https://cybertoolchain.io/tools/checkmarx New releases and features in Checkmarx, tracked by The Cyber Toolchain. en Thu, 29 Oct 2026 15:36:21 GMT https://checkmarx.com/blog/what-the-php-patch-scramble-reveals-about-remediation/ https://checkmarx.com/blog/what-the-php-patch-scramble-reveals-about-remediation/ Thu, 29 Oct 2026 15:36:21 GMT Checkmarx adds AI-assisted triage, automated remediation suggestions, and a Fusion SAST engine that combines rule-based analysis with frontier-model reasoning⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Checkmarx adds Fusion SAST, combining established security analysis with frontier-model reasoning and a Findings Analysis Engine that consolidates results to reduce false positives and duplicate findings, reaching an F1 score of 0.74 versus 0.64 for the Next-Gen SAST foundation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Checkmarx adds Triage Assist (AI Triage) to evaluate whether a finding is reachable and exploitable, automatically setting a finding's state to `Confirmed` or `Proposed Not Exploitable` with reasoning visible in Risk Orchestration. • Checkmarx adds automated AI remediation support via Remediation Assist, letting admins define the projects, branches, scanners, and severity thresholds in scope so suggested fixes are generated automatically after a scan or automated triage completes. • Checkmarx adds project overrides so individual teams can adapt automated remediation settings where permitted. • Checkmarx adds Developer Assist to bring security analysis and remediation guidance into IDE and AI coding workflows, including supported autonomous workflows where it works with the coding agent to repeat remediation and rescanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkmarx https://checkmarx.com/inside-checkmarx-triage-remediation-assist/ https://checkmarx.com/inside-checkmarx-triage-remediation-assist/ Thu, 17 Sep 2026 16:36:07 GMT Checkmarx One gains AI-driven Triage & Remediation Assist to move SAST/SCA findings from detection to governed fix with full audit trail.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Triage with AI` control in the Risk Orchestration side panel to evaluate eligible SAST findings for reachability, exploitability, and sanitization coverage, automatically setting state to `Confirmed` or `Proposed Not Exploitable`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Remediate with AI` control for eligible confirmed SAST findings, generating a suggested code fix with a structured what/why/how explanation inside `Remediation > AI Remediation`. • Adds automated AI Triage at scan completion, configurable by project, branch, scanner, risk status, and severity, with administrator controls over which parameters a project team can override. • Adds an `AI Triage & Remediation` dashboard reporting total triage and remediation actions, unique developers, estimated developer time saved, activity trends, triage outcomes, remediation results, and most-active projects, with filters by resource, branch, scanner, time range, tags, and groups. • Adds GitHub Code Repository Integration support to automatically create a pull request containing the AI-suggested fix for SAST findings. • AI Triage state changes propagate forward to identical SAST findings in subsequent scans (matched by Similarity ID or Attack Vector ID) and retroactively to identical results in earlier scans, preventing duplicate verdict work. • AI-driven state changes are attributed to `AI Assist` in the Change Log with actor, timestamp, previous state, new state, severity change, and reasoning preserved on the same risk record. • Both `Triage with AI` and `Remediate with AI` actions consume Checkmarx Credits; triage does not re-run or re-charge on an identical finding, and administrators can monitor burn rate and projected depletion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkmarx https://checkmarx.com/inside-checkmarx-triage-remediation-assist/ https://checkmarx.com/inside-checkmarx-triage-remediation-assist/ Thu, 17 Sep 2026 16:36:07 GMT Checkmarx One adds AI-powered Triage & Remediation Assist to evaluate reachability, exploitability, and generate suggested code fixes for SAST and SCA findings.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Triage with AI` control in the Risk Orchestration side panel to evaluate eligible SAST findings for reachability, exploitability, and existing sanitization — setting state to `Confirmed` or `Proposed Not Exploitable` with AI attribution.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `Remediate with AI` control for eligible SAST findings, generating a suggested code fix surfaced in the `Remediation > AI Remediation` tab with a structured what/why/how explanation. • Adds automated AI Triage on scan completion, configurable by project, branch, scanner, risk status, and severity, with administrator control over which parameters a project team can override. • Adds an AI Triage & Remediation dashboard reporting total triage and remediation actions, unique developers, estimated developer time saved, activity trends, triage outcomes, remediation results, and top projects — filterable by resource, branch, scanner, time range, tags, and groups. • Propagates AI Triage state changes to identical SAST findings retroactively across earlier scans (matched by Similarity ID or Attack Vector ID depending on account settings) and forward into subsequent SCA scans (matched by package version and package manager, without retroactive application). • Both `Triage with AI` and `Remediate with AI` actions draw on Checkmarx Credits, with administrator visibility into burn rate and projected depletion. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkmarx https://checkmarx.com/blog/four-appsec-imperatives-from-black-hat-usa-2026/ https://checkmarx.com/blog/four-appsec-imperatives-from-black-hat-usa-2026/ Mon, 17 Aug 2026 13:55:03 GMT Checkmarx debuts Fusion multi-model SAST, AI Inventory/AI-BOM, Triage Assist, Remediation Assist, and autonomous Developer Assist MCP mode. • Adds `Developer Assist` autonomous mode, which uses hooks and MCP to intercept coding-agent actions such as file writes and package installations before they take effect, returning remediation guidance directly to the agent from an independent AppSec layer. • Launches `Checkmarx Fusion` (early access), a Multi-Model AI Engine that runs curated frontier models over the hybrid SAST engine's already-validated findings to surface novel and AI-generated-code vulnerabilities with no known rule, CVE, or signature — available as an optional, usage-based layer where teams choose higher- or lower-cost models per project. • Introduces `AI Inventory` and `AI-BOM` using deterministic analysis to identify models, agents, MCP servers, AI libraries, and SDKs across repositories, with findings traceable to specific files and lines of code, and versioned AI-BOM documentation generated per release. • Introduces `Triage Assist`, which applies AI reasoning to eligible SAST and SCA findings grounded in reachability, exploitability, code context, risk context, policy, and mitigating controls to distinguish actionable findings from acceptable risks and suspected false positives. • Introduces `Remediation Assist`, which provides review-ready guidance and suggested code changes for prioritized findings and, for supported GitHub Code Repository Integration projects, can open a separate pull request containing the proposed fix for developer review — nothing is merged automatically. • Adds `One Risk Orchestration` to correlate signals from SAST, SCA, infrastructure-as-code security, API security, secrets detection, containers, repository health, DAST, and third-party tools, enriched with exploitability, reachability, exposure, ownership, and business criticality for enforcement across pull requests, builds, and releases. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkmarx