-to-avoid-detection.md)
- [NFC False Tag Vulnerability – CVE-2019-9295](https://checkmarx.com/blog/nfc-false-tag-vulnerability.md)
- [On the Road to DevSecOps: Security and Privacy Controls per NIST SP 800-53](https://checkmarx.com/blog/security-and-privacy-controls-per-nist-sp-800-53.md)
- [On the Road to DevSecOps: Top Three Benefits of CxFlow](https://checkmarx.com/blog/top-three-benefits-of-cxflow.md)
- [Open-Source Licenses – Everything You Need to Know](https://checkmarx.com/blog/open-source-licenses-everything-you-need-to-know.md)
- [Open-Source Licenses – Insights and Metrics](https://checkmarx.com/blog/open-source-licenses-insights-and-metrics.md)
- [Open-Source Licenses – Understanding the Risk Factors](https://checkmarx.com/blog/open-source-licenses-understanding-the-risk-factors.md)
- [Open-Source Software Supply Chain Risks and Attack Vectors: How Checkmarx Can Help](https://checkmarx.com/blog/open-source-software-supply-chain-risks-and-attack-vectors-how-checkmarx-can-help.md)
- [Open-Source vs Commercial AppSec Tools: Considerations for Enterprise](https://checkmarx.com/blog/open-source-vs-commercial-appsec-tools-considerations-for-enterprise.md)
- [OpenAI Allowed “Unlimited” Credit on New Accounts ](https://checkmarx.com/blog/openai-allowed-unlimited-credit-on-new-accounts.md)
- [Openminded](https://checkmarx.com/emea/openminded.md)
- [OpenSSL CVE-2022-3786: Food for Thought on the Importance of Security Scanning ](https://checkmarx.com/blog/openssl-cve-2022-3786-food-for-thought-on-the-importance-of-security-scanning.md)
- [Orange Cyberdefense](https://checkmarx.com/emea/orange-cyberdefense.md)
- [Our Response to NPM Account Takeover Attacks – ChainAlert, a Community-Backed Open-Source Tool](https://checkmarx.com/blog/our-response-to-npm-account-takeover-attacks-chainalert-a-community-backed-open-source-tool.md)
- [Our vision: Securing the entire software supply chain](https://checkmarx.com/blog/our-vision-securing-the-entire-software-supply-chain.md)
- [Performanta Group](https://checkmarx.com/emea/performanta.md)
- [Performetriks](https://checkmarx.com/emea/performetriks.md)
- [Pre-Commit or Pay Later: The New Cost of AI-Era AppSec ](https://checkmarx.com/blog/pre-commit-or-pay-later-the-new-cost-of-ai-era-appsec.md)
- [Preparing for Europe’s Most Extensive Cybersecurity Directive, NIS2 – What AppSec teams need to know](https://checkmarx.com/blog/preparing-for-europes-most-extensive-cybersecurity-directive-nis2-what-appsec-teams-need-to-know.md)
- [Presets, Queries, & Onboarding: The Checkmarx One Difference](https://checkmarx.com/blog/presets-queries-onboarding-the-checkmarx-one-difference.md)
- [Puleng Technologies](https://checkmarx.com/emea/puleng-technologies.md)
- [ReDoS – Regular Expression Denial of Service](https://checkmarx.com/blog/redos-regular-expression-denial-of-service.md)
- [Reducing Friction in AppSec Program Adoption: How Checkmarx One Can Help ](https://checkmarx.com/blog/reducing-friction-in-appsec-program-adoption-how-checkmarx-one-can-help.md)
- [Reducing Noise With Contextual Risk Scoring: Why Critical Doesn’t Always Mean Urgent ](https://checkmarx.com/blog/reducing-noise-with-contextual-risk-scoring.md)
- [Regional Sales Manager- Germany (202)](https://checkmarx.com/blog/regional-sales-manager-germany-202.md)
- [Repository Health Monitoring Part 1: A Cornerstone of Software Supply Chain Security ](https://checkmarx.com/blog/supply-chain-security/repository-health-monitoring-part-1-a-cornerstone-of-software-supply-chain-security.md)
- [Repository Health Monitoring Part 2: Essential Practices for Secure Repositories ](https://checkmarx.com/blog/supply-chain-security/repository-health-monitoring-part-2-essential-practices-for-secure-repositories.md)
- [Revolutionizing SCA With Agentic AI: How Checkmarx Developer Assist Transforms Open-Source Security Within the IDE ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/revolutionizing-sca-with-agentic-ai-how-checkmarx-developer-assist-transforms-open-source-security-within-the-ide.md)
- [Risk, Return, and Remediation: An Investment Strategy for Application Security](https://checkmarx.com/blog/investment-strategy-application-security.md): Learn why a hybrid application security strategy combining deterministic tools and AI delivers better protection, lower costs, and faster remediation for AI-generated code.
- [RSAC 2026 Marked a Turning Point for AppSec. The Reason – Agentic Security ](https://checkmarx.com/blog/rsac-2026-marked-a-turning-point-for-appsec-the-reason-agentic-security.md)
- [Rumors of the Developer’s Demise Have Been Greatly Exaggerated: A Perspective From Simon Bennetts, Software Engineering Expert at Checkmarx  ](https://checkmarx.com/blog/rumors-of-the-developers-demise-have-been-greatly-exaggerated-a-perspective-from-simon-bennetts-software-engineering-expert-at-checkmarx.md)
- [Safe Refactor: The Faster, Safer Way To Upgrade Vulnerable Packages](https://checkmarx.com/blog/safe-refactor-the-faster-safer-way-to-upgrade-vulnerable-packages.md)
- [SBOM and the Bill that is Coming](https://checkmarx.com/blog/sbom-and-the-bill-that-is-coming.md)
- [SBOM: How to Create One Using Checkmarx SCA](https://checkmarx.com/blog/sbom-how-to-create-one-using-checkmarx-sca.md)
- [SBOM: What It Is and Why You Should Care](https://checkmarx.com/blog/sbom-what-it-is-and-why-you-should-care.md)
- [SCA – Behind the Curtains](https://checkmarx.com/blog/sca-behind-the-curtains.md)
- [Secodis](https://checkmarx.com/emea/secodis.md)
- [Secon Cyber](https://checkmarx.com/emea/secon-cyber.md)
- [Secret Sprawl: The Silent Threat to Enterprise Security](https://checkmarx.com/blog/secret-sprawl-the-silent-threat-to-enterprise-security.md)
- [Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone ](https://checkmarx.com/blog/secrets-secrets-are-no-fun-secrets-secrets-stored-in-plain-text-files-hurt-someone-2.md)
- [Securing Code No One Actually Wrote](https://checkmarx.com/blog/ai-llm-tools-in-application-security/securing-code-no-one-actually-wrote-2.md): If you don’t secure AI-generated code at the moment it's created, you've already missed the most effective opportunity to secure it. 
- [Securing Open-Source Solutions: A Study of osTicket Vulnerabilities](https://checkmarx.com/blog/securing-open-source-solutions-a-study-of-osticket-vulnerabilities.md)
- [Securing the AI Development Lifecycle: From Code Generation to Deployment](https://checkmarx.com/blog/securing-the-ai-development-lifecycle-from-code-generation-to-deployment.md)
- [Securing Your AI Supply Chain: Your AI Is Running, But You Don’t Know What It’s Doing ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/securing-your-ai-supply-chain-your-ai-is-running-but-you-dont-know-what-its-doing.md)
- [Security & Quality Software GmbH](https://checkmarx.com/emea/security-quality-software-gmbh.md)
- [Severity Is Not a Strategy: What CISA BOD 26-04 Means for the Future of Federal Software Security](https://checkmarx.com/blog/severity-is-not-a-strategy-what-cisa-bod-26-04-means-for-the-future-of-federal-software-security.md)
- [Shift EVERYWHERE With Checkmarx One and DAST ](https://checkmarx.com/blog/shift-everywhere-with-checkmarx-one-and-dast.md)
- [Shifting AppSec to the Left Improves Security and Developer Productivity](https://checkmarx.com/blog/how-realtime-appsec-improves-developer-productivity.md)
- [Shifting Left Is No Longer Enough: It’s Time to Shift Everywhere](https://checkmarx.com/blog/shifting-left-no-longer-enough-time-to-shift-everywhere.md)
- [Soflab Technology](https://checkmarx.com/emea/soflab-technology.md)
- [Software Supply Chain Security Leaders Collaborate and Build Browser Extension to Help Developers Choose Open-Source](https://checkmarx.com/blog/software-supply-chain-security-leaders-collaborate-and-build-browser-extension-to-help-developers-choose-open-source.md)
- [Some Vulnerabilities Don’t Have a Name](https://checkmarx.com/blog/some-vulnerabilities-dont-have-a-name.md)
- [Something’s Wrong With Your Code. And Attackers Know It.](https://checkmarx.com/blog/somethings-wrong-with-your-code-and-attackers-know-it.md): Checkmarx CEO Sandeep Johri shares insights from a recent conversation with the New York Stock Exchange (NYSE) on how AI is reshaping modern codebases.
- [Sopra Steria](https://checkmarx.com/emea/sopra-steria.md)
- [Spring Function Cloud DoS (CVE-2022-22979) and Unintended Function Invocation](https://checkmarx.com/blog/spring-function-cloud-dos-cve-2022-22979-and-unintended-function-invocation.md)
- [Static Analysis of Infrastructure as Code with Codefresh and Checkmarx](https://checkmarx.com/blog/static-analysis-of-infrastructure-as-code-with-codefresh-and-checkmarx.md)
- [Stop Chasing Vulnerabilities – Let Agentic AI Prevent Them](https://checkmarx.com/blog/agentic-ai-vulnerability-prevention.md)
- [Stop Manual Triaging, Start Agentic Fixing](https://checkmarx.com/blog/stop-manual-triaging-start-agentic-fixing.md): Why execution, not detection, is now the defining AppSec challenge.
- [SwissConomy AG](https://checkmarx.com/emea/swissconomy-ag.md)
- [TCSS](https://checkmarx.com/emea/tcss.md)
- [Teleion](https://checkmarx.com/emea/teleion.md)
- [The $5 Hack That Shook the Tech World ](https://checkmarx.com/blog/the-5-hack-that-shook-the-tech-world.md)
- [The 5 Key Benefits of Source Code Analysis](https://checkmarx.com/blog/the-5-key-benefits-of-source-code-analysis.md)
- [The Agentic Future of AppSec: Measuring Impact and Securing the AI-Powered SDLC](https://checkmarx.com/blog/the-agentic-future-of-appsec-measuring-impact-and-securing-the-ai-powered-sdlc.md)
- [The AI Inventory Gap: Why Your Organization Has No Idea What AI Assets Are Part of Your Software Supply Chain](https://checkmarx.com/blog/ai-llm-tools-in-application-security/the-ai-inventory-gap-why-your-organization-has-no-idea-what-ai-assets-are-part-of-your-software-supply-chain.md)
- [The AppSec How To: Application Security in Continuous Integration](https://checkmarx.com/blog/the-appsec-how-to-application-security-in-continuous-integration.md)
- [The AppSec How-To: JavaScript Security Implications](https://checkmarx.com/blog/the-appsec-how-to-javascript-security-implications.md)
- [The AppSec Manager’s Guide to Understanding the Hidden Threats of Malicious Code in Open-Source Software](https://checkmarx.com/blog/the-appsec-managers-guide-to-understanding-the-hidden-threats-of-malicious-code-in-open-source-software.md)
- [The Buzz Around Developer Experience: Unlocking the Potential of Superior DevEx with Codebashing 2.0](https://checkmarx.com/blog/the-buzz-around-developer-experience-unlocking-the-potential-of-superior-devex-with-codebashing-2-0.md)
- [The Contextual Blind Spot: Why AppSec Keeps Striking Out in the Cloud and How CISOs Can Fix It ](https://checkmarx.com/blog/the-contextual-blind-spot-why-appsec-keeps-striking-out-in-the-cloud-and-how-cisos-can-fix-it.md)
- [The Cost of AI Velocity: 5 Actions Dev Leaders Must Take to Secure Their Codebase From AI Vulnerabilities](https://checkmarx.com/blog/the-cost-of-ai-velocity-5-actions-dev-leaders-must-take-to-secure-their-codebase-from-ai-vulnerabilities.md): AI-powered coding tools accelerate development but introduce alarming vulnerability rates. This blog reveals the 5 essential actions dev leaders must take to safeguard codebases against AI-driven security risks.
