# Checkmarx

> Mediated Wiki article. Canonical URL: https://mediated.wiki/source/Checkmarx
> Markdown URL: https://mediated.wiki/source/Checkmarx.md
> Source: https://en.wikipedia.org/wiki/Checkmarx
> Source revision: 1356241076
> License: Creative Commons Attribution-ShareAlike 4.0 International (https://creativecommons.org/licenses/by-sa/4.0/)

**Checkmarx** is an [information security](/source/Information_security) company specializing in [software application security testing](/source/Application_security) and [risk management](/source/Risk_management) for [software supply chains](/source/Software_supply_chain). It is headquartered in [Atlanta, Georgia](/source/Atlanta) in the United States.[1] It has over 900 employees.[1]

## Background

Before founding Checkmarx, Maty Siman worked in the [Mamram](/source/Mamram) unit of the [Israeli Defense Forces](/source/Israeli_Defense_Forces) (IDF) and later in the [Matzov](/source/Matzov) unit. Then he worked a two years term until February 2006 as an advisor at the Israeli [Prime Minister's Office](/source/Prime_Minister's_Office_(Israel)).[2]

## History

Checkmarx was founded in 2006 by Maty Siman and Emmanuel Benzaquen.[3][1]

In 2017, Checkmarx acquired Codebashing to add AppSec training.[4] The following year, it acquired Custodela, DevSecOps consulting firm.[5][6]

Checkmarx was acquired in April 2020 by Hellman & Friedman, a [private equity firm](/source/Private_equity_firm) with headquarters in San Francisco.

In August 2021, Checkmarx acquired Dustico, a software that detects backdoors and malicious attacks in the software supply chain.[7][8]

In 2023, founder Emmanuel Benzaquen stepped down as CEO and was succeeded by Sandeep Johri.'[9]

Checkmarx announced in December 2025 that it had acquired Tromzo, a California-based company known for its AI-native autonomous security agents.[10] No financial details were made public. Checkmarx stated that Tromzo’s founders, Harshil Parikh and Harshit Chitalia, together with their full AI engineering team, will transition to Checkmarx’s product and engineering division.[11] Tromzo’s [cognitive architecture](/source/Cognitive_architecture) and reasoning engine will serve as an intelligence layer throughout the Checkmarx One platform and will drive new Assist agents beginning in early 2026.[12]

In March 2026, two Checkmarx-maintained [GitHub](/source/GitHub) Actions were compromised by threat actors injecting credential-stealing malware which harvested cloud, GitHub, and CI/CD secrets from affected workflows, enabling potential cascading supply-chain compromises. [13]

## Research

Checkmarx maintains a research division, Checkmarx Zero, that has published findings on vulnerabilities and software supply chain risks:

- In 2019, researchers disclosed flaws in Google and Samsung [Android](/source/Android_(operating_system)) camera apps that could enable remote surveillance.[14]
- In 2022, *Ars Technica* reported a flaw in the Ring Android app that exposed sensitive user data.[15]
- In 2025, Checkmarx reported malicious Python packages on PyPI designed to exfiltrate data.[16]
- In 2025, *Cybersecurity Dive* reported survey data from Checkmarx indicating that 98% of organizations experienced breaches linked to software flaws.[17]
- In 2025, *ITProToday* covered research warning that AI-generated code creates "blind spots" in DevSecOps.[18]

Independent reporting on Checkmarx research also examined manipulation risks in AI coding agents via a "lies-in-the-loop" technique,[19] alongside broader supply-chain findings in public repositories.[20] Survey reporting highlighted that most organizations experienced breaches tied to vulnerable code amid growing adoption of AI development tools.[21]

## Funding

Checkmarx's early investors include [Salesforce](/source/Salesforce), which remains a partner as Checkmarx provides security reviews for the Salesforce AppExchange.[22][23][24] In 2015, U.S. private equity and venture capital firm [Insight Partners](/source/Insight_Partners) acquired Checkmarx for $84 million.[24][1][3]

In April 2020, private equity firm [Hellman & Friedman](/source/Hellman_%26_Friedman), alongside private investment firm TPG,[25] acquired Checkmarx for $1.15 billion.[1][3][26] After the acquisition, Insight Partners retained a minority interest in the company.[1][27]

## See also

- [Security testing](/source/Security_testing)

## References

1. ["Hellman & Friedman Acquires Checkmarx for $1.15B"](https://www.darkreading.com/application-security/hellman-friedman-acquires-checkmarx-for-1-15b). *Dark Reading*. 16 March 2020. Retrieved 2024-05-06.

