When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
Just Eat Takeaway.comInfoSec and IT Security ManagerSAST, DAST, SCA, MAST
SAST, DAST, SCA, API security
DerScanner found DOM, persistent and reflected XSS, SQL injection, RCE and path traversal. Checkmarx reported no critical vulnerabilities in this mode.
Real CVEs in Java and Python dependencies, with fewer false positives from version mapping.
DerScanner vs Checkmarx
Both tools flagged missing security headers and information exposure. DerScanner went further.
Overall result on two Java projects was close — each tool led in different classes.
DerCodeFix reconstructs source from bytecode and proposes a secure fix. Developers can request alternatives and pick the best one.
Delphi, Pascal, ABAP, LotusScript, Rust and Vyper sit next to Java, Python and Go.
Static analysis runs on compiled packages. Third-party software gets the same checks as in-house code.
Scans flag hidden functionality left in the code and check obfuscated fragments that other rules skip.
Supply Chain Security scores credibility, authorship, popularity and community response speed.
DerTriage checks each finding and attaches a justification to its verdict. Both AI agents run on-premises without internet access.
SQL injection in OrderService.java:42
True positiveUser input from the request parameter reaches the query string without parameterization.
Test scope: SAST on two Java projects, DAST on one web application in two modes, SCA on Java and Python projects with real CVEs.
| Capability | DerScanner | Checkmarx |
|---|---|---|
| AI verification of findings | Yes | Yes |
| AI-generated code fixes | Yes | Yes |
| AI verification of compiled artifacts (.jar, .exe, .dll, .apk, .ipa) | Yes | No |
| Fixes generated from decompiled bytecode | Yes | No |
| AI agents run offline in the customer environment | Yes | Yes |
Checkmarx data is based on public Checkmarx product pages and documentation as of September 2026.
Migration runs with no pause in scanning. Release checks continue while projects move to DerScanner.
Plan a migrationYes. DerScanner covers SAST, DAST, SCA, mobile and binary analysis, with AI agents for triage and fixes. It fits teams that need on-premises deployment, binary scanning or languages such as Delphi and COBOL.
DerScanner scans compiled applications without source code and runs its AI agents fully on-premises. In testing, Checkmarx detected a wider set of Java injection classes, and its IDE plugins show findings inline.
On the same test codebases, DerScanner found all listed critical vulnerabilities in authenticated DAST, where Checkmarx found none. In SCA, DerScanner detected 6 CVEs against 4. Checkmarx detected more injection types in SAST.
Yes. DerScanner installs on-premises, and DerTriage and DerCodeFix operate without internet access. Vulnerability databases in offline installations update manually.
43 languages, including Java, C#, Python, Go, Kotlin, Swift, Rust, COBOL, ABAP, Delphi, PL/SQL and Solidity. The full list is in the documentation.
A demo covers the modules planned for replacement and the languages in the current stack.
Prefer email? company@derscanner.com