By Rushabh Shah, Senior Software Developer · 2026-09-07
Checkmarx SCA's headline feature is "Exploitable Path" analysis: it correlates SCA findings with Checkmarx's own SAST engine to tell you whether a vulnerable library is actually reachable from your application code, not just present in the dependency tree — genuinely useful noise reduction that a manifest-only scanner (this one included) can't replicate without seeing your source. It's sold as part of the unified Checkmarx One platform, subscription-priced by user count, and reviewers consistently flag pricing as the thing they weigh most when comparing DevSecOps platforms.
DepWarden is a free, anonymous alternative for the faster, lower-commitment check. Paste a manifest, a lockfile, or an SBOM — or point it at a public repo — and get prioritized results in seconds, in a private, session-isolated workspace. No account, no per-seat subscription, and it never receives your source code — only the dependency manifest text.
Every component is checked against the full OSV mirror, then enriched with CISA KEV (actively exploited) and FIRST EPSS (exploit probability) — a short "fix these first" list instead of a raw CVE count, free on every scan.
To be fair: reachability analysis that's actually grounded in your real source code — not a manifest — is a genuinely different, deeper signal than anything a source-blind scanner can offer, and Checkmarx's SAST+SCA correlation is real engineering, not a marketing claim. Uploading source is exactly the trade DepWarden is built to avoid, so if call-graph-verified reachability is the requirement, Checkmarx (or a source-aware tool) is the right category.
Typosquat and dependency-confusion detection, OpenSSF Scorecard health, deprecated and end-of-life packages, plus a full compliance round-trip — ingest an existing CycloneDX or SPDX SBOM, export a CycloneDX SBOM, an OpenVEX document, and a NOTICE / license-obligations file.
Connect a GitHub, GitLab, Bitbucket or Azure DevOps repo branch with a personal access token and attach a schedule — daily, weekly or monthly — and DepWarden re-scans it automatically and emails a report. No token retained beyond the scan.
Try it: paste a pom.xml or package-lock.json and see prioritized findings in seconds — no sign-up, no per-seat subscription.