Burp Suite vs Checkmarx One

From $475 per user/year (Professional)

Quote on request

Professional is inexpensive for what it does; Enterprise is quote-based by scanning agents and applications.

Enterprise annual licensing, typically by developer count or lines of code. Six figures at scale.

Community Edition is free but omits the scanner and rate-limits key tools.

Free trial.

Category standard

PortSwigger · since 2003

Widely used

Checkmarx · since 2006

• The reference tool for manual application penetration testing — every security professional knows it.
• Exceptional scanner accuracy, particularly for injection classes.
• Professional Edition is remarkably good value at under $500 per year.

• Very deep SAST analysis with wide language coverage including legacy enterprise languages.
• One platform and one risk view across every scan type.
• Strong compliance and audit reporting.

• Community Edition is too limited for serious automated work.
• Requires security expertise; it is not a push-button product for developers.
• Enterprise licensing is a significant step up in cost.

• Expensive, with a long procurement and deployment cycle.
• High false-positive volume typical of deep SAST; tuning is a project.
• Scans are slow relative to developer-first tools.

Security teams and penetration testers, plus enterprises needing scheduled authenticated scanning.

Large enterprises with a security function and regulatory obligations.