Teams moving from Checkmarx to Aikido typically want shorter scans, a quieter triage queue, less rule-tuning admin overhead, and broader coverage across SAST, SCA, Secrets, IaC, Container, CSPM, and DAST in one platform.

This is the migration guide. For a feature-level discussion, see Aikido as a low-noise Checkmarx alternative. For the overall migration hub, see Migrating to Aikido.

Why teams switch

AutoTriage's reachability-first filtering reduces the triage queue before it reaches engineers.
One bundle for SAST, SCA, Secrets, IaC, Container, CSPM, VM, and DAST instead of stacked SKUs.
Ownership-aware PR routing via CODEOWNERS, teams, path-based assignment, and Jira smart routing.
Agentless SCM, cloud, and registry onboarding rather than appliance-style installs.

A safe transition plan

The pattern: visibility first, blocking later, and one tool blocks, the other measures during overlap. Cut over by capability, not by one big-bang date.

Connect Aikido to your SCM (GitHub, GitLab, Azure DevOps, Bitbucket) and enable the same capabilities Checkmarx currently covers.
Baseline existing debt so historical Checkmarx findings stay visible as non-blocking backlog, separate from net-new gating.
Run in parallel, warn-only for 2–4 weeks. Checkmarx stays the blocker; Aikido runs alongside in non-blocking mode.
Set ownership and routing before enforcement. Configure CODEOWNERS, teams, path-based assignment, Jira smart routing, roles/permissions, and SAML first.
Re-author load-bearing custom queries as Aikido Custom Rules on eligible paid plans. Translation is manual — Aikido does not currently publish an automated Checkmarx-to-Aikido importer for rules or suppression state. AutoTriage often removes the need for much of the prior tuning.
Flip enforcement by capability, then move Checkmarx to report-only for each.

What to preserve before cutover

Historical Checkmarx scan archive and triage state — keep read-only for your audit retention window. Plan to reference it in Checkmarx during overlap rather than migrate it.
Custom queries (CxQL) still in use — export for reference and re-author the ones that still matter.
Audit attestations that name Checkmarx specifically — flag for update at the next audit cycle.
Audit evidence going forward comes from Aikido via Reports, PDF and issue export, the activity log API, SBOM/VEX export, the REST API and webhooks, and the Vanta integration for control mapping.

Ownership and routing during migration

CODEOWNERS, teams, path-based assignment, and Jira smart routing should be wired up before enforcement. No repo should be onboarded without an owner. Roles, permissions, and SAML are configured in the same window.

Introducing enforcement without double-blocking PRs

Only one tool blocks a given capability at a time. During overlap, Checkmarx remains the gate and Aikido warns; after cutover, Aikido is the gate and Checkmarx moves to report-only or off for that capability.

When to decommission Checkmarx

Retire by capability once:

Aikido has been the sole PR gate for that capability for at least one full release cycle.
Net-new finding volume and ownership routing are stable.
Reports and evidence exports have been validated with your audit or compliance reviewer.
The Checkmarx history for that capability is archived read-only.

Many teams align full decommission with the Checkmarx contract renewal date.

Migrating from Checkmarx to Aikido