Checkmarx Unveils Hybrid SAST Engine For AI-Era Application Security

KUALA LUMPUR, June 16 (Bernama) -- Checkmarx, a leader in agentic application security, has announced a major advancement to the Checkmarx One platform, a new hybrid static application security testing (SAST) scanning engine designed to deliver what the company says is the industry's highest fidelity, as measured by F1 score.

The company introduced a next-generation SAST hybrid scanning engine within Checkmarx One that combines three layers of protection, namely a deterministic rules-based foundation refined through two decades of enterprise application security (AppSec), a purpose-tuned large language model (LLM) engine, and the new Finding Analysis Engine (FAE).

The LLM engine extends scanning capabilities to any language, including artificial intelligence (AI)-generated code and emerging programming languages, while the FAE confirms true positives and suppresses false positives before findings reach developers.

“No single approach – rules-based or AI – tells the whole story on its own. Deterministic scanning has earned its place as the precision standard, and AI extends that reach to code the rules were never written for.

“But neither alone separates the findings that matter from the ones that do not. At today's volumes, that noise is what slows teams down and drives up cost. Checkmarx One’s hybrid engines bring together the best of both in a fundamentally different architecture,” said its Chief Executive Officer, Sandeep Johri in a statement.

In testing across seven production codebases, Checkmarx said its hybrid engine achieved an F1 score of 0.64, more than three times the 0.20 average recorded by competing approaches evaluated by the company, while reducing false positives by 60 per cent.

According to Checkmarx, the results allow teams to cut through large volumes of findings, focus remediation on genuinely exploitable vulnerabilities and better manage risks introduced by AI-generated code.

The new engine offers language-agnostic scanning capabilities that address gaps introduced by AI coding assistants without compromising precision in established programming languages. It also provides what the company describes as board-grade evidence of exploitable vulnerabilities and resolved issues, enabling organisations to make risk decisions based on actual attackability rather than raw vulnerability counts.

The hybrid scanning engines and Finding Analysis Engine are now available in early access as part of the Checkmarx One platform.

-- BERNAMA