Statement issued by the company (Announcement)<\/p>\n
Checkmarx<\/strong>, the global leader in agentic application security, today announced a major advancement to the Checkmarx One platform<\/strong>: a new hybrid static application security testing (SAST)<\/strong> scanning engine set to deliver the industry\u2019s highest fidelity, known in the industry as an F1 score<\/strong><\/a>. AI-accelerated development is driving an unprecedented surge in software vulnerabilities, leaving organizations facing a tsunami of risk that no single scanning approach can address alone.<\/p>\n Neither rules-based analysis nor AI models tell the whole story alone. Deterministic scanning is the precision standard for the languages it covers, but AI-assisted development has introduced new and emerging languages that fall outside any fixed rule set. AI extends coverage to that new ground. However, scanning at volume surfaces findings faster than teams can act on them, burying the vulnerabilities that matter in noise. Today, 49% of code in production is AI generated<\/a> and measurably more insecure, and exploit windows collapsing from months to minutes. Organizations need both the precision of deterministic analysis and the reach of AI.<\/p>\n To meet this moment, Checkmarx is introducing a new next generation SAST hybrid scanning engine within Checkmarx One. It combines three layers of protection: a deterministic rules-based foundation refined over two decades of enterprise AppSec; a purpose-tuned LLM engine that extends that proven foundation to any language, including AI-generated code and emerging languages; and the new Finding Analysis Engine (FAE)<\/strong>, which confirms true positives and suppresses false ones before a single finding reaches a developer.<\/p>\n \u201cNo single approach \u2013 rules-based or AI \u2013 tells the whole story on its own,\u201d said Sandeep Johri<\/strong>, CEO of Checkmarx. \u201cDeterministic scanning has earned its place as the precision standard, and AI extends that reach to code the rules were never written for. But neither alone separates the findings that matter from the ones that don’t. At today’s volumes, that noise is what slows teams down and drives up cost. Checkmarx One\u2019s hybrid engines bring together the best of both in a fundamentally different architecture.\u201d<\/p>\n In head-to-head testing across seven real production codebases, Checkmarx One\u2019s hybrid engine achieved an F1 score of 0.64 \u2013 more than three times the 0.20 average across competing approaches that Checkmarx evaluated \u2013 while reducing false positives by 60%. The result: teams cut through massive findings volumes to high-confidence signals, focus remediation on what is genuinely exploitable, and stay protected as AI-generated code keeps introducing new risk.<\/p>\n Key capabilities of the new Checkmarx One hybrid scanning engine include:<\/p>\n \u201cAI has handed developers an unprecedented productivity boost, but independent benchmarks show that even the best models produce insecure code in a third to nearly half of cases \u2013 and the tools meant to catch it can burn through compute budgets chasing false positives,\u201d said Jonathan Rende, Chief Product Officer at Checkmarx. \u201cWhat teams need isn\u2019t just more findings, it\u2019s confidence and predictability: surfacing the vulnerabilities that truly matter, eliminating the noise, and doing it without blowing past budgets. That\u2019s the assurance Checkmarx One now gives every customer \u2013 the highest fidelity in the industry, with the economics to match.\u201d<\/p>\n The new hybrid scanning engines and Finding Analysis Engine are available in early access now as part of the Checkmarx One platform. For more information, visit checkmarx.com or join the upcoming virtual summit Agentic AppSec Unleashed \u201926<\/a> on June 16, 2026.<\/p>\n Checkmarx is the leader in agentic application security, delivering enterprise-grade protection while lowering engineering costs and accelerating development velocity. The Checkmarx One platform scans trillions of lines of code each year for companies, cutting vulnerability density by more than half. Its autonomous security agents detect and counter AI-driven threats across the SDLC, providing prevention-first protection for legacy, modern, and AI-generated code at enterprise scale. Follow Checkmarx on\u00a0LinkedIn<\/a>,\u00a0YouTube<\/a>, and\u00a0X<\/a>.<\/p>\n AGENCIA EFE S.A.U.,S.M.E. shall not be liable for any information contained in this message and assumes no responsibility towards third parties in relation to its contents, being expressly exempt from any liability that the author may have in relation to the information in question. Agencia EFE reserves the right to distribute the press release on the news wire, or to publish it on EFE Comunica.<\/em><\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":" Statement issued by the company (Announcement) New hybrid engine triples the industry\u2019s average fidelity score while cutting false positives by 60% Checkmarx, the global leader in agentic application security, today […]<\/p>\n","protected":false},"author":198164071,"featured_media":48434,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[125518],"tags":[],"class_list":["post-231089","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-globenewswire-en"],"acf":[],"yoast_head":"\n\n
About Checkmarx<\/h2>\n
For more information:\r\nPR@checkmarx.com<\/pre>\n