- [The Current State of AppSec: A Notable Survey to Share](https://checkmarx.com/blog/the-current-state-of-appsec-a-notable-survey-to-share.md)
- [The Dangers of Exposed Secrets – and How to Prevent Them ](https://checkmarx.com/blog/exposed-secrets-and-how-to-prevent-them.md): Modern enterprise software relies on authentication tokens, API keys, encryption keys, certificates, and other sensitive credentials to enable secure communication between applications, microservices, APIs, and DevOps pipelines. However, these secrets often end up hardcoded in source code during the development process, whether unintentionally or as a shortcut for quick development (because hardcoding access credentials is simply the fastest and easiest way to write and test code). 
- [The Executive Guide to Quantifying Agentic AppSec ROI, From IDE Metrics to Board-Ready Numbers](https://checkmarx.com/blog/the-executive-guide-to-quantifying-agentic-appsec-roi.md)
- [The Fast and the Frictionless: Tuning AppSec to Boost Your DORA Metrics ](https://checkmarx.com/blog/tuning-appsec-to-boost-your-dora-metrics.md)
- [The Future of AI in DevSecOps: Advanced and Automated Security](https://checkmarx.com/blog/the-future-of-ai-in-devsecops-advanced-and-automated-security.md)
- [The Future of AppSec: Insights from Development & Security Professionals](https://checkmarx.com/blog/the-future-of-appsec-insights-from-development-and-security-professionals.md)
- [The Future of DAST](https://checkmarx.com/blog/the-future-of-dast.md)
- [The Global Codebashing AppSec Training Initiative by Checkmarx and OWASP](https://checkmarx.com/blog/the-global-codebashing-appsec-training-initiative-by-checkmarx-and-owasp.md)
- [The MITRE CVE Program Funding Situation: Response From Checkmarx](https://checkmarx.com/blog/the-mitre-cve-program-funding-situation-response-from-checkmarx.md)
- [The Next Model Won’t Fix This: Three AppSec Imperatives From Black Hat USA 2026](https://checkmarx.com/blog/four-appsec-imperatives-from-black-hat-usa-2026.md)
- [The Open-Source Supply Chain Under Assault – New Defenses Are Required](https://checkmarx.com/blog/the-open-source-supply-chain-under-assault-new-defenses-are-required.md)
- [The Productivity–Security Paradox of AI Coding Assistants ](https://checkmarx.com/blog/ai-llm-tools-in-application-security/the-productivity-security-paradox-of-ai-coding-assistants.md)
- [The Regulators Already Assume You Have an AI Inventory. Do You? ](https://checkmarx.com/blog/the-regulators-already-assume-you-have-an-ai-inventory-do-you.md)
- [The Rhythm of Revolution: AI’s Role in the Next Tech Tipping Point  ](https://checkmarx.com/blog/the-rhythm-of-revolution-ais-role-in-the-next-tech-tipping-point.md)
- [The Risks of LLM Poisoning in AI-Powered Development and How to Mitigate Them](https://checkmarx.com/blog/ai-llm-tools-in-application-security/the-risks-of-llm-poisoning-in-ai-powered-development-and-how-to-mitigate-them.md)
- [The ROI of Agentic AI AppSec](https://checkmarx.com/blog/the-roi-of-agentic-ai-appsec.md)
- [The ROI of SCA: Reducing Technical Debt and Enhancing Security](https://checkmarx.com/blog/the-roi-of-sca-reducing-technical-debt-and-enhancing-security.md)
- [The Role of Security Tools in Platform Engineering: Enhancing Security in the New DevOps Era](https://checkmarx.com/blog/the-role-of-security-tools-in-platform-engineering-enhancing-security-in-the-new-devops-era.md)
- [The Security State of WordPress’ Top 50 Plugins](https://checkmarx.com/blog/the-security-state-of-wordpress-top-50-plugins.md)
- [The Trinity of Architects: How to Ensure Enterprise Grade Application Security](https://checkmarx.com/blog/the-trinity-of-architects.md)
- [The truth behind zombie and shadow APIs](https://checkmarx.com/blog/the-truth-behind-zombie-and-shadow-apis.md)
- [The Vibe Coding Hangover](https://checkmarx.com/blog/the-vibe-coding-hangover.md): What Gartner® reveals about the security gaps behind AI-driven development.
- [There Is No Patch Tuesday on the Blockchain: Why Solidity Developers Need Fusion-Grade AppSec Before They Deploy ](https://checkmarx.com/blog/there-is-no-patch-tuesday-on-the-blockchain-why-solidity-developers-need-fusion-grade-appsec-before-they-deploy.md)
- [Top 5 IaC Misconfigurations You Should Avoid](https://checkmarx.com/blog/top-5-iac-misconfigurations-you-should-avoid.md)
- [Top Considerations for API Security](https://checkmarx.com/blog/top-considerations-for-api-security.md)
- [TR Consult Ltd](https://checkmarx.com/emea/tr-consult-ltd.md)
- [Transforming Security + DevOps into DevSecOps](https://checkmarx.com/blog/transforming-security-devops-into-devsecops.md)
- [Trojan Source Vulnerability: Get Protection with Checkmarx SAST](https://checkmarx.com/blog/trojan-source-vulnerability-get-protection-with-checkmarx-sast.md)
- [Two Fronts, One Risk: Securing Yesterday’s Debt and Today’s AI Code  ](https://checkmarx.com/blog/two-fronts-one-risk-securing-yesterdays-debt-and-todays-ai-code.md)
- [Typosquatting Campaign Targeting Python’s Top Packages, Dropping GitHub Hosted Malware with DGA Capabilities](https://checkmarx.com/blog/typosquatting-campaign-targeting-pythons-top-packages-dropping-github-hosted-malware-with-dga-capabilities.md)
- [Understanding EPSS Score](https://checkmarx.com/blog/understanding-epss.md)
- [Understanding the Development Best Practices Landscape for Modern Secure Application Development](https://checkmarx.com/blog/understanding-the-development-best-practices-landscape-for-modern-secure-application-development.md)
- [Unifying SAST and DAST: The Key to Fostering Fearless Innovation](https://checkmarx.com/blog/unifying-sast-and-dast-the-key-to-fostering-fearless-innovation.md)
- [Unifying the Cyber Risk Lifecycle with Checkmarx One and Brinqa   ](https://checkmarx.com/blog/unifying-the-cyber-risk-lifecycle-with-checkmarx-one-and-brinqa.md)
- [Unveiling the Power of Cloud Insights](https://checkmarx.com/blog/unveiling-the-power-of-cloud-insights.md)
- [Unverified Commits: Are You Unknowingly Trusting Attackers’ Code?](https://checkmarx.com/blog/unverified-commits-are-you-unknowingly-trusting-attackers-code.md)
- [Update: Ongoing Checkmarx Supply Chain Security Incident](https://checkmarx.com/blog/ongoing-security-updates.md)
- [Vibe Coding Security: Risks, Vulnerabilities, and How to Secure AI-Generated Code](https://checkmarx.com/blog/security-in-vibe-coding.md): Vibe coding security risks are not theoretical. When AI generates code without strong guardrails, teams can inherit the same classes of issues security teams already know well, only faster and at greater scale.
- [VOQUZ IT](https://checkmarx.com/emea/voquz-it.md)
- [We Now Build Code Faster Than We Can Understand It: The New Risk of AI Speed](https://checkmarx.com/application-security-trends/the-new-risk-of-ai-speed.md): AI is generating code faster than teams can review it. Learn how hybrid SAST and Checkmarx Fusion help detect AI-era software security risks.
- [What Are the Challenges with Securing APIs?](https://checkmarx.com/blog/what-are-the-challenges-with-securing-apis.md)
- [What CEOs Need to do to be NIST 800-218 SSDF Ready](https://checkmarx.com/blog/what-ceos-need-to-do-to-be-nist-800-218-ssdf-ready.md)
- [What Is ACSA? Defining AI Code Security Assistance for the Enterprise ](https://checkmarx.com/blog/what-is-acsa-defining-ai-code-security-assistance-for-the-enterprise.md)
- [What is ASPM and Why Do You Need It in Your Cyber Toolkit?](https://checkmarx.com/blog/what-is-aspm-and-why-do-you-need-it-in-your-cyber-toolkit.md)
- [What Is Checkmarx Fusion?](https://checkmarx.com/blog/what-is-checkmarx-fusion.md): Now available in Early Access for SAST within Checkmarx One, Checkmarx Fusion adds a new detection layer that advances vulnerability-finding accuracy beyond what rules-based scanning or an AI model can achieve alone.
- [What Is Your API Attack Surface?](https://checkmarx.com/blog/what-is-your-api-attack-surface.md)
- [What types of reports can Checkmarx provide?](https://checkmarx.com/faq/what-major-android-browser-flaw-allowing-hackers-to-bypass-sop.md)
- [What You Need To Know About NIST 800-218: The Secure Software Development Framework](https://checkmarx.com/blog/what-you-need-to-know-about-nist-800-218-the-secure-software-development-framework.md)
- [What, How, and Where Open-Source Gets Pulled into a Codebase](https://checkmarx.com/blog/what-how-and-where-open-source-gets-pulled-into-a-codebase.md)
- [What’s ‘Boardish’ and Why You Should Learn to Speak It Fluently](https://checkmarx.com/blog/whats-boardish-and-why-you-should-learn-to-speak-it-fluently.md)
- [What’s New in Checkmarx One 3.0](https://checkmarx.com/blog/whats-new-in-checkmarx-one-3-0.md)
- [What’s New in Checkmarx’ April 2023 Platform Launch ](https://checkmarx.com/blog/whats-new-in-checkmarx-april-2023-platform-launch.md)
- [What’s Old Becomes New Again: CSRF Attacks on GraphQL APIs](https://checkmarx.com/blog/whats-old-becomes-new-again-csrf-attacks-on-graphql-apis.md)
- [When Findings Spark Debate Instead of Fixes: Aligning AppSec and Development](https://checkmarx.com/blog/when-findings-spark-debate-instead-of-fixes-aligning-appsec-and-development.md): When security findings lack context, developers lose time investigating instead of fixing. Here’s how AI-driven triage changes the workflow.
