Checkmarx

Application security testing vendor scanning code for vulnerabilities before it ships.

A compliance-locked customer base is now being tested by a public breach and cheaper AI-native rivals at the exact moment its private equity owner needs an exit.

Checkmarx helps large enterprises find security bugs in software code before it ships. The company has built sticky relationships through deep integration into customer workflows, compliance certifications, and multi-year contracts with over 860 big customers, which normally would be hard to replace. But three things are pushing back right now: Microsoft's GitHub Advanced Security comes built into the code platform most developers already use; new AI-powered rivals like Semgrep and Endor Labs are making the core scanning work cheaper and easier to copy; and most importantly, Checkmarx itself suffered a major security breach in early 2026 where attackers compromised the company's own software updates and published stolen data, which has shaken customer confidence. The company's biggest challenge is whether unhappy customers will stick around during renewals or jump to competitors like GitHub or Wiz.

• $150M+ ARR on Checkmarx One (2025-09-30)
• 860+ large enterprises protected (2025-10-14)
• ~$2.5B sale attempt failed in 2024 (2024)

• March-April 2026 supply-chain breach causing customer churn or litigation. Severity: high
• AI-native rivals commoditizing core SAST/SCA scanning layer. Severity: high
• PE exit overhang after failed 2024 sale attempt at ~$2.5B. Severity: medium
• GitHub Advanced Security default distribution inside customers' own dev environments. Severity: medium
• Ongoing broader TeamPCP threat-actor campaign hitting adjacent ecosystems into May 2026. Severity: medium

Is Checkmarx profitable in 2026?

Checkmarx does not disclose total company profitability as a private, PE-owned firm. Its flagship Checkmarx One platform reportedly surpassed $150M ARR with over 30% ARR growth year-to-date as of September 30, 2025, per company press releases, but no net income figures are public.

Was Checkmarx hacked?

Yes. Starting March 19-23, 2026, threat actor TeamPCP compromised Checkmarx's GitHub artifacts including github-action tools and VS Code extensions. Data was exfiltrated March 30, 2026 and published by LAPSUS$ on April 25, 2026; Checkmarx confirmed the theft April 29, 2026 and engaged Mandiant.

Who owns Checkmarx?

Hellman & Friedman has owned Checkmarx since acquiring it at a $1.15B valuation in a deal announced March 16, 2020 and closed in April 2020, with TPG taking a minority stake. A reported 2024 sale attempt at roughly $2.5B did not close.

Could AI replace Checkmarx's core product?

AI-native rivals like Semgrep, Corgea, and Endor Labs are commoditizing rule-based SAST/SCA scanning using LLM reasoning, per 2026 industry comparisons. Checkmarx is countering with its own Assist agent family and a December 2025 Tromzo acquisition for agentic AppSec, but this is parity, not a differentiator.

Is Checkmarx being sold or acquired?

Hellman & Friedman reportedly shopped Checkmarx at approximately $2.5B in a 2024 sale process that did not close, according to Trackr.Live as of September 29, 2025. As of mid-2026, H&F remains the owner with no confirmed new sale process.

Who is Checkmarx's biggest competitor?

GitHub Advanced Security (Microsoft) is the most structurally dangerous threat due to default distribution inside GitHub where code already lives. AI-native challengers Semgrep, Cycode, and Endor Labs are also contesting Checkmarx's core SAST/SCA scanning layer as of 2026.

• 2026-07-13Checkmarx One for Government achieves FedRAMP Moderate certification
• 2026-06-22Named Leader in inaugural 2026 Gartner MQ for Software Supply Chain Security; launches AI Inventory
• 2026-04-29Checkmarx confirms data stolen in supply-chain attack, engages Mandiant
• 2026-04-25LAPSUS$ publishes exfiltrated Checkmarx data on dark web
• 2026-04-22Second wave of compromised Checkmarx artifacts published
• 2026-03-23TeamPCP breach of Checkmarx GitHub actions and extensions begins (started Mar 19)
• 2025-12Checkmarx acquires Tromzo, an ASPM/autonomous-security-agent startup
• 2025-10-08Checkmarx announces Checkmarx One surpassed $150M ARR
• 2023Sandeep Johri replaces Emmanuel Benzaquen as CEO
• 2020-04Hellman & Friedman completes acquisition of Checkmarx at $1.15B valuation

• Checkmarx One Achieves Unprecedented Enterprise Adoption... (2025-10-08)
• Checkmarx One Surpasses $150M ARR... (2025-10-14)
• Checkmarx Careers, Perks + Culture
• Checkmarx Number of Employees 2026 (2026-06-29)
• Checkmarx - Headcount, Funding & Open Jobs (2026-07-14)
• PE Firm to Buy Application Security Specialist Checkmarx... (2023-01-23)
• Hellman & Friedman to Acquire Cybersecurity Leader Checkmarx at a $1.15B Valuation (2020-03-16)
• Checkmarx, Trackr.Live (2025-09-29)
• TeamPCP Hacks Checkmarx GitHub Actions... (2026-03-24)
• Checkmarx Confirms Data Stolen in Supply Chain Attack (2026-04-29)
• Ongoing Checkmarx Supply Chain Security Incident (2026-06-04)
• Checkmarx Named a Leader in the 2026 Gartner Magic Quadrant for Software Supply Chain Security (2026-06-22)