Konvu vs Checkmarx: Validating Checkmarx Findings Before Developers See Them (2026)

Quick verdict: Keep Checkmarx One for detection and AI Triage, and add Konvu when your reviewers need evidence for each exploitability condition before they dismiss a Checkmarx finding. Konvu reproduces the exploit against its own copy of your app, ships the fix, and covers Go, Ruby, PHP and Rust dependencies, which Checkmarx's Exploitable Path does not.

Checkmarx One detects vulnerabilities across SAST, SCA, secrets, IaC, APIs, containers and AI components, and its AI Triage triages SAST and SCA findings inside the platform, with a reviewer making the final call on each dismissal. Konvu starts from findings your scanners already produced, Checkmarx's included, and returns a verdict with evidence for each exploitability condition. For dependencies, Checkmarx's Exploitable Path covers Python, Java, JavaScript and C#, works from the most recent full SAST scan, and finds paths only for packages called directly in the code, not through reflection (checked Oct 13, 2026), while Konvu's exploitability assessment also covers Go, Ruby, PHP, Rust, Scala and Kotlin. The automated path from a Checkmarx pipeline uses Konvu's API, on the Enterprise plan.

The question each one answers

Checkmarx One detects and triages in the same platform. Its Triage Assist "evaluates whether the vulnerable method is reachable and whether the condition is exploitable," checks for masking or sanitization, and leaves each dismissal to a reviewer (Checkmarx). For some teams that is enough.

Konvu starts from a finding a scanner already produced and asks whether an attacker can use it in this deployment. For a dependency, it checks four preconditions, from installation to attacker-controlled input and configuration, with evidence for each. Then it attacks the finding, dependency or Checkmarx SAST result alike, to prove the exploit. Both tools go past reachability. They differ in where they run, which findings they cover, and the evidence a reviewer gets. Detection stays with Checkmarx.

Side by side

How Checkmarx decides a finding

SAST result states

New SAST results start as To Verify, meaning the result "hasn't been assessed by your AppSec team yet" (Triaging SAST Results, modified Aug 16, 2026). The other preconfigured states are Not Exploitable, Proposed Not Exploitable, Confirmed and Urgent. A move to either Not Exploitable state requires a note, and "a change log at the bottom tracks all past changes for a single result."

AI Triage

AI Triage, part of Triage & Remediation Assist, is generally available, "currently supported for the SAST and SCA scanners only," and uses credits "each time that a Triage or Remediation action is run" (AI Triage & Remediation, modified Oct 11, 2026).

Checkmarx's September 17, 2026 article explains the logic (Inside Checkmarx Triage & Remediation Assist). Triage Assist "evaluates whether the vulnerable method is reachable and whether the condition is exploitable," and "it checks whether masking or sanitization measures prevent exploitation." In Checkmarx's words: "Reachable, exploitable, unmitigated: those three conditions are what make a finding Attackable."

A reachable and exploitable finding goes to Confirmed. Otherwise AI Triage sets Proposed Not Exploitable, which "is not a final false-positive determination, and it does not remove the finding from reporting." The reviewer is asked to "validate it against the application's expected lifecycle and deployment conditions," then keep the proposal, mark the finding Confirmed, change it to Not Exploitable, or return it for investigation. "The agent proposes. The human disposes."

Checkmarx chose this design. A person signs off on every dismissal inside the system of record, and "AI triage changes are also recorded in the Change Log." If your policy requires human sign-off on each dismissal, AI Triage meets it without a second tool.

Exploitable Path for dependencies

For SCA, Exploitable Path asks: "Is there a path from your project code into the vulnerable package code" (Exploitable Path, modified Oct 6, 2026). The documented scope:

• "Supported languages: Python, Java, JavaScript and C#."
• "Exploitable Path is based on results from the most recent full SAST scan of the project," and "results from incremental scans aren't considered."
• "Exploitable paths created by reflection are not supported."
• "We find exploitable paths only for packages that are called directly in the code."

Exploitable Path is call-path reachability, and AI Triage adds its exploitability and sanitization checks on SCA findings. Neither page describes checks for configuration options or attacker-controlled input (checked Oct 13, 2026). Checkmarx's March 24, 2026 post on Attackability describes triage that "traces attacker-controlled inputs from real ingress points to potential impact" (Checkmarx blog). Ask Checkmarx how that applies to your SCA findings.