- [When It Comes to Cloud, Location Matters](https://checkmarx.com/blog/when-it-comes-to-cloud-location-matters.md)
- [When the AI Lies: A New Threat Emerges for “Human-in-the-Loop” Security  ](https://checkmarx.com/blog/when-the-ai-lies-a-new-threat-emerges-for-human-in-the-loop-security.md)
- [Why an AI Code Generator Can’t Secure Its Own Code. And Why Checkmarx Assist Can.](https://checkmarx.com/blog/why-ai-code-generators-cant-secure-its-own-code-and-why-checkmarx-assist-can.md)
- [Why Checkmarx Leads the ASPM Market: A Deep Dive into the Frost & Sullivan 2024 Report](https://checkmarx.com/blog/why-checkmarx-leads-aspm-market-frost-sullivan-2024-report.md)
- [Why CNAPPs Are Not Enough  ](https://checkmarx.com/blog/why-cnapps-are-not-enough.md)
- [Why Context Is the New Code: Building AI-Resilient AppSec From the IDE](https://checkmarx.com/blog/why-context-is-the-new-code-building-ai-resilient-appsec-from-the-ide.md)
- [Why Vulnerability Detection Doesn’t Scale  ](https://checkmarx.com/blog/why-vulnerability-detection-doesnt-scale.md): The execution gap that is quietly breaking modern AppSec programs.
- [Why You Need an Accurate “Parts List” for Your Software](https://checkmarx.com/blog/why-you-need-an-accurate-parts-list-for-your-software.md)
- [Windsurf Makes Coding Faster. Developer Assist Makes It Safer.](https://checkmarx.com/blog/windsurf-makes-coding-faster-developer-assist-makes-it-safer.md): AI-native editors are changing how developers work.
- [WiniGroup](https://checkmarx.com/blog/winigroup.md)
- [You Better Get Going with Go](https://checkmarx.com/blog/you-better-get-going-with-go.md)
- [You Can Have It All: Speed & Security – Introducing Our New SAST Engine](https://checkmarx.com/blog/you-can-have-it-all-speed-security-introducing-our-new-sast-engine.md)
- [You’re Securing Your Code. But Are You Securing the AI Inside It? ](https://checkmarx.com/blog/youre-securing-your-code-but-are-you-securing-the-ai-inside-it.md)
- [Your New Teammate Doesn’t Eat Pizza ](https://checkmarx.com/blog/your-new-teammate-doesnt-eat-pizza.md)
- [Your SBOM Won’t Save You From AI Audits](https://checkmarx.com/blog/your-sbom-wont-save-you-from-ai-audits.md): Your SBOM can track packages, but not the AI shaping application behavior. Here’s why AI-BOMs are emerging as the missing layer in software supply chain security and compliance.
- [Your Scanner’s Accuracy Claims Are Only Half the Story](https://checkmarx.com/blog/your-scanners-accuracy-claims-are-only-half-the-story.md)
- [Your Smart Scale is Leaking More than Your Weight: Privacy Issues in IoT](https://checkmarx.com/blog/smart-scale-privacy-issues-iot.md)
- [Zombie CVEs: Put to Rest by Humans, Dug Back Up by AI Agents ](https://checkmarx.com/blog/zombie-cves-put-to-rest-by-humans-dug-back-up-by-ai-agents.md)

## Zero Posts

- [“Free Hugs” – What To Be Wary of in Hugging Face – Part 1 ](https://checkmarx.com/blog/free-hugs-what-to-be-wary-of-in-hugging-face-part-1.md)
- [“Free Hugs” – What to be Wary of in Hugging Face – Part 2 ](https://checkmarx.com/blog/free-hugs-what-to-be-wary-of-in-hugging-face-part-2.md)
- [“Free Hugs” – What to be Wary of in Hugging Face – Part 3 ](https://checkmarx.com/blog/free-hugs-what-to-be-wary-of-in-hugging-face-part-3.md)
- [“Free Hugs” – What to be Wary of in Hugging Face – Part 4 ](https://checkmarx.com/blog/free-hugs-what-to-be-wary-of-in-hugging-face-part-4.md)
- [“Old Father Eternity”: Shai-Hulud Worm Strikes a 6th Time – keyv/cacheable npm Supply Chain Attack](https://checkmarx.com/zero-post/shai-hulud-npm-supply-chain-attack-keyv-cacheable.md): A new Shai-Hulud npm supply chain attack has compromised popular packages including Keyv and Cacheable, stealing credentials, spreading across thousands of dependencies, and infecting GitHub repositories. Learn the affected packages, IoCs, and remediation steps.
- [11 Emerging AI Security Risks with MCP (Model Context Protocol)](https://checkmarx.com/zero-post/11-emerging-ai-security-risks-with-mcp-model-context-protocol.md): Model Context Protocol (MCP)—rapidly becoming the connective tissue of agentic AI—introduces an attack surface far larger than most teams realize. From poisoned data and schema manipulation to cross-agent context abuse, the research outlines eleven emerging risks that are poised to reshape agentic AI security.
- [2025 Was Quietly Good for Application Security](https://checkmarx.com/zero-post/2025-was-quietly-good-for-application-security.md): A grounded look at why 2025 was quietly good for developers and AppSec practitioners—real ecosystem changes, safer defaults, and community shifts that reduced risk without slowing teams down.
- [A Beautiful Factory for Malicious Packages](https://checkmarx.com/blog/a-beautiful-factory-for-malicious-packages.md)
- [A Deep Dive into 70 Layers of Obfuscated Info-Stealer Malware](https://checkmarx.com/blog/a-deep-dive-into-70-layers-of-obfuscated-info-stealer-malware.md)
- [A New Type of Supply Chain Attack Could Put Popular Admin Tools at Risk](https://checkmarx.com/blog/a-new-type-of-supply-chain-attack-could-put-popular-admin-tools-at-risk.md)
- [AI fights and more attacks on dev infrastructure: Last Week in AppSec for 4. March 2026](https://checkmarx.com/zero-post/ai-fights-and-more-attacks-on-dev-infrastructure-last-week-in-appsec-for-4-march-2026.md): Last week: an “AI bot” abusing GitHub Actions to run code and steal tokens, agent takeover paths from a single browser visit, and fresh reminders that npm packages and WordPress plugins can still become execution paths.
- [AI Model Confusion: An LLM/AI Model Supply Chain Attack](https://checkmarx.com/zero-post/hugs-from-strangers-ai-model-confusion-supply-chain-attack.md): Checkmarx Zero research reveals the AI Model Confusion attack pattern against registries like Hugging Face, building on Dependency Confusion in OSS library registry. Learn what it is and how to defend yourself.
- [Alert: CDN Service “polyfill.io” Used by 100K+ Websites Provided Malicious Code in Responses](https://checkmarx.com/blog/alert-cdn-service-polyfill-io-used-by-100k-websites-provided-malicious-code-in-responses.md)
- [All You Need to Know about Spring Framework Vulnerabilities](https://checkmarx.com/blog/all-you-need-to-know-about-spring-framework-vulnerabilities.md)
- [Amazon Confirmed and Fixed a High Severity Vulnerability of Broken Authentication in Amazon Photos Android App](https://checkmarx.com/blog/amazon-confirmed-and-fixed-a-high-severity-vulnerability-of-broken-authentication-in-amazon-photos-android-app.md)
- [Amazon Quickly Fixed a Vulnerability in Ring Android App That Could Expose Users’ Camera Recordings](https://checkmarx.com/blog/amazon-quickly-fixed-a-vulnerability-in-ring-android-app-that-could-expose-users-camera-recordings.md)
- [An Ongoing Open-Source Attack Reveals Roots Dating Back To 2021 ](https://checkmarx.com/blog/an-ongoing-open-source-attack-reveals-roots-dating-back-to-2021.md)
- [APACHE LOG4J RCE – Variants and Updates](https://checkmarx.com/blog/apache-log4j-rce-variants-and-updates.md)
- [Apache Log4j Remote Code Execution – CVE-2021-44228](https://checkmarx.com/blog/apache-log4j-remote-code-execution-cve-2021-44228.md)
- [Apache Unomi CVE-2020-13942: RCE Vulnerabilities Discovered](https://checkmarx.com/blog/apache-unomi-cve-2020-13942-rce-vulnerabilities-discovered.md)
- [API Crash Course: Broken Object Level Authorization Found in Coursera](https://checkmarx.com/blog/api-crash-course-broken-object-level-authorization-found-in-coursera.md)
- [Assistance Required: XSS Vulnerability Discovered in Helpdesk Software Solution Deskpro](https://checkmarx.com/blog/assistance-required-xss-vulnerability-discovered-in-helpdesk-software-solution-deskpro.md)
- [Attacker – hidden in plain sight for nearly six months – targeting Python developers ](https://checkmarx.com/blog/attacker-hidden-in-plain-sight-for-nearly-six-months-targeting-python-developers.md)
- [Attacker Adds Evasive Technique to Their Ongoing Attacks on NPM](https://checkmarx.com/blog/attacker-adds-evasive-technique-to-their-ongoing-attacks-on-npm.md)
- [Attacker Unleashes Stealthy Crypto Mining via Malicious Python Package](https://checkmarx.com/blog/attacker-unleashes-stealthy-crypto-mining-via-malicious-python-package.md)
- [Attackers Write Bugs as Well!](https://checkmarx.com/blog/attackers-write-bugs-as-well.md)
- [Backdoor Discovered in xz: The Most Advanced Supply Chain Attack Known to Date](https://checkmarx.com/blog/backdoor-discovered-in-xz-the-most-advanced-supply-chain-attack-known-to-date.md)
- [Behind the Middleware Curtain — Explaining CVE-2025-29927, A Critical Authorization Bypass in Next.js](https://checkmarx.com/zero-post/critical-cve-2025-29927-research-nextjs-middleware-authorization-bypass.md)
- [Bypassing AI Agent Defenses With Lies-In-The-Loop](https://checkmarx.com/zero-post/bypassing-ai-agent-defenses-with-lies-in-the-loop.md): Lies-in-the-loop is a new attack that bypasses AI agent's "human-in-the-loop" defenses to run malicious code on user machines. Learn what it does and how we uncovered it.
- [Bypassing Claude Code: How Easy Is It to Trick an AI Security Reviewer?](https://checkmarx.com/zero-post/bypassing-claude-code-how-easy-is-it-to-trick-an-ai-security-reviewer.md): AI code assistants are starting to be security reviewers; so how easy is it to trick them? Let's see how Claude Code's new security review handles complexity and misdirection.
- [Chained RaspAP Vulnerabilities Grant Root Level Access](https://checkmarx.com/blog/chained-raspap-vulnerabilities-grant-root-level-access.md)
- [ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey](https://checkmarx.com/zero-post/chainveil-a-malicious-npm-supply-chain-attack-by-successkey.md): A new npm supply chain attack campaign leverages typosquatting and a command-and-control system that's nearly impossible to disable. Learn how the actor "SuccessKey" takes steps to hide from malware detection, resist researcher analysis, and use public blockchains for control. Includes IoCs and methods to find out whether you're at risk.
