Checkmarx vs. Rencore Code (SPCAF)

If you are going with SAST process or want to improve overall security posture then go for it like integrating it with post deployment steps. If you are more concerned about proactive controls better choose other options such as pee-commit hooks and CI security. Also choose other tools for DAST and API scans.

Incentivized

For Microsoft shops that are doing custom development on the Microsoft cloud platform in Office 365 and Azure, the Rencore toolset is an absolute must, especially if you are involved in converting farm solutions to cloud, or just moving into cloud development for the first time.

• Supports a large number of languages
• Finds a large variety of potential risks

Incentivized

• Support - It is very quick relative to other vendors in this space and also very thorough.
• Product Features - It appears to be the only product in the market that has ALL the pieces for a baseline SPFx project versus no tools or manual activities.

• DAST capability can be the one where it does not support native use case of using OTP based arch
• API Scanning is something that lacks a bit due to not much customizations
• Branch wise reports for SAST is not available

Incentivized

• Rencore's product line is of course still a bit of a niche: SharePoint code quality is not something every organization on the planet is concerned with - although Rencore does much more than that.
• We feel Rencore's marketing efforts are mainly targeted at technologists. There's a lot of other potential, especially for their platform governance product.

Checkmarx's usability is generally good, but it can be a bit complex for new users. The interface may take some time to get used to, especially for those unfamiliar with security tools. Once you become familiar with it, it’s effective and integrates well into development workflows.

Incentivized

Happy with the fast and meaningful responses.

Incentivized

Checkmarx is easier to integrate with development tools and gives quick feedback during coding, which is helpful for developers. Veracode is more focused on scanning and reporting for compliance, but it’s more complex to set up. We chose Checkmarx because it fits better into our development process, offering faster scans and more useful suggestions for fixing problems

Incentivized

I don't know of any products that compete in the space and if there were any, they would not stand a chance against Rencore. Behind any good product is a team of highly skilled individuals, who all have the same goal, who are passionate what they do and lastly, are in it for the betterment of where they started; As Developers themselves. You can't buy that

• Great diversity of vulnerabilities covered.
• Quicker scans
• They are feature rich compared to other tools I used in the past.
• Dashboards are not customizable enough.
• High number of false positives take up time and sometimes make our report look bad.

Incentivized

• Valuable insights into large existing SharePoint customizations that would otherwise would have taken weeks to analyze and assess on quality.
• Without Rencore's tooling, it would be impossible to track changes to client-side code. For example, we can tell exactly who changed which JavaScript in which webpart in the environment.
• Transformation tools helped developers migrate their existing code bases to the cloud, while already providing an automatically translated code base to start from.