Checkmarx licensing is the set of terms under which Checkmarx sells its application security software. Its current platform is Checkmarx One, a cloud-native platform that combines static analysis (SAST), software composition analysis (SCA), DAST, API security, infrastructure-as-code and container scanning, application security posture management (ASPM) and AI agents (Checkmarx One Assist).[10] Before Checkmarx One, Checkmarx sold separately installed products: Checkmarx SAST (CxSAST) with CxOSA, Checkmarx SCA (CxSCA), Checkmarx IAST (CxIAST) and the Codebashing training service. Each has its own published licence types.[14] All are sold under the Checkmarx Terms of Service. These grant a limited, non-exclusive, non-transferable licence for internal business purposes during the Subscription Term, “subject to the License Type restrictions and the quantity and type of licenses purchased”.[9] The License Type definitions are those published at checkmarx.com/legal/terms.[9] See subscription and consumption licensing for the general models.
Editions
Checkmarx One is sold in packages. List prices are not published. Checkmarx says the platform is “priced per package”, with quotes depending on the modules, the deployment model (SaaS or self-hosted) and the number of developers in scope.[10]
| Package | Contents named on the pricing page[10] |
|---|---|
| Essentials | SAST, SCA, API Security, ASPM; other scanners as add-ons |
| Professional | Essentials plus Malicious Package Protection, Repository Health, DAST and Container Security |
| Enterprise | Essentials and Professional plus IaC Security, Secrets Detection and Codebashing |
| Start with SAST | SAST, described as ideal for existing on-prem customers |
| Start with Supply Chain | SCA, Malicious Package Protection, Repository Health, Container Security |
Fusion, Checkmarx Assist and AI Inventory are add-ons to every package.[10] The Checkmarx One License screen shows a tenant’s Package Type, its purchased solutions and the solutions available for purchase.[11] The on-premises product families and their licence types are described in Checkmarx SAST and legacy product licensing.
Metrics
| Checkmarx term | Catalog row | Definition |
|---|---|---|
| Contributing Developer | Contributing Developer | Any Contributor (an AI agent, bot or individual) who has committed to a private Repository scanned by the Software in the last 90 days[1] |
| Lines of code | Lines of code scanned | 15,000,000 lines scanned in the last 90 days per Contributing Developer licence, pooled at account level[1] |
| Credit | Checkmarx Credit | The unit that meters AI Actions such as Triage Assist and Remediation Assist[1] |
| Concurrent Scan | Concurrent Scan | Scans that can run in parallel. Version 2024.02 set ratios to Contributing Developers.[2] |
| Named User | Named User | A licence tied to one individual (CxSAST, CxSCA, Codebashing)[4][7] |
| Project / Scanned Unit | Project; Scanned Unit | One named codebase (CxSAST); one Project or 10 Microservices (CxSCA)[4][5] |
| Application | Application | A single executable component (CxIAST)[6] |
| Package | Package | A monthly quantity of packages checked through the Supply Chain Security Threat API[8] |
The Contributing Developer is the central metric of Checkmarx One. Its definition, counting rules and earlier versions are covered in Checkmarx One Contributing Developer licensing.
Counting / floors
Rolling 90-day window. A Contributing Developer licence is consumed by anyone who committed to a scanned private repository in the last 90 days. In the current version, 2026.09, Contributors include AI agents and bots.[1] Catalog: Contributing Developer is a committer to a scanned private repository in the last 90 days; AI agents and bots count as Contributors.
Lines-of-code ceiling. Each Contributing Developer licence brings 15 million lines of code scanned per 90 days into an account-level pool.[1] Catalog: 15 million lines of code per Contributing Developer licence per 90 days.
Estimation. If an exact count cannot be determined, Checkmarx estimates it with a formula derived from consumption metrics.[1] Catalog: Checkmarx may estimate Contributing Developers when an exact count is not possible.
On-premises licence files. By default a CxSAST licence file is valid for one version, up to 12 months and up to 10,000,000 lines of code. It expires when any of these limits is reached.[12] Catalog: CxSAST licence files expire at one version, 12 months or 10 million lines.
Floors. No minimum quantity is published.[10]
Virtualization & partitioning
Checkmarx One counts people (and agents) who commit code, so the infrastructure behind it plays no part. The on-premises products are different. The CxSAST server (CxManager) and the CxIAST server component are Node Locked, meaning the Software is licensed to run on a single computer. The licence key is tied to a hardware ID (HID), and moving it to another machine needs a written request and a new key.[4][6] For CxIAST, identical copies of one executable on different instances count as one Application.[6] See virtualization and partitioning.
Cloud / BYOL
Checkmarx One runs as SaaS and is also supported as a self-hosted deployment. The deployment model is factored into the quote.[10] Under the Terms of Service, On Premises Software may be installed on one customer-controlled server, or on the number of servers stated in the Quote, with one inactive backup copy.[9] Customers can also buy Hosting Services, in which Checkmarx hosts licensed on-premises software. There is no BYOL construct between the two delivery models.[9]
Programs
- Evaluation Access. Trials run for 14 days from first access unless Checkmarx specifies another period. They are provided as-is.[9] Checkmarx’s pricing page says it does not offer a self-serve free trial, only a personalised demo.[10]
- Migration licences. Temporary CxSAST and CxSCA licences support moves to Checkmarx One. They may only scan code from developers licensed as Contributing Developers.[4][5]
- Support. The Software SLA offers Standard support during business days and Premium support 24 hours a day, 365 days a year. Priority 1 initial response is 6 hours under Standard and 2 hours under Premium.[13]
- Checkmarx Credits. AI Actions draw down a purchased Credit balance. They are suspended when the balance reaches zero.[1]
Audits and compliance
The Terms of Service contain a usage verification clause. The customer must keep use within the number and type of licences purchased. On written request it must provide a signed certification of compliance and records needed to verify actual usage. Checkmarx sets no frequency or notice period for these requests. Excess usage must be covered by buying more licences, with fees calculated from the date the excess began and invoiced for the rest of the Subscription Term.[9] Catalog: Customers must certify compliance and provide usage records on request; Excess usage is charged from the date it began. In Checkmarx One, the tenant administrator’s License screen shows the Contributing Developers count and can export a CSV report of contributing developers with email addresses and projects.[11] That report is the natural record to reconcile against the Quote. See software license audit and true-up.
Contract terms
The Terms of Service prohibit using the Solution to provide application security services to third parties, and prohibit sharing generated reports with third parties except where the law requires disclosure.[9] Approved orders are firm and non-cancelable. If a Quote sets no term, the Subscription Term is 12 months. New York law governs unless a Local Country Addendum provides otherwise.[9] Australia, France, Germany, India and the United Kingdom have Local Country Addenda.[14] The full agreement is analysed in Checkmarx Terms of Service.
Version history
Checkmarx versions its License Types pages and keeps earlier Checkmarx One versions online. The applicable version depends on when the licence was bought. Version 2022.08 sold Contributing Developers at a ratio of 3 Repositories each.[3] Version 2024.02 tied Concurrent Scans to developer counts.[2] Compared with 2024.02, the current version 2026.09 contains a lines-of-code limit, counts AI agents and bots as Contributors, adds Credits and no longer states a Concurrent Scan ratio. Intermediate versions are not archived on checkmarx.com.[1]
Out of scope
- Prices, discounts and marketplace private offers, which Checkmarx does not publish.
- Negotiated master agreements that replace the Terms of Service.
- Checkmarx One License Types versions between 2024.02 and 2026.09 that are not archived on checkmarx.com.
- The Data Processing Agreement and sub-processor list, which concern personal data rather than licence scope.