- [Chalk And 17 Other NPM Packages Compromised In Supply-Chain Attack](https://checkmarx.com/zero-post/chalk-and-17-other-npm-packages-compromised-in-supply-chain-attack.md)
- [Checkmarx Research: A Race Condition in Kubernetes](https://checkmarx.com/blog/checkmarx-research-race-condition-in-kubernetes.md)
- [Checkmarx Research: Apache Dubbo 2.7.3 – Unauthenticated RCE via Deserialization of Untrusted Data (CVE-2019-17564)](https://checkmarx.com/blog/apache-dubbo-unauthenticated-remote-code-execution-vulnerability.md)
- [Checkmarx Research: Smart Vacuum Security Flaws May Leave Users Exposed](https://checkmarx.com/blog/checkmarx-research-smart-vacuum-security-flaws-leave-users-exposed.md)
- [Checkmarx Research: Solidity and Smart Contracts from a Security Standpoint](https://checkmarx.com/blog/checkmarx-research-solidity-and-smart-contracts-from-a-security-standpoint.md)
- [Checkmarx Zero Takes Down Malicious “Prettier” Alternative Found In VSCode Marketplace](https://checkmarx.com/zero-post/checkmarx-zero-takes-down-malicious-prettier-alternative-found-in-vscode-marketplace.md): A malicious VSCode Extension posing as "Prettier Plus" (an apparent attempt to leverage Brandjacking of the legitimate and popular "Prettier") has been taken down by Checkmarx Zero coordinating with Microsoft. Learn how it works, how it evades detection, and what you can do to stay safe.
- [Crypto-Stealing Code Lurking in Python Package Dependencies](https://checkmarx.com/blog/crypto-stealing-code-lurking-in-python-package-dependencies.md)
- [Cryptocurrency Enthusiasts Targeted in Multi-Vector Supply Chain Attack](https://checkmarx.com/blog/cryptocurrency-enthusiasts-targeted-in-multi-vector-supply-chain-attack.md)
- [CTparental Vulnerabilities Enabled Filter Bypassing](https://checkmarx.com/blog/ctparental-vulnerabilities-enabled-filter-bypassing.md)
- [CVE-2021-31800: How We Used Impacket to Hack Itself](https://checkmarx.com/blog/cve-2021-31800-how-we-used-impacket-to-hack-itself.md)
- [CVE-2021-33829: Stored XSS Vulnerability Discovered in CKEditor4 Affects Widely-Used CMS](https://checkmarx.com/blog/cve-2021-33829-stored-xss-vulnerability-discovered-in-ckeditor4-affects-widely-used-cms.md)
- [CVE-2021-37794: XSS to One-Click RCE in FileBrowser](https://checkmarx.com/blog/cve-2021-37794-xss-to-one-click-rce-in-filebrowser.md)
- [CVE-2021-44832 – Apache Log4j 2.17.0 Arbitrary Code Execution via JDBCAppender DataSource Element](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element.md)
- [CVE-2025-27520 Critical RCE In BentoML Has Fewer Affected Versions Than Reported](https://checkmarx.com/zero-post/bentoml-rce-fewer-affected-versions-cve-2025-27520.md)
- [CVE-2026-94545 – ⁠From JSX to SVG Injection  ](https://checkmarx.com/zero-post/cve-2026-94545-from-jsx-to-svg-injection.md)
- [Cybersecurity AI agent is Vulnerable to Command Injection (CVE-2025-67511)](https://checkmarx.com/zero-post/cybersecurity-ai-agent-is-vulnerable-to-command-injection-cve-2025-67511.md): Cybersecurity AI agent for pentesting becomes a threat on its own, allowing attackers to inject malicious SSH hostnames in content to execute shell commands on the agent's host.
- [Dozens of Machines Infected: Year-Long NPM Supply Chain Attack Combines Crypto Mining and Data Theft](https://checkmarx.com/blog/dozens-of-machines-infected-year-long-npm-supply-chain-attack-combines-crypto-mining-and-data-theft.md)
- [Drupal Core: Behind the Vulnerability](https://checkmarx.com/blog/drupal-core-behind-the-vulnerability-part-1-reflected-xss.md)
- [Drupal Core: Behind the Vulnerability](https://checkmarx.com/blog/drupal-core-behind-the-vulnerability-part-2-defacement-stored-xss-and-self-xss.md)
- [EchoLeak (CVE-2025-32711) Show us That AI Security is Challenging ](https://checkmarx.com/zero-post/echoleak-cve-2025-32711-show-us-that-ai-security-is-challenging.md): Lessons from a "zero-click" vulnerability in Microsoft's Copilot AI for Office 365. How it works, how it gets exploited, and what you can do to better defend yourself.
- [Exploiting Markdown Injection in AI agents: Microsoft Copilot Chat and Google Gemini](https://checkmarx.com/zero-post/exploiting-markdown-injection-in-ai-agents-microsoft-copilot-chat-and-google-gemini.md): AI agents provide only very thin defenses against malicious behavior. Popular AI agents such as Microsoft's Copilot Chat and Google Gemini can experience injection from Markdown content they include in their context. Learn how markdown injection in AI agents works and how different products try to mitigate it.
- [Falling Stars](https://checkmarx.com/blog/falling-stars.md)
- [Find and Fix CVE-2025-30066, Compromised GitHub Actions Leading to Credential Leaks](https://checkmarx.com/zero-post/compromised-github-actions-leading-to-credential-leaks.md)
- [First Known Targeted OSS Supply Chain Attacks Against the Banking Sector](https://checkmarx.com/blog/first-known-targeted-oss-supply-chain-attacks-against-the-banking-sector.md)
- [GitHub Repos Used for Distributing Malware](https://checkmarx.com/blog/github-repos-used-for-distributing-malware.md)
- [GlassWorm Targets Developer IDEs Again, Hiding Staged Malware Behind Runtime-Rebuilt Loaders](https://checkmarx.com/zero-post/glassworm-targets-developer-ides-again-hiding-staged-malware-behind-runtime-rebuilt-loaders.md): The GlassWorm malware campaign continues to adapt to defender detection tactics. The latest round of GlassWorm-infected IDE extensions target developers and use novel tactics to evade prior detections. Learn how this new tactic works and how to defend.
- [HAProxy Affected by Low-Severity Supply Chain Vulnerability, Leading To High-Severity Denial of Service (DoS) Risk](https://checkmarx.com/zero-post/haproxy-mjson-supply-chain-dos-vuln.md)
- [Hijacking S3 Buckets: New Attack Technique Exploited in the Wild by Supply Chain Attackers ](https://checkmarx.com/blog/hijacking-s3-buckets-new-attack-technique-exploited-in-the-wild-by-supply-chain-attackers.md)
- [How Attackers Could Hijack Your Android Camera to Spy on You](https://checkmarx.com/blog/how-attackers-could-hijack-your-android-camera.md)
- [How one country is impacting supply chains ](https://checkmarx.com/blog/how-one-country-is-impacting-supply-chains.md)
- [How To Fight the Ongoing Battle Between AI and CAPTCHA](https://checkmarx.com/zero-post/how-to-fight-the-ongoing-battle-between-ai-and-captcha.md): CAPTCHA used to be the best anti-bot game in town, but AI models defeat common ones with ease. Here's what to do about it.
- [How we take down malicious Visual Studio Code extensions](https://checkmarx.com/zero-post/how-we-take-down-malicious-visual-studio-code-extensions.md): Checkmarx Zero exposes how malicious Visual Studio Code extensions infiltrate the software supply chain — from brand impersonation and data exfiltration to payload staging. The team details how they detect, verify, and coordinate with Microsoft to remove these threats, highlighting why AppSec teams must extend their focus beyond libraries to include developer tools and IDE ecosystems.
- [How We Were Able to Infiltrate Attacker Telegram Bots](https://checkmarx.com/blog/how-we-were-able-to-infiltrate-attacker-telegram-bots.md)
- [Inside Shai-Hulud’s Maw: How The NPM Worm Exploits And Propagates](https://checkmarx.com/zero-post/inside-shai-huluds-maw-how-the-npm-worm-exploits-and-propagates.md): How the world's first NPM worm did it's work, from exploitation to propagation in detail. Bruno Dias explores both the original Shai-Hulud worm and the "Second Coming" evolution, and breaks down each step of a successful infection.
- [It’s Time to Update Your Drupal Now!](https://checkmarx.com/blog/its-time-to-update-your-drupal-now.md)
- [JWT Security and CVE-2023-46943 Related Vulernability](https://checkmarx.com/blog/json-web-tokens-security.md)
- [Last Week in AppSec for 02. December 2025](https://checkmarx.com/zero-post/last-week-in-appsec-for-02-december-2025.md): Last week in AppSec was busy; with Shai-Hulud 2, node-forge signature bypasses, Apache Syncope hard-coded AES key, renewed focus on libxml2 vulnerabilities, and some big patched from GitLab
- [Last Week in AppSec for 04. November 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-11-04.md): Jenkins vulnerable to SAML session stealing via replay attack; Apache Tomcat's rewrite rules have a path traversal again; Last Week In AppSec
- [Last Week in AppSec for 07. October 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-10-07.md): Django allowing SQLi when backed by MySQL or MariaDB; FreshRSS letting anyone self-register as an admin. Last Week In AppSec
- [Last Week in AppSec for 08. January 2026](https://checkmarx.com/zero-post/last-week-in-appsec-for-08-january-2026.md): React2Shell keeps going, Shai-Hulud doesn't. MongoDB and RustFS have problems. AdonisJS could write arbitrary files. 08. January 2026: Last Week In AppSec
- [Last Week In AppSec for 08. July 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-07-08.md): AI MCP leak from Anthropic, fraudulent verification in IDE extensions, and a Next.js Denial of Service (DoS) — last week in AppSec
- [Last Week in AppSec for 09. September 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-09-09.md): Hono JS framework auth bypass, Netty java framework 0-day, and Claude Code warning about its warnings — last week in AppSec
- [Last Week in AppSec for 11. November 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-11-11.md): Two fresh CVEs hit developer tooling last week: Apache Tomcat’s multipart upload flaw can fill disks and cause DoS, while Vercel’s AI SDK bug lets unsafe files slip past its allowlist. Both are low-complexity, easy-to-patch issues highlighting persistent risks in DevOps supply chains.
- [Last Week in AppSec for 12. August 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-08-12.md): ChatGPT-5 system prompt leaked, CISA supports CVE, and AppSec Village completes; last week in AppSec
- [Last Week in AppSec for 12. Feb 2026](https://checkmarx.com/zero-post/last-week-in-appsec-for-11-feb-2026.md): A targeted supply-chain attack pushed malicious dYdX packages to npm and PyPI, stealing wallet credentials and even deploying a RAT—an urgent reminder that “dependency updates” can become incidents. Plus: a BeyondTrust pre-auth RCE worth patching immediately, emerging AI memory/skills poisoning risks, and why local privesc on developer workstations (Docker Desktop) still matters.