1. Bar-Yosef, Noa (November 20, 2012). ["Security Startups: In Focus With CheckMarx Founder Maty Siman"](https://www.securityweek.com/security-startups-focus-checkmarx-founder-maty-siman/). *SecurityWeek*

1. ["Insight Partners sells security firm Checkmarx to Hellman & Friedman for $1.15B"](https://techcrunch.com/2020/03/16/insight-partners-sells-security-firm-checkmarx-to-hellman-friedman-for-1-15b/). *TechCrunch*. 16 March 2020. Retrieved 2020-09-01.

1. ["App security co Checkmarx buys UK co Codebashing"](https://en.globes.co.il/en/article-app-security-co-checkmarx-buys-uk-co-codebashing-1001198477). *Globes*. 2017-07-24. Retrieved 2025-11-21.

1. Wenkert, Amarelle (2018-11-08). ["Cybersecurity Company Checkmarx Buys Ontario-based Custodela"](https://www.calcalistech.com/ctech/articles/0,7340,L-3749426,00.html). *CTECH - www.calcalistech.com*. Retrieved 2020-09-09.

1. ["Checkmarx Acquires Custodela"](https://www.darkreading.com/vulnerabilities---threats/checkmarx-acquires-custodela/d/d-id/1333222). *Dark Reading*. 8 November 2018. Retrieved 2020-09-09.

1. ["Checkmarx acquires open-source supply chain security startup Dustico"](https://techcrunch.com/2021/08/05/checkmarx-acquires-open-source-supply-chain-security-startup-dustico/). *TechCrunch*. 5 August 2021.["Checkmarx’s Dustico acquisition bolsters the open source software supply chain"](https://venturebeat.com/business/checkmarxs-dustico-acquisition-bolsters-the-open-source-software-supply-chain/). *VentureBeat*. 2021-08-09. [Archived](http://web.archive.org/web/20231003110122/https://venturebeat.com/business/checkmarxs-dustico-acquisition-bolsters-the-open-source-software-supply-chain/) 2023-10-03 at the Wayback Machine. Retrieved 2025-11-21.

1. Page, Carly (2021-08-05). ["Checkmarx acquires open-source supply chain security startup Dustico"](https://techcrunch.com/2021/08/05/checkmarx-acquires-open-source-supply-chain-security-startup-dustico/). *TechCrunch*. Retrieved 2025-11-21.

1. ["Checkmarx CEO Benzaquen stepping down after 17 years in latest shakeup at cyber unicorn"](https://www.calcalistech.com/ctechnews/article/sjnolii0o). *ctech*. 2023-02-28. Retrieved 2025-11-21.

1. ["Checkmarx acquires Tromzo: Leap in autonomous AppSec"](https://www.sourcesecurity.com/news/checkmarx-acquires-tromzo-leap-autonomous-appsec-co-14655-ga-co-1765370195-ga-1765370885.html). *SourceSecurity.com*. 10 December 2025. Retrieved 10 December 2025.

1. Dorbian, Iris (10 December 2025). ["PE-backed Checkmarx acquires tech company Tromzo"](https://www.pehub.com/pe-backed-checkmarx-acquires-tech-company-tromzo/). *PE Hub*. Retrieved 10 December 2025.

1. Chowdhry, Amit (9 December 2025). ["Checkmarx Buys Tromzo To Advance Agentic Application Security"](https://pulse2.com/checkmarx-buys-tromzo/). *Pulse 2.0*. Retrieved 10 December 2025.

