Why choose Oryon over Checkmarx One

1. 01

   Analysis starts on your machine.

   Local SAST, code, dependencies and configuration in your editor workflow. You control connected features and AI assistance, according to your plan.

2. 02

   From the editor to every delivery.

   The engine ships with the extension. Connect code analysis, dependencies and CI integrations with your team's platform in one workflow.

3. 03

   One review the whole team can reuse.

   Shared suppressions, history, scan comparisons, CSV exports and PDF reports. Detection becomes ongoing work your team can track.

Capabilities, side by side.

The table describes documented features; it does not measure performance or detection quality. Commercial features may depend on product, plan and configuration.

What you need	Code Security	Checkmarx One
Editor integration	✓Documented Scan as you edit or save, or start a file or repository scan; configure profiles and exclusions.	✓Documented VS Code, JetBrains and Visual Studio plugins; several VS Code-based editors are supported. ↗
Static code analysis	✓Documented Static analysis of code, secrets, infrastructure, pipelines and AI/MCP security. Combines patterns with data tracking within each file. Profiles and exclusions adapt the scan to the repository.	✓Documented Checkmarx One SAST. ↗
Dependencies	✓Documented Extends the inventory of packages and their relationships from the repository, including Maven projects. Automatically attempted in the extension and CI; native analyzers provide a fallback when it is unavailable.	✓Documented Checkmarx SCA within One, subject to the purchased license. ↗
Secrets	✓Documented Static analysis of code, secrets, infrastructure, pipelines and AI/MCP security. Combines patterns with data tracking within each file. Profiles and exclusions adapt the scan to the repository.	+Optional / plan dependent Secret Detection requires SCS and Enterprise Secrets in the account. ↗
CI integration	✓Documented Run the same analysis core from GitHub Actions and Azure Pipelines, with OIDC and a project token.	✓Documented CLI and plugins communicate with Checkmarx One. ↗
AI-assisted fixes	+Optional / plan dependent Explains causes, risk and impact and proposes changes, diffs, effort and verification checks. Available according to plan and configuration; the user reviews and applies the proposal in the editor.	+Optional / plan dependent Developer Assist and MCP remediation; a specific licensing model applies. ↗
SAST without SaaS code upload	✓Documented OpenGrep bundled with the extension; local SAST works offline once the engine is extracted. AI and sync use the network.	↗Another suite product On-prem SAST is another offering; One uses a server and ASCA covers files and snippets with a different scope. ↗
Infrastructure & configuration	✓Documented Rules for Terraform, Docker, Kubernetes, CI/CD and configuration; coverage depends on format and rule.	✓Documented IaC Security and KICS Realtime Scanner. ↗
Profiles & exclusions	✓Documented production_security/full profiles, path inclusion and exclusion, and .gitignore support.	✓Documented Scanner selection, file filters and project configuration. ↗
Selective MDN compatibility	✓Documented Selective MDN assessment: String.replaceAll against configured browsers. Other warnings require validation; this is not a general browser compatibility audit.	—Not documented in this scope No MDN compatibility assessment documented in the reviewed scope. ↗
Shared triage decisions	✓Documented Project-level shared false-positive suppressions, with restoration from the extension and dashboard.	✓Documented Shared states and comments; SAST/IaC triage from the IDE. ↗
History & reporting	✓Documented History, comparisons, audit PDF and JSON/CSV exports. The advanced AI report depends on the plan.	✓Documented History and PDF/JSON/CSV reports, with scanner-specific differences. ↗

Product scope