- [Last Week In AppSec for 14. October 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-10-14.md): Poppler PDF library has use-after-free on write; Liferay web platform leaks user address data due to IDOR. Learn about the issues, impacts, and remediation steps (last week in AppSec for 2025-10-14)
- [Last Week in AppSec for 15. January 2026](https://checkmarx.com/zero-post/last-week-in-appsec-for-15-january-2026.md): Potentially serious flaws, depending on your uses, in sigstore, n8n, and pnpm made last week in appsec all about tools in the software supply chain.
- [Last Week in AppSec for 15. July 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-07-15.md)
- [Last Week in AppSec for 18. November 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-11-18.md): NPM safe eval module expr-eval isn't so safe after all, and agentic AI workflow designer Flowise struggles with password management, all last week in AppSec
- [Last Week in AppSec for 19. August 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-08-19.md): code injection in AI Agent dev tool, path traversal in `go-getter`, model code injection protection bypass in TensorFlow Keras, and unsafe ImageMagick use in Rails Active storage — last week in AppSec
- [Last Week in AppSec for 2. September 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-09-02.md): Lessons from session takeovers in Payload CMS, and malicious workflows in the Nx build system leaked secrets; last week in AppSec
- [Last Week in AppSec for 21. October 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-10-21.md): Access control bypasses in Python's Authlib (OAuth and OpenID) and Java's Spring Framework (CSRF protection failure), last week in AppSec
- [Last Week in AppSec for 22. July 2025](https://checkmarx.com/zero-post/last-week-in-appsec-22-july-2025.md): Hacking cars with bluetooth (PerfektBlue), container escapes in NVIDIA Container Toolkiet, and vulnerable Grafana dashboards—last week in appsec (2025-07-22)
- [Last Week in AppSec for 23. September 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-09-23.md): Jenkins/Jetty HTTP/2 DoS and Kubernetes C# client cert-validation flaw. What’s affected, fixed versions, and fast mitigations—Last Week In AppSec
- [Last Week in AppSec for 26. August 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-08-26.md)
- [Last Week in AppSec for 26. February 2026](https://checkmarx.com/zero-post/last-week-in-appsec-for-26-february-2026.md): Last Week In AppSec saw public disclosures relating to AI code assistants trusting context that can be attacker-controlled.
- [Last Week in AppSec for 28. October 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-10-28.md): Seven CVEs, including DoS, in GitLab; Apache Geode's nasty CSRF leading to remote code execution. Last week in AppSec.
- [Last Week in AppSec for 29. January 2026](https://checkmarx.com/zero-post/last-week-in-appsec-for-29-january-2026.md): Denial of Service in Java SE and React server, and pnpm lets a directory traversal (Zip) slip in. Last week in AppSec.
- [Last Week in AppSec for 29. July 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-07-29.md)
- [Last Week in AppSec for 30. September 2025](https://checkmarx.com/zero-post/last-week-in-appsec-2025-09-30.md): go-mail SMTP injection and Rancher SAML phishing vector with escalation of privilege: Last Week In AppSec
- [LeapFrog LeapPad Ultimate Security Vulnerabilities](https://checkmarx.com/blog/leappad-security-vulnerabilities.md)
- [Learning About LLM-Based Zero-Day Hunting with Claude Code’s Opus 4.6](https://checkmarx.com/zero-post/learning-about-llm-based-zero-day-hunting-with-claude-codes-opus-4-6.md): The vulnerability hunting capabilities that underly Claude Code's "security-review" feature and Claude Code Security capability in Claude Web are cool — and they have important limits and weaknesses that are critical for organizations to understand before they adopt it into their security programs.
- [Llama Drama: Critical Vulnerability CVE-2024-34359 Threatening Your Software Supply Chain](https://checkmarx.com/blog/llama-drama-critical-vulnerability-cve-2024-34359-threatening-your-software-supply-chain.md)
- [Malicious NPM Package Exploits React Native Documentation Example](https://checkmarx.com/blog/malicious-npm-package-exploits-react-native-documentation-example.md)
- [Malicious Python Package Targets macOS Developers To Access Their GCP Accounts](https://checkmarx.com/blog/malicious-python-package-targets-macos-developers-to-access-their-gcp-accounts.md)
- [Malicious Python Packages Reveal Extensive Cybercriminal Operation Based in Iraq](https://checkmarx.com/blog/malicious-python-packages-reveal-extensive-cybercriminal-operation-based-in-iraq.md)
- [MCP Configuration Poisoning: Owning Your Machine With Just A Text File](https://checkmarx.com/zero-post/mcp-configuration-poisoning-owning-your-machine-with-just-a-text-file.md): Attackers can weaponize your AI agent tooling just by sneaking a text file into the right place on your system, putting developers and other users at risk. Learn how this works and how to protect yourself and your organization.
- [Mutation Cross-Site Scripting (mXSS) Vulnerabilities Discovered in Mozilla-Bleach](https://checkmarx.com/blog/vulnerabilities-discovered-in-mozilla-bleach.md)
- [Native Support For SBOMs In Python (PEP-770) Is A Reality — But Not Risk-Free](https://checkmarx.com/zero-post/pep770-sboms-in-python-reality-but-not-risk-free.md)
- [Navigating the Rising Tide of CI/CD Vulnerabilities: The Jenkins and TeamCity Case Studies](https://checkmarx.com/blog/navigating-the-rising-tide-of-ci-cd-vulnerabilities-the-jenkins-and-teamcity-case-studies.md)
- [New Protestware Found Lurking in Highly Popular NPM Package](https://checkmarx.com/blog/new-protestware-found-lurking-in-highly-popular-npm-package.md)
- [New Technique to Trick Developers Detected in an Open-Source Supply Chain Attack](https://checkmarx.com/blog/new-technique-to-trick-developers-detected-in-an-open-source-supply-chain-attack.md)
- [November 2024 in Software Supply Chain Security](https://checkmarx.com/blog/most-striking-events-of-november-2024-in-supply-chain-security.md)
- [npm ‘btree’ Malware Campaign Affects Millions of Downloads, No Need for Install Script](https://checkmarx.com/zero-post/npm-btree-malware-campaign-affects-millions-of-downloads-no-need-for-install-script.md): An ongoing npm supply chain campaign is using a malicious package, indexed-btree, that mimics the legitimate sorted-btree library — but instead of a preinstall or postinstall script, its malware trigger is buried inside the package's own prototype method, firing the moment the library is used. The malware fingerprints hosts, exfiltrates data via Slack and Telegram, and uses an Ethereum smart contract as a resilient C2 channel. Checkmarx Zero breaks down the technique, the IOCs, and why runtime — not just install-time — analysis is now essential.
- [NPM Account Takeover Results in Crypto Supply Chain Attack](https://checkmarx.com/blog/npm-account-takeover-results-in-crypto-supply-chain-attack.md)
- [NPM command confusion ](https://checkmarx.com/blog/npm-command-confusion.md)
- [NPM Hit By Shai-Hulud, The Self-Replicating Supply Chain Attack](https://checkmarx.com/zero-post/npm-hit-by-shai-hulud-the-self-replicating-supply-chain-attack.md): A self-replicating malware on NPM is affecting hundreds of packages, stealing credentials, and exposing private GitHub repos
- [NPM Malware Alert: `@lanyer640/mcp-runcommand-server` with Reverse Shell](https://checkmarx.com/zero-post/npm-malware-alert-lanyer640-mcp-runcommand-server-with-reverse-shell.md): Checkmarx Zero reported a malicious NPM package pretending to be a useful AI tool (an MCP server). Here's what to watch for, how to mitigate the risk, and how to find out if you're impacted.
- [npm v12 Lifecycle Script Limits: A Real Malicious Package Risk Reduction, or Just Moving Risk Around?](https://checkmarx.com/zero-post/npm-v12-lifecycle-script-limits-a-real-malicious-package-risk-reduction-or-just-moving-risk-around.md): The new npm client v12 introduced new defaults that refuse to run preinstall and other lifecycle scripts when installing. But did this make a meaningful improvement to risk, or just move risk around? And more importantly, what do you and your organization need to do about it?
- [October 2024 in Software Supply Chain Security](https://checkmarx.com/blog/october-2024-in-software-supply-chain-security.md)
- [Operation Navy Ghost: How Attackers Planted a Telegram-Powered Backdoor Across Fake pyrogram Packages on PyPI](https://checkmarx.com/zero-post/operation-navy-ghost-pyrogram-telegram-supplychain-attack.md): A threat actor targeted Telegram bot developers adopting the popular 'pyrogram' package on PyPI over the course of six months starting November 2025, in Operation Navy Ghost. This malware is a complete backdoor on servers where infected bots are operated, and uses Telegram itself for C2 and data exfiltration. Learn how it works, how it sneaks by most scanners, and how to detect infections.
- [Over 170K Users Affected by Attack Using Fake Python Infrastructure](https://checkmarx.com/blog/over-170k-users-affected-by-attack-using-fake-python-infrastructure.md)
- [OverDoS: Taking Down Over 70,000 n8n Instances](https://checkmarx.com/zero-post/n8n-overdos-vulnerability-cve-2026-42236.md): The OverDoS vulnerability puts any attacker-accessible n8n deployment in the crosshairs, allowing malicious actors to fill the n8n database and deny service to legitimate users. And an adjacent Open Redirect allows attackers a path to scam legitimate users.
- [Persistent Threat: New Exploit Puts Thousands of GitHub Repositories and Millions of Users at Risk](https://checkmarx.com/blog/persistent-threat-new-exploit-puts-thousands-of-github-repositories-and-millions-of-users-at-risk.md)
- [Popular NuGet Package “Moq” Silently Exfiltrates User Data to Cloud Service](https://checkmarx.com/blog/popular-nuget-package-moq-silently-exfiltrates-user-data-to-cloud-service.md)
- [Preparing For The Post-Quantum Cryptography Era](https://checkmarx.com/zero-post/preparing-for-the-post-quantum-cryptograhy-era.md): Quantum computing is headed to breaking most encryption; learn what's happening and what you have to do to protect information in the post-quantum era
- [Proof, Not Promises: How We Drive Security Testing Accuracy With Better Data ](https://checkmarx.com/zero-post/proof-not-promises-how-we-drive-security-testing-accuracy-with-better-data.md): Claims of security testing accuracy are often the result of inexpensive testing methods that produce results intended to tell a marketing story. But when you need data to drive design decisions that improve results for real application security teams, you can’t afford to rely on marketing outcomes. Here’s how we bring greater rigor to measuring the accuracy of SAST and other security testing tools, and use it to drive real improvements for defenders.
- [Protecting yourself against malicious open-source packages](https://checkmarx.com/zero-post/protecting-yourself-against-malicious-open-source-packages.md): Malicious open-source packages like Shai-Hulud attack developers and infrastructure. But centralized package controls and API access to a malicious packages database can help protect you.
