Checkmarx CEO Sandeep Johri’s recent visit to the UK gave James Goulding the opportunity to find out more about the enterprise application security leader’s cloud native platform, Checkmarx One. He was assisted by Richard Hinson, Regional Sales Leader, UK, Nordics and Benelux, who was on hand to provide a UK perspective. We started out by asking for a quick overview of Checkmarx’s area of expertise and target market
Sandeep Johri (SJ):
Checkmarx is a leader in the application security space. We help developers make sure their applications are secure before they are pushed out into production.
We look for vulnerabilities in code or malicious code that might have been put in applications inadvertently. We check to make sure that there aren’t any vulnerabilities in code written by developers and highlight ones that we think are critical; we highlight vulnerable code in open source tools that developers are increasingly using; and we check for malicious code that hackers have put into open source packages. That’s known as supply chain security.
Then, when you package it and put it into the cloud, there are APIs involved, there are infrastructure configurations that need to be set up, and there could be vulnerabilities there as well. So we test that too. Once an application has gone through all this testing, you can put it into production safely.
Everything I described to you has a different acronym, and there are companies that cover each of those acronyms. One acronym is SAST, static analysis; another is SCA, software composition analysis, typically targeted at open source. Supply chain is typically targeted at malicious code, and then there’s IaC security, API security, container security and so one.
We are one of the only companies to have all these capabilities built on a single cloud native platform, which allows us to take all alerts and vulnerabilities identified by these individual engines, correlate them and put them in context. Sometimes by putting them in context, you can eliminate them or see that they’re not relevant. There’s a lot of benefit in that. Correlation is called ASPM, application security posture management. You look at all your vulnerabilities and figure out which ones are relevant and prioritise. That’s what we do, and we are recognised as one of the leaders in the category.
We have been in business for around 15 years. About 55% to 60% of our business comes out of the US, about 35% out of Europe and 5% to 10% out of APAC and the rest of the world. Within Europe, the UK is our largest country, with around 100 customers.
Worldwide, we have about 1,700 customers, including 40% of the global top 100, 50% of the top 50 banks and 100-plus government agencies in the US. We tend to focus on larger enterprises with more complex needs – some of our customers have literally billions of lines of code.
JG: The platform you mention is Checkmarx One. Is that a recent development?
SJ: Fifteen years ago, when we started, we had a couple of point products and they were on-prem. About four years ago, we started building out a modern cloud native platform. We launched it about three years ago and last year was the first year we led with that platform. This year, we are actively migrating some of our on-prem customers onto the platform.
Last year, 80% of our business was on Checkmarx One, with usage on the platform increasing 40x. We went from scanning two and a half billion lines of code in January to about 100 billion lines of code by December. Today, we scan about 130 billion lines of code on the Checkmarx One platform. We have invested over $150 million in the platform and we expect all of our customers eventually to move to it.
JG: So, a customer that’s using one of your point products now would use that same product on the platform but have the option to add new capabilities.
SJ: Yes, they could have just that single engine, but typically when a customer moves to the platform, they use more – 80% of customers on Checkmarx One end up with multiple engines. That’s one of the main benefits of a cloud native platform.
Richard Hinson (RH): It’s a consolidation play. The customer is thinking ‘I’ve got these myriad tools. I am using Checkmarx for SAST, for example, as one product on-prem. If I go to the platform, I can take out a number of different players and consolidate down to one platform, and also get consolidated results so I really know where my priorities lie’.
In the UK specifically, we’ve moved 32% of our customers across to the new platform. By the end of this year, we’ll be up to about 65%. We’re now getting down to customers that maybe for security reasons of their own don’t want to operate in the cloud. There’s very few of them left but there are one or two and obviously they will take longer to convert.
JG: What is driving demand for your products – is it the number of apps being developed or the greater complexity?
SJ: It is both. More apps are being developed, but just as important is the shift to the cloud. As large enterprises move more of their compute to the cloud, application security becomes even more critical, because more of your application surface is exposed to the public environment. When an application was deployed only in your data centre, you could control the perimeter, so, while you could not be lax about security, the criticality was a little less. People are even more focused on application security today because it is in the public cloud and there are just more attack surfaces – code, APIs, infrastructure, containers, storage.
JG: Is the C-suite sufficiently engaged with this or is there an education piece you need to do?
SJ: No, it is highly engaged. But there has been a shift. The CISO organisation and enterprises have always been engaged in application security, but it used to be a bit of an afterthought; the dev team would develop applications and then the security team would try to convince them they needed to fix this and that before the app could be shipped out. Enterprises moved to DevOps and are now taking a step further and moving to DevSecOps where they not only have an integrated product to dev, test and operate but also want security built in from the very beginning. Our deployments of Checkmarx One are mostly fully integrated with the dev cycle and dev tools. Developers, for example, will have a plugin for security within their IDE (integrated development environment).
JG: Don’t developer tools have a security element within them already?
SJ: Some do, some don’t. But even the ones that do typically don’t have very sophisticated security capabilities. GitHub is quite a common dev tool. It’s part of Microsoft, and they have something called GitHub Advanced Security, which seems to work well or OK for smaller customers and relatively simplistic environments. But it is not security-focused enough for large enterprises with complex deployments. It’s kind of okay, which doesn’t work for a large bank or a large federal agency.
JG: Obviously, a lot of developers are using GenAI. What are the risks you’ve identified with that and how are you addressing them?
SJ: People are trying to adopt Gen AI as quickly as possible because it has huge benefits for developers including a 15% or 30% or 40% productivity increase. That means you will have 30% to 40% more code coming into the enterprise that happens to be auto-generated – and just because code is auto- generated by GenAI doesn’t mean it is vulnerability-free. We now have a plugin that can scan code and check for vulnerabilities as people use generative AI systems, before they bring it into the enterprise.
The second set of vulnerabilities that GenAI introduces are hallucinations. There have been instances where someone looking for an open source package to do a specific thing has asked
GenAI if there is one and it has hallucinated and just created one. You think you’re using an open source package, but it’s actually something the GenAI system has created for you. That’s a new kind of vulnerability and we check for that as well. We launched a number of AI capabilities for Checkmarx One several weeks ago.
We’re also using GenAI to improve the product itself. Developers are not always experts on security issues, so when we surface a vulnerability we can make a recommendation on how to fix it, based on GenAI. This improves developer productivity because they don’t need to become experts in XYZ vulnerabilities.
JG: Do you remediate problems you identify?
SJ: We tell developers how to remediate. We identify the problem and then we can tell them how to fix it. We have two capabilities there. One is a set of training tutorials that describe a vulnerability, how it manifests itself and how you should address it. And then with GenAI we can suggest a code to do it.
JG: What should we be looking out for from Checkmarx this year?
SJ: We launched our AI portfolio a few weeks ago. That was a big launch for us. We are planning to launch ASPM and continue to roll out more capabilities on our Checkmarx One platform. A lot of that investment is in GenAI. We continue to improve the developer experience because it needs to be a developer-first product. GenAI ASPM is a category that we’re investing a lot in, which is how you get value across the platform. Lastly, we are doing a lot of integrations with cloud runtime security tools, so that we can deliver code to cloud, which is the holy grail in security. People want to make sure that they’re secure from the first line of code that’s written all the way to deployment. We cover everything pre-deployment and we integrate with runtime security tools, so you get an end-to-end view.
