How SAST is customized for different applications

Today, Checkmarx SAST provides tremendous flexibility  to scan applications based on how they are built. This is done using two constructs:

• Queries: essentially a rule that identifies a potential vulnerability. 
• Presets: a collection of queries optimized for a specific type of application (for example, a mobile app) that defines the scope of the SAST scan. We’ve written elsewhere about working with presets. 

Queries are building blocks for identifying potential vulnerabilities and critical for filtering through the noise to avoid sending false positives and false negatives to your developers. Understanding queries enables AppSec teams and developers to prioritize your efforts, and promptly address the most critical issues.  

Checkmarx SAST includes pre-built queries (and presets) written in the Checkmarx Query Language (CxQL). These identify common security issues such as SQL injection, cross-site scripting, and insecure access controls and provide an easy way to start securing applications out of the box.  

Customizing queries for your unique applications 

Checkmarx is the only solution in the market that allows for queries to be customized – either by creating new custom queries or customizing existing queries.  

Custom queries provide a uniquely flexible and powerful mechanism to tailor your SAST solution to specific application requirements. They provide the freedom to explore unique or specific code structures that pre-built rules may not cover adequately.  

For example, as we wrote in an earlier post: 

A common use case that neatly highlights the benefits of customizing queries can be found in cross-site scripting (XSS) vulnerability findings where a false positive may be occurring due to the use of an in-house sanitizer method that is not included in the Checkmarx One default out-of-the-box query. We can simply add this method to the appropriate CxQL query and rescan the project to remove the FP. 

AI enters the room 

Unless you’ve been living under a rock, you’ve probably heard about AI and the impact that it’s having across every industry. In tech, many developers have embraced AI and are already using AI to generate their code. But even more so, according to a recent IDC survey(1) , developers believe that software quality and testing (22.5%) and security testing and vulnerability management (21.5%) have the most potential to benefit from Generative AI. 

Making custom queries more accessible with AI 

Today, Checkmarx introduced AI Query Builder for SAST. This feature lets Checkmarx One users harness the power of AI to automatically generate new custom queries or modify existing ones. AI Query Builder builds on the custom query capability, allowing AI to help any AppSec team write new or edit existing custom queries. This allows every organization to tune SAST more easily for your applications, increasing accuracy and minimizing false positives and false negatives. 

AI Query Builder is an expert in the ins and outs of CxQL. You no longer need to be an expert in building a query when an AI can do the work for you! With this feature, a simple prompt such as, “Help me generate a Checkmarx query that will detect an authentication issue,” will immediately generate a new custom query.  

Benefits of AI-Generated Custom Queries 

 Some benefits of using artificial intelligence to generate custom queries include: 

• Comprehensive coverage: AI Query Builder can use existing public SAST documentation and security best practices to generate custom queries that cover a broader range of potential vulnerabilities. This reduces the risk of making mistakes or missing critical issues. 
• Enhanced efficiency: Save time and effort – instead of manually crafting queries, AppSec managers and developers can engage with AI Query Builder to generate tailored queries, reducing time spent on query development. 
• Fewer false positives: False positives are always a challenge for any AppSec solution, but AI-generated custom queries can improve accuracy and reduce false positives.  

• Everyone can use it : No longer are custom queries reserved for power users, but now every Checkmarx One user can now better tune their SAST solution using AI.  

Try it yourself.  

Interested in seeing for yourself?  

Join the Checkmarx Early Access program.  

We’re just beginning. Check in next week when we’ll have a new blog post taking us through AI Query Builder for IaC Security. 

(1) Source: IDC, Generative AI Adoption and Attitudes: A Survey of U.S. Developers, Doc #US50655123, May 2023 

Avi Hein

Avi brings over 15 years of experience to his role as product marketing manager at Checkmarx. He has extensive product and corporate marketing skills and has worked for leading cybersecurity and developer tool companies, such as Imperva, AlgoSec, Allot, and Incredibuild. Avi holds an MBA from the Technion-Israel Institute of Technology, an MA from the Hebrew University of Jerusalem, and a BA from the University of Maryland.

See All Blogs >

Avi Hein

Avi brings over 15 years of experience to his role as product marketing manager at Checkmarx. He has extensive product and corporate marketing skills and has worked for leading cybersecurity and developer tool companies, such as Imperva, AlgoSec, Allot, and Incredibuild. Avi holds an MBA from the Technion-Israel Institute of Technology, an MA from the Hebrew University of Jerusalem, and a BA from the University of Maryland.

See All Blogs >

Never miss an update. Subscribe today!

By submitting my information to Checkmarx, I hereby consent to the terms and conditions found in the Checkmarx Privacy Policy and to
the processing of my personal data as described therein. By clicking submit below, you consent to allow Checkmarx
to store and process the personal information submitted above to provide you the content requested.