- [Protestware, Politics, and Open-Source Software](https://checkmarx.com/blog/protestware-politics-and-open-source-software.md)
- [Pwn3D: Abusing 3D Models for Code Execution ](https://checkmarx.com/blog/pwn3d-abusing-3d-models-for-code-execution.md)
- [PyPi Is Under Attack: Project Creation and User Registration Suspended](https://checkmarx.com/blog/pypi-is-under-attack-project-creation-and-user-registration-suspended.md)
- [PyPI Supply Chain Attack Uncovered: Colorama and Colorizr Name Confusion](https://checkmarx.com/zero-post/python-pypi-supply-chain-attack-colorama.md)
- [Python obfuscation traps](https://checkmarx.com/blog/python-obfuscation-traps.md)
- [Python Packages Leverage GitHub to Deploy Fileless Malware](https://checkmarx.com/blog/python-packages-leverage-github-to-deploy-fileless-malware.md)
- [Race Conditions Can Exist in Go](https://checkmarx.com/blog/race-conditions-can-exist-in-go.md)
- [Rapid Exploitation and Clever Malware in the Supply Chain, Last Week In AppSec (2026-04-02)](https://checkmarx.com/zero-post/rapid-exploitation-and-clever-malware-in-the-supply-chain-last-week-in-appsec-2026-04-02.md): Two supply-chain stories mattered most this week: Langflow’s recent code-injection flaw was added to CISA’s Known Exploited Vulnerabilities catalog, and the Telnyx Python package compromise showed how quickly trusted developer tooling can become a delivery path for malware. We break down what happened, who should care, and what AppSec and development teams should do next.
- [React2Shell (CVE-2025-55182) Deserialization to Remote Code Execution in React and Next.js](https://checkmarx.com/zero-post/react2shell-cve-2025-55182-deserialization-to-remote-code-execution-in-react-and-next-js.md): React2Shell (CVE-2025-55182) is a critical unauthenticated RCE vulnerability in React and Next.js caused by insecure deserialization, putting a large number of applications at immediate risk.
- [React2Shell2? – CVE-2026-75604 – Next.JS Pre-Auth RCE on Windows Servers](https://checkmarx.com/zero-post/react2shell2-cve-2026-75604-pre-auth-rce-on-windows-servers-next-js.md)
- [Recently Discovered Supply-chain Worm](https://checkmarx.com/blog/recently-discovered-supply-chain-worm.md)
- [Rewriting Your History Using a Historical Vulnerability](https://checkmarx.com/blog/rewriting-your-history-using-a-historical-vulnerability.md)
- [Same Origin, Same Tricks: Bypassing n8n’s CSP Sandbox (CVE-2026-27578)](https://checkmarx.com/zero-post/same-origin-same-tricks-bypassing-n8ns-csp-sandbox-cve-2026-27578.md): A stored XSS in n8n let authenticated attackers bypass webhook sandbox protections and execute JavaScript in a victim’s session. Checkmarx Zero explains how an SVG-based content-type bypass broke a denylist-based defense, why that design was fragile, and what versions fix the issue.
- [Sequel to ChainVeil npm Malware Targets Vite Ecosystem](https://checkmarx.com/zero-post/sequel-to-chainveil-npm-malware-targets-vite-ecosystem.md): npm malware campaign ChainVeil has a sequel targeting the Vite ecosystem, that we're calling "ViteVenom". Read about how to identify this malware variant, defend against it, and find it in your environment.
- [Shai-Hulud’s Second Coming: NPM Malware Attack Evolved](https://checkmarx.com/zero-post/shai-huluds-second-coming-npm-malware-attack-evolved.md): A newly-evolved Shai-Hulud variant hits NPM; and this time it's out for blood. Faster, stealthier execution and a "punishment" if it can't successfully steal a users' credentials.
- [Skibidi Java – The Infinite Loop in Java Collections; Edge Case to Java Universal DoS   ](https://checkmarx.com/zero-post/he-infinite-loop-in-java-collections.md)
- [Software Composition Analysis: Why Exploitable Path Is Imperative](https://checkmarx.com/blog/software-composition-analysis-why-exploitable-path-is-imperative.md)
- [Solidity devs targeted again: Malicious VS Code extension drops ScreenConnect-based remote access trojan (RAT)](https://checkmarx.com/zero-post/solidity-devs-targeted-again-malicious-vs-code-extension-drops-screenconnect-based-remote-access-trojan-rat.md): We took down yet another malicious VS Code extension trying to target Solidity / Ethereum developers with a Remote Access Trojan (RAT). We break down the campaign, key indicators of compromise, and practical steps teams can take to reduce exposure to malicious marketplace packages.
- [Solidity Top 10 Common Issues](https://checkmarx.com/blog/solidity-top-10-common-issues.md)
- [SpringShell – Remote Code Execution via Spring Web](https://checkmarx.com/blog/springshell-remote-code-execution-via-spring-web.md)
- [StackExchange Abused to Spread Malicious Python Package That Drains Victims’ Crypto Wallets](https://checkmarx.com/blog/stackexchange-abused-to-spread-malicious-python-package-that-drains-victims-crypto-wallets.md)
- [StarJacking – Making Your New Open-Source Package Popular in a Snap](https://checkmarx.com/blog/starjacking-making-your-new-open-source-package-popular-in-a-snap.md)
- [Supply Chain Attack Using Ethereum Smart Contracts to Distribute Multi-Platform Malware](https://checkmarx.com/uncategorized/supply-chain-attack-using-ethereum-smart-contracts-to-distribute-multi-platform-malware.md)
- [Supply Chain Phishing Campaign Drops More Malware Into NPM: got-fetch 5.1](https://checkmarx.com/zero-post/supply-chain-phishing-campaign-drops-more-malware-into-npm-got-fetch-5-1.md): Ariel Harush and Tal Folkman of Checkmarx Zero discover malware in NPM package ‘got-fetch’, resulting from a previously-uncovered phishing campaign targeting NPM developers
- [Surprise: When Dependabot Contributes Malicious Code  ](https://checkmarx.com/blog/surprise-when-dependabot-contributes-malicious-code.md)
- [Taking Down More Malicious VSCode Extensions in the ‘Prettier’ Campaign](https://checkmarx.com/zero-post/taking-down-more-malicious-vscode-extensions-in-the-prettier-campaign.md): As adversaries improve their tactics for getting malicious content into the Visual Studio Code Marketplace and Open VSX, Checkmarx Zero continues to defend the community. Here's the latest brandjacking campaign we took down.
- [The 0xDABB of Doom: CVE-2021-25641](https://checkmarx.com/blog/the-0xdabb-of-doom-cve-2021-25641.md)
- [The Cyber Resilience Act’s New Reporting Obligations Are Active: What You Should Know](https://checkmarx.com/zero-post/the-cyber-resilience-acts-new-reporting-obligations-are-active-what-you-should-know.md): The new CRA (EU Cyber Resilience Act) is starting to go into effect. Learn what you must now report if your software product reaches the EU market, and when your open-source projects could be impacted.
- [The evolutionary tale of a persistent Python threat ](https://checkmarx.com/blog/the-evolutionary-tale-of-a-persistent-python-threat.md)
- [The Glass Sandbox – The Complexity of Python Sandboxing ](https://checkmarx.com/zero-post/glass-sandbox-complexity-of-python-sandboxing.md)
- [The Hacker vs. Struts 2 Game – It Appears it has No Ending](https://checkmarx.com/blog/hacker-vs-struts2-game-has-no-ending.md)
- [The Hidden Dangers of Abandoned Digital Assets in Open-Source Ecosystems](https://checkmarx.com/blog/the-hidden-dangers-of-abandoned-digital-assets-in-open-source-ecosystems.md)
- [The Hidden Supply Chain Risks in Open-Source AI Models ](https://checkmarx.com/blog/the-hidden-supply-chain-risks-in-open-source-ai-models.md)
- [The mosaic of 2023’s Software Supply Chain threats](https://checkmarx.com/blog/the-mosaic-of-2023s-software-supply-chain-threats.md)
- [This New Supply Chain Attack Technique Can Trojanize All Your CLI Commands](https://checkmarx.com/blog/this-new-supply-chain-attack-technique-can-trojanize-all-your-cli-commands.md)
- [Threat Actor Continues to Plague the Open-Source Ecosystem with Sophisticated Info-Stealing Malware](https://checkmarx.com/blog/threat-actor-continues-to-plague-the-open-source-ecosystem-with-sophisticated-info-stealing-malware.md)
- [Tornado Cash Theft Uncovered: Malicious Code Drains Funds for Months](https://checkmarx.com/blog/tornado-cash-theft-uncovered-malicious-code-drains-funds-for-months.md)
- [Turning AI Safeguards Into Weapons with HITL Dialog Forging](https://checkmarx.com/zero-post/turning-ai-safeguards-into-weapons-with-hitl-dialog-forging.md): Human-in-the-Loop safeguards can be turned against the users of AI agents. Learn how the concepts of Lies in the Loop and HITL Dialog Forging can be turned against developers using agentic AI code assistants.
- [UAParser.js – Attack & Preparations](https://checkmarx.com/blog/uaparser-js-attack-preparations.md)
- [Understanding Vulnerability Hunting and its Challenges ](https://checkmarx.com/zero-post/understanding-vulnerability-hunting-and-its-challenges.md)
- [Unearned Confidence: AI Security Reviewers Don’t Really Get It](https://checkmarx.com/zero-post/unearned-confidence-ai-security-reviewers-dont-really-get-it.md): AI-based security reviewers can be great helpers. But the gap between the certainty they express in their findings and the reality of their current capabilities can lead to problems. Understanding their limits helps AppSec teams use these features wisely.
- [Users of Telegram, AWS, and Alibaba Cloud targeted in latest supply chain attack](https://checkmarx.com/blog/users-of-telegram-aws-and-alibaba-cloud-targeted-in-latest-supply-chain-attack.md)
- [Webhook Party – Malicious packages caught exfiltrating data via legit webhook services](https://checkmarx.com/blog/webhook-party-malicious-packages-caught-exfiltrating-data-via-legit-webhook-services.md)
- [What you should know: HTTP/2 CONTINUATION Flood Vulnerability ](https://checkmarx.com/blog/what-you-should-know-http-2-continuation-flood-vulnerability.md)
- [When “Everything” Goes Wrong: NPM Dependency-Hell Campaign – 2024 Edition ](https://checkmarx.com/blog/when-everything-goes-wrong-npm-dependency-hell-campaign-2024-edition.md)
- [When the Hunter Becomes the Hunted ](https://checkmarx.com/blog/when-the-hunter-becomes-the-hunted.md)
- [When Vigilance Causes an Outage: The NPM Stylus Package Outage](https://checkmarx.com/zero-post/npm-stylus-outage-review-2025-07.md)
- [With 2FA Enabled: NPM Package lottie-player Taken Over by Attackers](https://checkmarx.com/blog/with-2fa-enabled-npm-package-lottie-player-taken-over-by-attackers.md)
- [XSS Vulnerabilities Identified on Gallup’s website](https://checkmarx.com/blog/critical-xss-vulnerabilities-identified-on-gallup-com.md)
- [Year-Long Campaign of Malicious npm Packages Targeting Roblox Users](https://checkmarx.com/blog/year-long-campaign-of-malicious-npm-packages-targeting-roblox-users.md)
- [Your Lenovo Watch X Is Watching You & Sharing What It Learns](https://checkmarx.com/blog/lenovo-watch-watching-you.md)
- [Zenly Fixes User Data Exposure and Account Takeover Risks](https://checkmarx.com/blog/zenly-fixes-user-data-exposure-and-account-takeover-risks.md)

## Resources list

- [“Healthier” Codebase with Checkmarx Developer Assist](https://checkmarx.com/resources/healthier-codebase-with-checkmarx-developer-assist.md)
- [10 AI Supply Chain Risks Hiding in Your Codebase, and How to Get Ahead of Them](https://checkmarx.com/resources/10-ai-supply-chain-risks-hiding-in-your-codebase.md): AI components are shipping in your production code, and most AppSec tools can't see them. Download this free guide to discover the 10 supply chain risks hiding in your codebase and how to get ahead of them.