In early access

Two newer capabilities may change parts of this page. We will revisit it when either reaches general availability.

• Finding Analysis Engine, announced June 15, 2026. It "reasons over every raw finding, suppressing false positives and confirming true ones." Checkmarx reports an F1 score of 0.64 across seven production codebases in its own evaluation, and says the engine reduces false positives by 60% (press release).
• Checkmarx Fusion, announced July 28, 2026. Checkmarx calls it "a new hybrid scanning approach" that combines its engines with Anthropic models. Through Amazon Bedrock, customers' "scanning workloads run entirely within their own cloud environment" (press release).

How Konvu decides a finding

Dependency findings

Konvu checks each dependency finding against four preconditions, with reachability as one of them (Reading an assessment, reachability analysis). All four must hold for the vulnerability to apply to you.

1. Dependency installed. The affected package and version are in your manifest or lockfile.
2. Environment. The application runs on an OS, runtime version or platform the vulnerability affects.
3. Code reachability. The vulnerable function is "imported, referenced, or reachable through your call graph."
4. Attacker controllability. User-controlled input reaches the vulnerable function, the dangerous configuration options are enabled, and no validation, sanitization or safe API variant blocks the exploit.

The conditions for each CVE come from a vulnerability database Konvu builds from OSV, GHSA and NVD, enriched with the vulnerable method signatures (Vulnerability enrichment). Each precondition is marked met, not met or inconclusive, with file paths, code snippets or written reasoning. The verdict follows:

• All met: Exploitable.
• Any not met: False positive.
• Some inconclusive, and Konvu has a question that could settle it, such as "Is this service internet-facing?": Needs input (Answering Konvu's questions).
• Some inconclusive, with no question to ask: Inconclusive.

Konvu keeps every assessment attempt, with the evidence available at the time (How assessments work). It assesses a dependency finding once the repository is connected through GitHub or GitLab, or on Enterprise through GitHub Enterprise Server, GitLab self-managed, Bitbucket Data Center or Azure DevOps Server (Bring in findings, Checkmarx integration).

Checkmarx SAST findings

When automated triage is on, Konvu splits a Checkmarx SAST export, as SARIF or JSON, into one report per finding (External reports). It checks each report against scope, links duplicates, and reproduces the valid ones: it deploys its own copy of your application in an isolated lab, runs the exploit from a separate host, and records the requests, the responses and the observed impact (How reproduction works). Those end as Reproduced, with the proof, or as False positive, Hardening or Inconclusive, with the evidence (Vulnerability reports, Checkmarx integration).

Proof and the fix. Dependency findings get the same attack and keep the same proof. When the attack disproves the finding, its verdict changes to False Positive, with the evidence. If the lab cannot build what the exploit needs, Konvu records why, and the verdict from the checklist stands. For exploitable findings, Konvu opens a draft fix PR that runs your tests, or hands a remediation plan to your coding agent, then re-runs the same exploit against the fix branch to confirm it no longer fires.

For scale: in one Global Fortune 500 customer's Black Duck SCA backlog, Konvu assessed 96% of findings as false positives and 4% as exploitable (case study). That is one customer's backlog, not a benchmark.

Where Checkmarx is stronger

• Detection. Checkmarx One finds the vulnerabilities, across code, dependencies, secrets, IaC, APIs, containers and AI components (platform). Konvu's analysis needs a scanner's findings to start from.
• Deployment options. Checkmarx supports self-hosted and on-premises deployment "for teams with data residency, air-gapped, or regulatory requirements" (pricing).
• Custom detection. CxQL lets a team teach the scanner its own sanitizers and frameworks, and AI Query Builder, generally available since January 15, 2026, writes CxQL from a plain-language request (Checkmarx). A tuned query removes a false positive before any triage tool sees it.
• The IDE. Developer Assist works "in real time within the IDE" (Checkmarx One Assist). Konvu works on scan results, and its Guardrails run inside Claude Code and Codex.
• One system of record. Result states, required notes, the change log, and tickets in Jira, GitHub Issues or Azure DevOps all live in Checkmarx One (Feedback Apps). Konvu keeps its verdicts and evidence in Konvu and opens Jira tickets on Enterprise. Someone still records each decision in Checkmarx.
• Analyst standing. Gartner named Checkmarx a Leader in the 2025 Magic Quadrant for Application Security Testing, its seventh time (press release), and a Leader in the first Magic Quadrant for Software Supply Chain Security in June 2026 (press release).