1. Ravie Lakshmanan (24 March 2026). ["TeamPCP Hacks Checkmarx GitHub Actions Using Stolen CI Credentials"](https://thehackernews.com/2026/03/teampcp-hacks-checkmarx-github-actions.html). *The Hacker News*

1. ["Camera app vulnerability could allow surveillance of Android users"](https://www.securityweek.com/camera-app-vulnerability-could-allow-surveillance-android-users). *SecurityWeek*. 19 November 2019. Retrieved 5 October 2025.

1. ["Ring Android bug could let rogue apps spy on camera feeds"](https://arstechnica.com/information-technology/2022/08/ring-android-bug-could-let-rogue-apps-spy-on-camera-feeds/). *Ars Technica*. 29 August 2022. Retrieved 5 October 2025.

1. ["Checkmarx surfaces malicious effort to compromise software supply chains"](https://devops.com/checkmarx-surfaces-malicious-effort-to-compromise-software-supply-chains/). *DevOps.com*. 15 January 2025. Retrieved 6 October 2025.

1. ["Developers knowingly push vulnerable code, despite growing breach risk"](https://www.cybersecuritydive.com/news/software-vulnerabilities-breaches-checkmarx-report/757793/). *Cybersecurity Dive*. 3 September 2025. Retrieved 5 October 2025.

1. ["AI code generation creates blind spots in DevSecOps security"](https://www.itprotoday.com/devops/ai-code-generation-creates-blind-spots-in-devsecops-security). *ITProToday*. 20 July 2025. Retrieved 5 October 2025.

1. ["Lies-in-the-loop attack shows risks in AI coding agents"](https://www.darkreading.com/application-security/-lies-in-the-loop-attack-ai-coding-agents). *Dark Reading*. 12 September 2025. Retrieved 6 October 2025.

1. ["Checkmarx surfaces malicious effort to compromise software supply chains"](https://devops.com/checkmarx-surfaces-malicious-effort-to-compromise-software-supply-chains/). *DevOps.com*. 3 September 2025. Retrieved 6 October 2025.

1. ["Developers knowingly push vulnerable code, despite growing breach risk"](https://www.cybersecuritydive.com/news/software-vulnerabilities-breaches-checkmarx-report/757793/). *Cybersecurity Dive*. 3 September 2025. Retrieved 6 October 2025.

1. Scheer, Matt (2020-07-27). ["Security Checks When Submitting Apps to the Salesforce ISV Team"](https://www.crmscience.com/single-post/2020/07/22/conduct-security-checks-before-submitting-apps-to-the-salesforce-isv-team). *crmscience*. Retrieved 2020-11-13.

1. ["Checkmarx Raises Funding From Salesforce.com, Ofer Hi-Tech"](https://techcrunch.com/2011/10/11/checkmarx-raises-funding-from-salesforce-com-ofer-hi-tech/). *TechCrunch*. Retrieved 2020-09-04.

1. ["Insight Venture Partners to buy Israeli co Checkmarx - Globes"](https://en.globes.co.il/en/article-insight-venture-partners-to-buy-israeli-co-checkmarx-1001045698) (in Hebrew). *en.globes.co.il*. 2015-06-17. Retrieved 2020-09-09.

1. ["In $1.15 Billion Deal, Hellman & Friedman Acquires DevOps Firm Checkmarx | Israel Defense"](https://www.israeldefense.co.il/en/node/42627). *www.israeldefense.co.il*. 17 April 2020. Retrieved 2020-10-21.

1. ["3 Israeli cybersecurity firms win Black Unicorn Awards"](https://www.israel21c.org/3-israeli-cybersecurity-firms-win-black-unicorn-awards/). *ISRAEL21c*. 2019-08-22. Retrieved 2020-10-21.

1. Novinson, Michael (2020-06-24). ["The Biggest 10 Cybersecurity Acquisitions Of 2020 (So Far)"](https://www.crn.com/slide-shows/security/the-biggest-10-cybersecurity-acquisitions-of-2020-so-far-/8). *CRN*. Retrieved 2020-09-04.

---
Adapted from the Wikipedia article [Checkmarx](https://en.wikipedia.org/wiki/Checkmarx) by Wikipedia contributors ([contributor history](https://en.wikipedia.org/wiki/Checkmarx?action=history)). Available under [Creative Commons Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/). Changes may have been made.