- [5 DevSecOps Recommendations You Can’t Afford to Ignore](https://checkmarx.com/resources/5-devsecops-recommendations-you-cant-afford-to-ignore.md)
- [6 Key Considerations for Container Security](https://checkmarx.com/resources/6-key-considerations-for-container-security.md)
- [7 Proven Strategies for Developer Adoption of AppSec](https://checkmarx.com/resources/7-proven-strategies-for-developer-adoption-of-appsec.md)
- [7 Steps to Prioritizing AppSec for Greater Impact](https://checkmarx.com/resources/7-steps-to-prioritizing-appsec-for-greater-impact.md)
- [7 Steps to Safely Use Generative AI in Application Security](https://checkmarx.com/resources/7-steps-to-safely-use-generative-ai-in-application-security.md)
- [A Modern Approach to Developer AppSec Awareness and Training](https://checkmarx.com/resources/ebooks/a-modern-approach-to-developer-appsec-awareness-and-training.md)
- [A Unified Checkmarx Platform: UNSW](https://checkmarx.com/resources/a-unified-checkmarx-platform-unsw.md)
- [Agentic AppSec in Action](https://checkmarx.com/resources/agentic-appsec-in-action.md)
- [AI SCS: See Every AI Component in Your Codebase](https://checkmarx.com/resources/ai-supply-chain-security.md): See how Checkmarx AI Supply Chain Security automatically discovers and assesses AI components, detects AI-specific risks, and enforces governance through existing workflows
- [AI Secure Coding](https://checkmarx.com/resources/ai-secure-coding.md)
- [Airius Builds Trust
With Checkmarx’ MSSP Program](https://checkmarx.com/resources/airius-checkmarx-one-aws-cloud.md)
- [Al- Powered Multi Agent](https://checkmarx.com/resources/101415-2.md)
- [An AppSec Plan for the ECB Mandate](https://checkmarx.com/resources/an-appsec-plan-for-the-ecb-mandate.md)
- [API and Software Composition Analysis](https://checkmarx.com/resources/vidyard-all-players-6/api-sca-webinar-ntt.md)
- [API Attack ! Quand assurer la sécurité des API s’apparente à une véritable chasse aux zombies_cu](https://checkmarx.com/resources/api-attack-quand-assurer-la-se-curite-des-api-s-apparente-a-une-ve-ritable-chasse-aux-zombies-cu.md)
- [API Threat Landscape (Portuguese)](https://checkmarx.com/resources/zumbis-e-sombras-entendendo-as-crescentes-preocupacoes-do-app-sec-em-torno-da-seguranca-de-apis.md)
- [App Risk Management (ASPM)](https://checkmarx.com/resources/app-risk-management-aspm.md)
- [AppSec Guide for Software Engineering Leaders](https://checkmarx.com/resources/gartner-report-appsec-guide-for-software-engineering-leaders.md)
- [AppSec in the Age of Mythos](https://checkmarx.com/resources/appsec-age-of-mythos.md)
- [AppSec in the Era of Agentic AI](https://checkmarx.com/resources/appsec-in-the-era-of-agentic-ai.md)
- [ASPM: The Central Nervous System of Application Security in an AI-Driven World](https://checkmarx.com/resources/aspm-the-central-nervous-system-of-application-security-in-an-ai-driven-world.md)
- [AWS ReInforce – AWS on Air](https://checkmarx.com/resources/vidyard-all-players-6/aws-reinforce-aws-on-air.md)
- [Be Ready for the Cybersecurity Compliance Era](https://checkmarx.com/resources/be-ready-for-the-cybersecurity-compliance-era.md)
- [Benefits of Implementing AppSec Through a Marketplace and a Women-Owned Small Business – Copy](https://checkmarx.com/resources/benefits-of-implementing-appsec-through-a-marketplace-and-a-women-owned-small-business-copy.md)
- [Best Practices to Mitigate Security Risks With Agentic Coding Tools by Gartner®](https://checkmarx.com/resources/108591-2.md)
- [Beyond SBOM: 2024 Trends: AI, Malicious Packages, and Everything In Between](https://checkmarx.com/resources/2024-state-of-software-supply-chain-security.md)
- [Building CRA‑Aligned Security](https://checkmarx.com/resources/building-cra-aligned-security.md)
- [Capability Without Security: Measuring the Functionality-Security Gap in AI-Generated Code](https://checkmarx.com/resources/capability-without-security-measuring-the-functionality-security-gap-in-ai-generated-code.md)
- [Cdiscount Matures Its AppSec Program With Actionable Guidance From Checkmarx APMA](https://checkmarx.com/resources/cdiscount-sast-sca-ampa.md)
- [Cebu Pacific Cut Vulnerability Density in Half with Checkmarx One](https://checkmarx.com/case-study-highlights-cebu-pacific.md)
- [Checkmarx Analytics: Swift and Effective AppSec](https://checkmarx.com/resources/checkmarx-analytics-swift-and-effective-appsec.md)
- [Checkmarx AWS: IDE-Native Security for AI-Powered Development](https://checkmarx.com/resources/checkmarx-aws-ide-native-security-for-ai-powered-development.md)
- [Checkmarx AWS: Ship Secure Code at the Speed of AI](https://checkmarx.com/resources/checkmarx-aws-solution-brief.md)
- [Checkmarx DAST Solution Brief](https://checkmarx.com/resources/dast-solution-brief.md): Checkmarx DAST has been built to deliver a faster time to secure, streamlined authentication support and unified risk correlation. Get comprehensive coverage that tests AI-generated code paths and undocumented APIs that other tools miss.
- [Checkmarx Fusion and the Future of AppSec: Forged in Alliance](https://checkmarx.com/resources/checkmarx-fusion-and-the-future-of-appsec-forged-in-alliance.md)
- [Checkmarx Fusion: Why Correlation Matters](https://checkmarx.com/resources/vidyard-all-players-5/checkmarx-fusion-why-correlation-matters.md)
- [Checkmarx Fusion™: Hybrid SAST for Higher Detection Accuracy](https://checkmarx.com/resources/checkmarx-fusion-hybrid-sast-for-higher-detection-accuracy.md)
- [Checkmarx Honored as 2024 ASPM Competitive Strategy Leader](https://checkmarx.com/resources/99640-2.md)
- [Checkmarx MCP Server: Security Delivered Through Every AI Tool](https://checkmarx.com/resources/checkmarx-mcp-server-security-delivered-through-every-ai-tool.md)
- [Checkmarx Named a Leader in the 2026 Gartner® Magic Quadrant™ for Software Supply Chain Security](https://checkmarx.com/resources/checkmarx-named-a-leader-in-the-2026-gartner-magic-quadrant-for-software-supply-chain-security.md)
- [Checkmarx One AI Supply Chain Security Demo](https://checkmarx.com/resources/checkmarx-one-ai-supply-chain-security-demo.md): See how you can find and protect hidden AI, ensure compliance, and reduce AI supply chain risk.
- [Checkmarx One for Government](https://checkmarx.com/resources/checkmarx-one-for-government.md)
- [Checkmarx One Solution Brief](https://checkmarx.com/resources/checkmarx-one-solution-brief.md): Read the full brief to discover how Checkmarx One leverages the power of Agentic AI to deliver comprehensive security and streamline your workflows. Learn more about the features and benefits of a complete application security testing platform for the enterprise.
- [Checkmarx Optimizer](https://checkmarx.com/resources/checkmarx-optimizer.md): Take a holistic approach to application onboarding and optimization that includes code scanning, results triaging and mitigation advice.
- [Checkmarx SAST: AI-Powered Static Code Security Testing](https://checkmarx.com/resources/checkmarx-sast-solution-brief.md): Checkmarx SAST is purpose-built for how code is written today. With AI coding assistants accelerating code generation across multiple languages, organizations need comprehensive security scanning that covers every language.
- [Checkmarx Targets DevSecOps Friction Points with AI](https://checkmarx.com/resources/checkmarx-targets-devsecops-friction-points-with-ai.md)
- [CISOs, are you ready to get ahead of application risk?](https://checkmarx.com/resources/cisos-are-you-ready-to-get-ahead-of-application-risk.md)
- [Closing the Risk Gap: Power and Proof with Checkmarx Fusion](https://checkmarx.com/resources/closing-the-risk-gap-power-and-proof-with-checkmarx-fusion.md)
- [Closing the Risk Gap: Power and Proof with Checkmarx Fusion – Asia](https://checkmarx.com/resources/closing-the-risk-gap-power-and-proof-with-checkmarx-fusion-apac.md)
- [Closing the Risk Gap: Power and Proof with Checkmarx Fusion – Europe](https://checkmarx.com/resources/closing-the-risk-gap-power-and-proof-with-checkmarx-fusion-emea.md)
- [Cloud Security and AI – Interview with Sandeep Johri at RSA 2024](https://checkmarx.com/resources/sandeep_techstrong.md)
- [Code at Risk – Why DevOps Teams Need to Unify Application Security](https://checkmarx.com/resources/code-at-risk-why-devops-teams-need-to-unify-application-security.md)
- [Container Security](https://checkmarx.com/resources/container-security.md)
- [Customer Voices: ITV Selects Checkmarx For Its Developer-Friendly AppSec Tools](https://checkmarx.com/resources/customer-voices-itv-selects-checkmarx-for-its-developer-friendly-appsec-tools.md)
- [Customer Voices: MyHeritage Selects Checkmarx For Its Highly Accurate AppSec Scan Tools](https://checkmarx.com/resources/customer-voices-myheritage-selects-checkmarx-for-its-highly-accurate-appsec-scan-tools.md)
- [DevSecOps Evolution 2025](https://checkmarx.com/resources/100823-2.md)
- [Don’t Trust the Code](https://checkmarx.com/resources/dont-trust-the-code.md): AI-generated code introduces new scale, new supply chains, and new security risks. Discover why traditional AppSec can't keep pace and how security must move into the IDE to effectively secure.
- [From Chaos to Clarity](https://checkmarx.com/resources/from-chaos-to-clarity.md)
- [From Finding to Fixing: Triage & Remediation Assist Reduce AppSec Friction at Scale](https://checkmarx.com/resources/from-finding-to-fixing-triage-remediation-assist-reduce-appsec-friction-at-scale.md)
- [From Fragmented to Unified AppSec with Checkmarx](https://checkmarx.com/resources/from-fragmented-to-unified-appsec-with-checkmarx.md)
- [From Reactive to Proactive: Agentic AI and the Rise of Shift Zero](https://checkmarx.com/resources/from-reactive-to-proactive-agentic-ai-and-the-rise-of-shift-zero.md)
- [Future of Application Security in the AI Era](https://checkmarx.com/resources/future-of-application-security-in-the-ai-era.md): AI now writes the code – and the gap between detection and action is widening. See what 2,350 CISOs, AppSec leaders & developers across 14 countries reveal.
