Checkmarx Fusion
Overview
Checkmarx Fusion lets you scale LLM-based scanning across your entire organization, with compliance, governance, and cost control built directly into the platform while your findings are incorporated into your existing workflows.
Fusion combines rule-based scanning with LLM-based scanning to expand coverage and identify additional findings. When you use Fusion, you run an additional LLM scan against your code alongside the scan that a rule-based scanner already performs, using the LLM model of your choice. Findings Analysis then runs to remove false positives and Fusion aggregates and deduplicates the findings from the engines into one result set. Because the LLM scan surfaces issues that pattern and rule-based analysis alone may miss, you can expect to see an increase in the number of findings.
You can configure Fusion at the tenant and scan levels so you maintain the flexibility to toggle scan overrides where you need them.
You view Fusion results through your existing results view and in Risk Orchestration. LLM-based findings are visually distinguishable from rule-based findings, so you can see at a glance which engine identified a given finding. See here for more information on understanding results.
How Checkmarx Fusion Works
When you enable Fusion, your scan runs the following stages:
Parallel scanning: Rule-based and LLM-based scanning run as part of the same scan, in parallel, against the languages and frameworks as listed here. LLM-based scanning expands the coverage and analyzes your entire codebase, including the languages and frameworks that rule-based scanning already supports. This applies to every Fusion scan, including your first scan and every subsequent scan.
Findings Analysis: The combined result set is evaluated to reduce false positives.
Matching and deduplication: Findings are matched using three signals: CWE (Common Weakness Enumeration category), sink filename, and sink line. When both rule-based scans and LLM-based scans identify the same finding, the rule-based scan result is kept and the corresponding LLM-based finding is discarded as a duplicate.
Merge: The deduplicated findings from both engines are merged into a single, unified result set you can review.
For example, in a project that contains Java and Solidity code, Java is analyzed by a rule-based scanner because it is supported by deterministic rules, and it is also analyzed by an LLM-based scanner. Solidity is not supported by rule-based scanning, so it is analyzed by LLM-based scanning only. Deduplication then ensures that overlapping findings for the same vulnerability appear once in the final result set.
If any part of the Fusion analysis cannot complete, your scan does not fail outright. You still get whatever results are available from the stages that did complete, rather than the entire scan being blocked by a single failure.
Triage actions you apply to LLM-based findings, including state, severity, and comments, are preserved across subsequent scans. If you triage a finding (for example, adjust its severity) in one scan, it is saved to later scans too.
Pull Requests and Scheduled Scans
Pull request (PR) scans triggered through integrations and scheduled scans start automatically.
Whether these scans run Fusion depends only on your configuration:
If Fusion is enabled at the tenant or project level, the Fusion scan starts.
If Fusion is disabled at the tenant or project level, the Fusion scan does not start.
Configuration inheritance and override behavior is the same as for any other scan.
Credit Usage and Metering
Your Fusion usage is metered per tenant based on the lines of code (LOC) of your project, with consumption tracked through Credits. Credits are reserved before engine work and settled after. Your first scan and every subsequent scan are always charged based on the full LOC of the project, at the credit rate of the LLM model you select. For example, a 1M LOC project is charged based on 1M LOC on every Fusion scan. A reservation failure stops the scan before Fusion engines run. You can check the Monitor dashboard to see the costs. Navigate to Credits > Details > Credit Usage > History. For more information on credit usage see Credit Usage.