Replacing Checkmarx with Open Source — Designing an AppSec Stack from SAST, SCA, IaC, and Secrets

No single open-source tool replaces Checkmarx one to one. The realistic answer is a loosely coupled multi-engine setup: place a dedicated OSS scanner in each functional category and bind them with a management layer like DefectDojo. This article walks through the Semgrep CE versus Opengrep split in SAST, Trivy-centered SCA, Checkov and KICS for IaC, Gitleaks and TruffleHog for secrets, and DefectDojo's deduplication and Jira sync, as of 2026, along with the limits such as legacy languages and supply-chain risk.

Comparing Open-Source DAST Tools — Binding ZAP, Nuclei, Wapiti, and Nikto into a DevSecOps Pipeline

DAST (dynamic application security testing) hits a running app from the outside with simulated attacks to surface runtime-specific vulnerabilities that SAST and SCA miss. Open-source DAST has moved from 'one tool does everything' to 'divide the work among lightweight tools.' Centered on the all-around ZAP, template-driven Nuclei, lightweight-CLI Wapiti, and server-exposure-focused Nikto, this article adds the SQLi specialist sqlmap and the XSS specialist Dalfox, plus the free-but-not-OSS Dastardly and StackHawk, and lays out 2026 selection criteria alongside SPA/API coverage, phased CI/CD integration, and false-positive tuning.