Semgrep

Name: Semgrep
Brand: Semgrep
Rating: 4.6 (69 reviews)

Semgrep is the leader in code security for builders, helping teams catch and fix real security issues before they ship.

Est 2017|Valuation $395M|Raised $196M|37 Ref Customers

LinkedIn 20K|Website|Web traffic 89K|FTEs 241|HQ San Francisco, California, US

MarketsCloud-Native Application Protection Platform (CNAPP)

Platform CoversApplication Security Testing (AST)Code Security SCA SAST Secret Scanning

Published Oct 15, 2026

01Common complaints

- Redistribution or embedding restrictions - Organizations that plan to redistribute vendor-maintained rules or embed them in a competing product or SaaS offering should evaluate alternative engines or forks with clearer redistribution rights. - Need for maximum out-of-the-box recall without tuning - If the priority is high recall with minimal tuning, consider complementary tools or different detection approaches; rule-based tools often require tuning to approach peak effectiveness in specific codebases. - Requirement for fully transparent, publicly listed pricing - If procurement requires purely self-serve, fully transparent list pricing without sales engagement, vendors with clear list prices and self-serve procurement models may be preferable. - Requirement for a single-vendor enterprise AST suite covering many modalities - Large programs that prioritize centralized governance and a broad modality coverage may prefer established enterprise AST vendors; trade-offs include developer UX and tuning burden. - Licensing and ecosystem constraints - Recent changes affected naming and licensing for vendor-maintained rules and introduced restrictions for non-internal redistribution. These changes led to community responses and forks; buyers should perform legal and technical review of license terms relevant to planned uses. - Product limitations implied by reviews - Rule authoring has a learning curve for complex cases and requires investment in rule engineering. - Benchmark limitations and context - Academic benchmarks vary by dataset and configuration. Some studies show rule-based tools have lower recall in certain evaluations; this suggests that Semgrep may be most effective as one component in a layered AppSec strategy rather than the sole detection technology.

Deal disqualifiers (poor fit)

Organizations unable to allocate staff for rule tuning and program operations.
Use cases that require unrestricted redistribution of vendor-maintained rules for resale or embedding into a competing SaaS product.

02Why they buy

- Customizable rule authoring and developer workflow integration - The product provides facilities for organizations to author and deploy custom detection rules and integrate results into developer CI/PR workflows. - Managed scanning options for centralized rollouts - The vendor offers managed scanning capabilities intended to reduce infrastructure overhead and centralize policy management; buyers should validate onboarding, governance, and operational responsibilities. - Competitor strengths (context) - Alternative vendors may provide clearer entry pricing, deeper semantic query models, or broader enterprise governance features depending on buyer needs.

03Field reports

Review platform signals (quantitative)

Public review platforms show ratings and limited review volumes in the snapshots accessed; review counts and scores change over time and should be treated as snapshots rather than definitive measures.

Positive feedback themes (aggregated from review platforms and community discussions)

Review summaries cite usability and customization as favorable attributes; users reference the ability to author custom rules and receive timely feedback in CI workflows as reasons for adoption.
Community discussions highlight the flexibility to write organization-specific rules as a distinguishing capability.

Negative feedback themes / criticisms (community + platform summaries)

- Rule-writing learning curve - Multiple review summaries and community discussions note a learning curve for crafting and maintaining complex rules, which can increase programmatic overhead. - Licensing and ecosystem concerns - Changes to licensing for vendor-maintained rules prompted community reactions and forks; organizations should assess licensing terms for rule reuse and redistribution. - Operational/performance issues in some environments - Anecdotal reports describe performance or resource usage issues in certain setups; these reports are environment-specific and should be validated during a proof-of-value on target repositories.

Reasons customers chose this product over alternatives (observed from reviews and discussion)

Preference for developer-focused workflows and configurability over heavier enterprise SAST products.
Budget and flexibility considerations when organizations are prepared to invest in rule tuning rather than purchasing fully managed content suites.

Reasons customers left or did not purchase (inferred)

Potential churn drivers include the rule maintenance burden, preference for broader out-of-the-box coverage from enterprise suites, or concerns about licensing and ecosystem direction.

Deal-breakers and reasons organizations decline purchase

Licensing constraints for vendor-maintained rules that restrict redistribution or embedding in third-party SaaS can be a disqualifier for some buyers.
Teams that cannot staff rule engineering or tuning may prefer vendors that provide more comprehensive managed detection content.

Vendor-published scale metrics (not independent)

Vendor-published metrics such as scan volumes and language coverage provide useful context but should be validated with clear telemetry definitions and contractual guarantees when scale is a procurement criterion.

Independent/academic evaluation (useful reality check)

Recent academic and independent benchmarks compare rule-based scanners to other approaches; outcomes vary depending on dataset selection, labeling criteria, and tool configuration. These studies can inform expectations but are not definitive product benchmarks for every environment.

Methodology gaps to call out

Many vendor ROI and noise-reduction claims are difficult to validate externally. For procurement, require:
- A proof-of-value exercise on representative repositories
- Precision/recall sampling with human adjudication
- Measurement of developer fix rates and cycle time

04Best fit

Company sizes

A strong fit often includes:
- Mid-market to enterprise engineering organizations with many repositories/services and requirements for scalable, policy-driven scanning.
- Smaller teams with skilled engineering/security personnel can also adopt the community edition and selectively purchase platform features.

Industries and verticals

Industries where secure SDLC and CI/CD maturity are common:
- SaaS, fintech, cloud infrastructure, and developer tools companies.

Roles and personas

Decision makers
- Heads of AppSec, security leaders in the CISO organization, and engineering leadership focused on shift-left security.
End users
- AppSec engineers, security champions, platform engineers, and developers who respond to findings.

Pain points the product addresses

Improve developer-consumable findings in CI/PR workflows.
Provide customization for internal patterns, framework-specific rules, and organizational coding standards.
Reduce noise through tuned rules and suppression workflows (precision and recall should be validated in target repositories).

Qualification criteria (good fit)

Organizations with clear workflows for ownership, exception handling (suppression/ignore governance), and rule governance (review, testing, rollout) are well-positioned to derive value.

05The pitch

What the product does (core value proposition in objective terms)

Semgrep is an application security testing platform focused on static code analysis (SAST), software composition analysis (SCA), and secrets detection, with developer-facing workflows including CI integrations, pull request feedback, rule customization, and dashboards.
The project provides a local/offline scanning engine (Semgrep Community Edition) and a commercial cloud platform (Semgrep AppSec Platform).

Target market and market positioning

- Primary buyers/users - AppSec and DevSecOps teams that require scalable scanning across many repositories, with governance features such as policies and baselines and integrated developer workflows. - Engineering teams that prefer faster, customizable static analysis (including the ability to author custom rules) rather than heavyweight enterprise SAST products. - Positioning themes observed in vendor and reviewer materials - Emphasis on developer-focused workflows and configurable rule sets as differentiators. - Consolidation of SAST, SCA, and secrets detection into a single platform offering.

Get a comprehensive analysis of Semgrep including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →