Divya Agarwal
New architecture combines the highest fidelity, AI reasoning, validation, and enrichment over the codebase
Pune (Maharashtra) [India], July 30: Checkmarx, the leader in agentic application security, today announced Checkmarx Fusion, a new hybrid scanning approach now available in early access to Checkmarx customers. Checkmarx Fusion combines Checkmarx’s industry-leading AppSec engines and proprietary security context with leading frontier models from Anthropic. The result is the most complete vulnerability detection available, spanning every language, every codebase, and every stage of the software development lifecycle.
The need has never been more urgent. According to Checkmarx’s 2026 Future of Application Security report, 49% of production code is now AI-generated. As AI fuels development, the volume and complexity of vulnerabilities is outpacing the tools and processes organizations have relied on to manage them.
“We are at an inflection point in application security,” said Sandeep Johri, CEO of Checkmarx. “AI has driven code volume, delivery speed, and risk complexity beyond what any organization can manage with yesterday’s thinking. Checkmarx Fusion is the answer to that moment: deterministic precision and frontier AI reasoning, delivered in an integrated enterprise-grade cloud architecture. This is how code security has to work from here.”
“Enterprise application security is one of the most consequential domains for AI reasoning, because the complexity is high, the cost of error is real, and speed matters,” said Ashraf Alhashim, Head of Enterprise Cybersecurity GTM, Anthropic. “Checkmarx Fusion is a compelling example of what becomes possible when organizations bring frontier AI intelligence to bear within the kind of deep security context Checkmarx has spent decades building.”
Checkmarx Fusion is an integral component of Checkmarx One, purpose-built to address the limitations of single-approach vulnerability detection – offering complete vulnerability detection, at enterprise scale, without the cost and performance penalties of standalone AI scanning. It uniquely synthesizes outputs from multiple scanning engines, confirming true positives and reducing false positives. The result is the highest-fidelity vulnerability detection in the industry, achieving an F1 score of 0.741, nearly four times the category average.
Checkmarx Fusion’s deterministic foundation draws on two decades of trusted Checkmarx AppSec research, delivering consistent, high-precision vulnerability detection across established languages and attack patterns.
A multi-model AI engine extends detection to any language outside a fixed rule set, including AI-generated code, emerging languages for complete coverage. It operates within Checkmarx’s proprietary security context, ensuring AI reasoning is grounded in real application risk rather than pattern-matching alone. For the deepest reasoning, customers can easily select among Claude models.
Checkmarx Fusion’s proprietary architecture is built for enterprise efficiency and control at scale. Model optionality ensures customers can optimize cost and performance without sacrificing coverage, delivering faster scan times and lower operational costs. Leveraging Amazon Bedrock, scanning workloads run entirely within their own cloud environment, ensuring source code never leaves their infrastructure boundary. For organizations in regulated industries, this architecture directly addresses the data residency and compliance requirements that have historically made AI-powered security tooling difficult to adopt at scale.
“With AI generating unprecedented amounts of code, security has to be an enabler, not a bottleneck,” said Erik Brown, Business Information Security Officer, AppSec Leader, Nelnet. “This hybrid approach combining rules-based precision with AI-powered reasoning gives AppSec teams a way to scale while delivering high fidelity performance. The industry finally has an approach built for what AI demands.”
“AI-driven security has become a board-level conversation. The question I hear every day is no longer whether we have vulnerabilities—it’s whether we’ve discovered the ones that matter most and whether we’re fixing them fast enough,” said Mustapha Kebbeh, Chief Security Officer, UKG. “That’s exactly what Checkmarx Fusion is built to address: giving organizations confidence that they’re not missing what matters, while enabling teams to prioritize and remediate critical vulnerabilities faster.”
Checkmarx Fusion is available in early access now as part of the Checkmarx One platform. Checkmarx Fusion will be demonstrated at Black Hat USA in Las Vegas. The Checkmarx booth is #4553. To register for a meeting at Black Hat, visit checkmarx.com/black-hat/, or to request early access and learn more, visit Checkmarx.com/platform/checkmarx-fusion.
About Checkmarx
Checkmarx is the leader in agentic application security, delivering enterprise-grade protection while lowering engineering costs and accelerating development velocity. The Checkmarx One platform scans trillions of lines of code each year, enabling companies to cut vulnerability density by more than half. Autonomous security agents continuously detect and counter AI-driven threats across the software development lifecycle, delivering prevention-first protection for legacy, modern, and AI-generated code at enterprise scale. Follow Checkmarx on LinkedIn, YouTube, and X.
If you object to the content of this press release, please notify us at [email protected]. We will respond and rectify the situation within 24 hours.
