Checkmarx's New SAST Engine Tackles the False Positive Problem—Not Just LLM Branding

Checkmarx has raised a pointed challenge to the SAST industry: most vendors are simply wrapping large language models around legacy scanning engines and rebranding them as "next-generation." But does the repackaging actually solve the underlying problem?

The company this week unveiled a new SAST engine that combines three components: a deterministic rules-based scanner, an LLM fine-tuned on security data, and a novel Findings Analysis Engine (FAE) designed to filter out false positives before developers see them. According to Checkmarx, the system achieved an F1 score of 0.499 against a category average of 0.20, and identified 327 true positives missed by a leading frontier model in testing across four production codebases.

The Real Innovation: Orchestration, Not AI#

Rather than claiming breakthrough LLM capabilities, Checkmarx is positioning orchestration as the actual product. The three engines work together automatically without requiring customers to manually wire up their own multi-engine workflows. As Frank Emery, Director of Product Management, told The New Stack: "Neither of these solutions is good enough on its own."

The broader industry consensus is converging on a similar architecture: traditional query-based tools are deterministic and auditable but slow to support new languages; purely LLM-based scanners handle any language immediately but produce non-deterministic results that create governance headaches. The question is who manages the integration and how transparent that process remains.

The Noise Crisis#

The strongest argument behind Checkmarx's approach addresses a real pain point. As AI coding tools accelerate development velocity—Emery estimates customers are now committing 1–1.5× more code than a few years ago—the false-positive triage burden on AppSec teams scales exponentially. Checkmarx's CEO, Sandeep Johri, claims that 75% of code shipped today is vulnerable because code generation has outpaced security tooling.

Attackability: A Metrics Shift#

The engine introduces "Attackability," an exploitability score that traces attack paths from source, evaluates sanitizers, and considers business context. The idea is to shift reporting away from raw vulnerability counts toward defensible, boardroom-ready prioritization.