Konvu's limits

• A pipeline step, not a native connector. Your pipeline sends results to Konvu after each scan (Checkmarx integration).
• The automated path needs Enterprise. Dependency findings arrive only through the API or CLI, both on the Enterprise plan (pricing). SAST exports can also be uploaded by hand in the dashboard (External reports).
• Partial coverage. KICS IaC results and Checkmarx container results are not imported. The integration is documented for Checkmarx One.
• Source control. Dependency verdicts wait until the repository is connected. Konvu reads code from GitHub and GitLab. Enterprise adds GitHub Enterprise Server, GitLab self-managed, Bitbucket Data Center and Azure DevOps Server (pricing). Konvu's docs list the cloud versions of Azure DevOps and Bitbucket as coming soon (What is Konvu).
• Not air-gapped. Self-hosted analysis on Enterprise runs in your Kubernetes cluster, with optional bring-your-own LLM keys, but still sends metadata to Konvu (security, pricing).
• No published accuracy benchmark. Each verdict carries its evidence, and each proven finding its exploit run. Test Konvu on your own findings.

Running both

1. Checkmarx One scans as it does today.
2. A pipeline step after the scan sends results to Konvu with an organization API key (API). Dependency findings go to POST /sca_findings or konvu finding submit, with the repository and manifest file, and resending the same findings updates them instead of creating duplicates (Bring in findings). SAST results go up as a SARIF or JSON export. A repeat upload creates new reports, which Konvu links to the earlier ones as duplicates instead of running them twice (External reports).
3. Konvu returns verdicts with evidence, proves the exploitable ones and fixes them with a draft PR that runs your tests or a plan for your coding agent (Fix pull requests). A daily Slack digest lists the dependencies newly confirmed exploitable (Slack digest). On Enterprise, Konvu also opens Jira tickets.
4. Someone records the outcome in Checkmarx One: Not Exploitable with the required note, or Confirmed. Konvu's evidence can go in that note.

The setup is one pipeline step and an Enterprise plan for the API. Step 4 stays manual. If AI Triage stays on, both tools bill for the same findings, Checkmarx in credits per run and Konvu per confident verdict, and a reviewer can check each proposal against Konvu's evidence. If your Checkmarx SCA findings also flow through ArmorCode, Konvu can add its assessment to them there as a comment and a tag, without changing their ArmorCode status (ArmorCode).

Konvu is probably not worth adding if every finding comes from Checkmarx One, your reviewers keep up with AI Triage proposals, and your dismissals do not need evidence per condition.

Pricing models

Checkmarx One does not publish prices. It "is priced per package and tailored to your environment," with quotes based on modules, deployment model and "the number of developers in scope" (pricing). The packages are Essentials, Professional, Enterprise, Start with SAST and Start with Supply Chain, with Checkmarx Assist and Fusion as add-ons on each. AI Triage runs consume Checkmarx Credits.

Konvu bills for confident verdicts and successful fix PRs. Business is $2,000 a month and includes 400 confident verdicts. "Inconclusive runs and failed PRs are free." API and CLI access is on Enterprise, custom priced on annual contracts (pricing), so plan on Enterprise for the automated Checkmarx path.

Sources checked

All sources checked on October 13, 2026.

• Checkmarx: Application Security Platform, Checkmarx One Assist, Triage & Remediation Assist post, AI Triage & Remediation docs, Triage and Remediation page, Triaging SAST Results, Exploitable Path, Reachability blog post, Feedback Apps, AI Query Builder, Finding Analysis Engine, Checkmarx Fusion, Pricing, AST Magic Quadrant, SSCS Magic Quadrant
• Konvu: Product, Pricing, Security, Reachability analysis, Checkmarx integration, Global Fortune 500 case study, What is Konvu, Dependencies (SCA), Reading an assessment, How assessments work, Answering Konvu's questions, Vulnerability enrichment, Vulnerability reports, How reproduction works, Bring in findings, External reports, API documentation, Fix pull requests, Slack daily digest, ArmorCode connector, Self-hosted analysis

Related comparisons

• Checkmarx vs Veracode: Source-code analysis with CxQL against binary analysis with managed accuracy.
• Checkmarx vs Black Duck: Checkmarx One's single platform against the Black Duck portfolio on SCA depth, FedRAMP and safety-critical work.
• SCA vs SAST: The two scanning categories whose findings Konvu assesses.