Checkmarx One vs TruffleHog

Quote on request

Free tier available

Enterprise annual licensing, typically by developer count or lines of code. Six figures at scale.

Free CLI; the enterprise platform adds continuous monitoring and reporting, priced on request.

Free trial.

Open-source CLI is free and fully functional including verification.

Widely used

Checkmarx · since 2006

Widely used

Truffle Security · since 2016

• Very deep SAST analysis with wide language coverage including legacy enterprise languages.
• One platform and one risk view across every scan type.
• Strong compliance and audit reporting.

• Live verification cuts false positives to near zero for supported providers.
• Free and easy to add as a pre-commit hook or CI step.
• Scans far beyond git — buckets, images, logs.

• Expensive, with a long procurement and deployment cycle.
• High false-positive volume typical of deep SAST; tuning is a project.
• Scans are slow relative to developer-first tools.

• No dashboard or workflow in the free CLI.
• Verification requires outbound network calls, which some environments block.
• Full-history scans on large repositories are slow.

Large enterprises with a security function and regulatory obligations.

Teams that want free, high-signal secret scanning in the pipeline today.