- [GenAI: What You Really Need to Know](https://checkmarx.com/resources/homepage/genai-what-you-really-need-to-know.md)
- [Getting a High-Value Return: How a Financial Giant Maximized Its AppSec ROI](https://checkmarx.com/resources/getting-high-value-return-financial-giant-maximized-appsec-roi.md)
- [Helping to Deliver Customer Centric Services: A Partner For Your AppSec Journey | Riversafe](https://checkmarx.com/resources/helping-to-deliver-customer-centric-services-a-partner-for-your-appsec-journey-riversafe.md)
- [How a Global Pharma Transformed AppSec with Checkmarx](https://checkmarx.com/resources/how-global-pharma-transformed-appsec-checkmarx.md)
- [How Best Buy Reduced False Positives by 80%](https://checkmarx.com/resources/best-buy.md)
- [How Mature is Your Application Security Program?](https://checkmarx.com/resources/how-mature-is-your-application-security-program.md)
- [IDC MarketScape for ASPM 2025](https://checkmarx.com/resources/idc-marketscape-for-aspm-2025.md): Positioned as a Leader for Application Security Posture Management (ASPM) for strengths in Making ASPM actionable for developers, Platform-centric packaging, and Broad and growing investment in AI.
- [Intro to Checkmarx One: The AppSec Platform for the AI Era](https://checkmarx.com/resources/intro-to-checkmarx-one-the-appsec-platform-for-the-ai-era.md)
- [ISMG, AWS, and Checkmarx Present: How to Secure the Code Pipeline](https://checkmarx.com/resources/vidyard-all-players-5/how-to-secure-the-code-pipeline-2.md)
- [Keeping Bad Vibes Out](https://checkmarx.com/resources/keeping-bad-vibes-out.md)
- [Lessons Learned in DevSecOps and Vibe Coding](https://checkmarx.com/resources/lessons-learned-in-devsecops-and-vibe-coding.md)
- [Let Your Devs Work](https://checkmarx.com/resources/100413-2.md)
- [LLM Application Security: Governing AI-Driven Risk Across the Software Lifecycle](https://checkmarx.com/resources/llm-application-security-governing-ai-driven-risk.md)
- [Malicious Package Identification API](https://checkmarx.com/resources/malicious-package-identification-api.md)
- [Merito + Checkmarx Power Unified, Secure AppSec](https://checkmarx.com/resources/merito-checkmarx-power-unified-secure-appsec.md)
- [On Air at re:Invent 2022](https://checkmarx.com/resources/vidyard-all-players-6/checkmarx-hosted-by-aws-on-air-at-re-invent-2022.md)
- [On-Point Fixes: How PatientPoint Outpaced Its Own Vulnerability Backlog](https://checkmarx.com/resources/on-point-fixes-how-patientpoint-outpaced-its-own-vulnerability-backlog.md)
- [PCL Construction Simplifies Its Cloud Transition With the Checkmarx One](https://checkmarx.com/resources/pcl-construction-cx1-sast-sca-codebashing.md)
- [Precision Meets Power: Checkmarx Fusion Pairs Deterministic Security with Frontier Firepower](https://checkmarx.com/resources/the-best-of-both-ais.md)
- [Redefining AppSec with Agentic AI](https://checkmarx.com/resources/redefining-appsec-with-agentic-ai.md)
- [SAST tools guide: 10 Key Considerations for a SAST Platform](https://checkmarx.com/resources/10-key-considerations-when-choosing-a-sast-platform.md)
- [Secure Code As It Is Written with Developer Assist](https://checkmarx.com/resources/secure-code-as-it-is-written-with-developer-assist.md)
- [Securing Agentic AI-driven Development](https://checkmarx.com/resources/securing-agentic-ai-driven-development.md)
- [Securing the Self-Built Software Supply Chain](https://checkmarx.com/resources/securing-the-self-built-software-supply-chain.md)
- [Security Can’t Keep Up With AI – But DAST Closes the Gap](https://checkmarx.com/resources/security-cant-keep-up-with-ai-but-dast-closes-the-gap.md)
- [Self-Healing Code for AI-Native Development Workflows](https://checkmarx.com/resources/self-healing-code-for-ai-native-development-workflows.md): Self-healing code workflows help enterprises find, fix, and reduce risk inside AI-nativedevelopment, before vulnerable code becomes a pull request, build failure, ticket, or backlog item.
- [Shadow AI in the SDLC: A Practitioner Panel on Visibility, Risk, and the Road to Governed AI](https://checkmarx.com/resources/shadow-ai-in-the-sdlc.md)
- [Sleep soundly with a unified AppSec platform that your developers will love](https://checkmarx.com/resources/videos/sleep-soundly-with-a-unified-appsec-platform-that-your-developers-will-love.md)
- [Smart Security for the AI-powered SDLC](https://checkmarx.com/resources/secure-code-at-ai-speed-with-the-first-agentic-appsec-platform.md)
- [Smarter Security Starts Here. Watch the Agentic AI Demo in Action.](https://checkmarx.com/resources/smarter-security-starts-here-watch-the-agentic-ai-demo-in-action.md)
- [Software GmbH Modernizes AppSec with Cloud-Native Checkmarx One](https://checkmarx.com/resources/software-ag.md)
- [Still on CxSAST? It’s About Time You Modernize](https://checkmarx.com/resources/modernizing-appsec-with-checkmarx-one.md)
- [Stocking Up on Speed: A “Huge Success” in European Retailer’s AppSec Transformation](https://checkmarx.com/resources/stocking-up-on-speed-a-huge-success-in-european-retailers-appsec-transformation.md)
- [Test Vimeo Resource GATED](https://checkmarx.com/resources/test-vimeo-resource-2.md)
- [Testimonial: Microsoft Visual Studio Cloud Services](https://checkmarx.com/resources/videocustomerstories/what-makes-checkmarx-a-good-fit-for-devops.md)
- [The 2025 Gartner® Critical Capabilities for Application Security Testing](https://checkmarx.com/resources/the-2025-gartner-critical-capabilities-for-application-security-testing.md): Ranked #1 in the DevSecOps and Customer Use Cases.
- [The 2025 Gartner® Magic Quadrant™ for Application Security Testing](https://checkmarx.com/resources/the-2025-gartner-magic-quadrant-for-application-security-testing.md): Find out why Checkmarx has been named a Leader for the seventh time in a row by viewing a copy of the report.
- [The 6-Point ECB AI Cybersecurity Readiness Checklist](https://checkmarx.com/resources/the-6-point-ecb-ai-cybersecurity-readiness-checklist.md)
- [The Agent-Native Security Stack: How MCP Is Reshaping Application Security Workflows](https://checkmarx.com/resources/the-agent-native-security-stack-how-mcp-is-reshaping-application-security-workflows.md)
- [The Agentic AI Buyer’s Guide](https://checkmarx.com/resources/the-agentic-ai-buyers-guide.md): Choose the right AppSec product with this useful guide to Agentic AI and application security.
- [The AppSec Overload Problem and Why Context Is the Cure](https://checkmarx.com/resources/the-appsec-overload-problem-and-why-context-is-the-cure.md)
- [The AppSec Paradox: Why Organizations That Feel Secure Are Getting Breached](https://checkmarx.com/resources/the-appsec-paradox-why-organizations-that-feel-secure-are-getting-breached.md)
- [The AppSec Regulatory Review and Assessment Guide](https://checkmarx.com/resources/the-appsec-regulatory-review-and-assessment-guide.md)
- [The Art of Secure Code](https://checkmarx.com/resources/the-art-of-secure-code.md)
- [The Dark Side of GenAI: Security Aspects of Using Generative AI](https://checkmarx.com/resources/the-dark-side-of-genai-security-aspects-of-using-generative-ai.md)
- [The Forrester SAST Wave 2025](https://checkmarx.com/resources/forrester-wave-for-static-analysis-security-testing-q3-2025.md): Recognized as a leader for SAST, while also earning the highest score in the Current Offering category, and the highest scores possible in the AI-Powered Tools in SDLC, risk prioritization, and roadmap criteria.
- [The Future of Application Security in the Era of AI – Executive Summary](https://checkmarx.com/resources/the-future-of-application-security-in-the-era-of-ai-executive-summary.md)
- [The Future of AppSec in the Era of AI](https://checkmarx.com/resources/the-future-of-appsec-in-the-era-of-ai.md)
- [The Hidden Threat of Malicious Open-Source Packages](https://checkmarx.com/resources/the-hidden-threat-of-malicious-open-source-packages.md)
- [The Hidden Threat of Malicious Open-Source Packages: Exec Summary](https://checkmarx.com/resources/the-hidden-threat-of-malicious-open-source-packages-exec-summary.md)
- [The New Rules of SAST: 10 Considerations for the AI Era](https://checkmarx.com/resources/the-new-rules-of-sast-10-considerations-for-the-ai-era.md)
- [The Road to DevSecOps](https://checkmarx.com/resources/the-road-to-devsec-ops.md)
- [The Software Supply Chain Just Got Harder to See](https://checkmarx.com/resources/the-software-supply-chain-just-got-harder-to-see.md): AI and open-source risk are converging. Watch on demand to learn what security leaders must do now.
- [The Velocity Trap: A Data-Driven Report on Balancing Speed and Security in the Generative AI Era](https://checkmarx.com/resources/the-velocity-trap-a-data-driven-report-on-balancing-speed-and-security-in-the-generative-ai-era.md)
- [Tomorrow with Checkmarx: Fixed Before You See It with Developer Assist](https://checkmarx.com/resources/tomorrow-with-checkmarx-agentic-security-that-is-built-to-heal-not-just-detect.md)
- [Trade-Van Significantly Improves Time to Market With the Easy-to-Use Checkmarx One Platform](https://checkmarx.com/resources/trade-van-sast.md)
- [Two Fronts, One Risk](https://checkmarx.com/resources/two-fronts-one-risk.md)
- [Two Fronts. One Risk.](https://checkmarx.com/resources/ai-security-infographic.md): AI has opened two simultaneous security fronts: attackers are weaponizing vulnerabilities faster than ever, while AI-generated code introduces defects security teams weren't built to catch. This infographic breaks down the data behind both fronts and the independent control plane needed to address them. Download the full paper for the complete framework, governance commitments, and benchmark data.
- [Understanding Europe’s Most Extensive Cybersecurity Directive](https://checkmarx.com/resources/understanding-europes-most-extensive-cybersecurity-directive.md)
- [Unlock the True Value of Moving to Checkmarx One](https://checkmarx.com/resources/103201-2.md)
- [When AI Finds Everything: How AppSec Teams Prioritize, Govern, and Fix What Matters](https://checkmarx.com/resources/how-appsec-teams-prioritize-govern-fix-what-matters.md): See why AI-scale vulnerability discovery shifts the bottleneck from finding risk to prioritizing, governing, and fixing what matters - and how Checkmarx One turns findings into accountable action.
- [Why Checkmarx for the Public Sector?](https://checkmarx.com/resources/solution-brief-checkmarx-for-the-public-sector.md): Support Your Modernization Initiatives and Protect Legacy Application Development with Checkmarx Solutions for the Public Sector