Semgrep

Name: Semgrep
Brand: Semgrep
Rating: 4.6 (55 reviews)

Semgrep is the leader in code security for builders, helping teams catch and fix real security issues before they ship.

Est 2017|Valuation $395M|Raised $196M|26 Ref Customers

LinkedIn 20K|Web traffic 89K|FTEs 241|HQ San Francisco, California, US

MarketsCode Security SAST

Published Oct 15, 2026

01Common complaints

- If broader runtime and configuration coverage (containers, IaC, DAST, API scanning) is required from a single vendor without integrating multiple tools. - If the organization cannot allocate ownership for rule lifecycle, exceptions, and rollout across many repositories, given governance demands reported at scale. - If sensitivity to open-source licensing dynamics requires a fully community-driven engine and rules ecosystem without commercial constraints—evaluate Opengrep. - If the organization is GitHub-centric and prefers first-party security features bundled into GitHub with simpler SKU and operational models—GitHub Advanced Security may be more straightforward to operationalize.

Deal disqualifiers (poor fit)

Requirement for a single product to cover SAST, SCA, secrets, containers, IaC, and DAST without integrating multiple tools.
Strict need for clearly documented enterprise security features (SCIM, data residency, BAAs) prior to procurement.
Requirement for a fully open ecosystem without commercial licensing constraints, in which case an independent open-source fork may be considered.

Vendor-acknowledged / review-observed limitations

Learning curve for advanced rule creation and ongoing tuning.
Potential misses for complex, multi-function or multi-file patterns unless advanced or commercial features are used.
Governance overhead at scale for exception and rule lifecycle management.

Ecosystem risk: open-source/community dynamics

The Opengrep fork was launched in response to changes in Semgrep’s licensing and packaging, introducing ecosystem fragmentation risk and a credible alternative for buyers prioritizing a fully open engine.

Roadmap / not-yet-available

No authoritative roadmap commitments or dated feature delivery commitments were collected in the sources reviewed.

02Why they buy

Validated by review evidence: - Custom rules that are reported by reviewers to be more approachable than some AST-level programming approaches; reviewers cite the YAML-based rule format as readable and authorable. - Fast scan performance and CI/CD friendliness reported in multiple user reviews. Claims requiring validation: - Vendor marketing about eliminating false positives or very large percentage reductions in noise should be validated with baseline measurements and test data in the buyer’s environment. Competitive considerations: - Competitors such as Snyk may offer broader platform consolidation. - GitHub’s security add-ons may offer lower operational friction for organizations already standardized on GitHub. - SonarQube may be preferable where code quality governance is as important as security scanning.

03Field reports

Vendor-authored customer stories are published but are self-reported; claimed metrics should be validated during procurement.

Review platform signal (G2)

Semgrep is very highly rated on G2. Pricing references on G2 aligned with vendor pricing materials. Positive review summaries (G2): - Reviewers reported effective security scanning, straightforward setup with pipeline integration, comparatively low false-positive rates, and actionable findings. - Several reviewers described a flexible and transparent rule engine, CI/CD integration, and autofix functionality that contributed to reduced remediation time. Critical/constructive review summaries (G2): - Reviewers referenced a learning curve for the custom rule syntax and noted that Semgrep may miss complex security patterns that span multiple functions or files unless advanced features are used. - Multiple reviews commented on governance overhead at scale, including maintenance of organization-wide rule sets, exceptions, and updates across many repositories. - Some reviewers noted initial tuning effort to reduce false positives and mentioned limitations in built-in reporting and export capabilities. Community discussion and open-source context: - Community discussions referenced changes to the open-source project and the creation of an independent fork. Sentiment varies and includes concerns about licensing and feature placement between open-source and commercial editions. Why customers cited selecting Semgrep (themes across reviews): - Speed and CI-friendliness. - Rule transparency and customization (YAML rules interpreted as readable and authorable by developers). - Lower noise compared with some legacy SAST tools in several reported deployments. Why some customers consider alternatives or leave: - Preference for a broader, consolidated AppSec platform covering IaC, container, DAST, and API scanning without integrating multiple tools. - Governance and operational overhead when rolling out at large scale. - Concerns about open-source licensing and community changes leading some to evaluate open-source forks. Deal-breakers implied by negative feedback: - Organizations unwilling to invest in rule tuning and governance. - Buyers that require deep multi-repo, cross-service contextual analysis beyond static pattern matching. - Buyers needing fully documented enterprise security posture (SCIM, data residency, BAA) prior to procurement.

Supply-chain analysis (vendor-authored customer story)

Claimed outcomes: - The customer reported substantially reduced noise in detecting supply-chain vulnerabilities through the vendor’s reachability analysis. - The customer reported a high remediation/fix rate for issues found using custom rules. Critical evaluation: - Methodology for these metrics is not disclosed (baseline definition, measurement window, and counting rules are not provided). Metrics should be validated and contextualized during evaluation.

Security SLOs (vendor-authored customer story)

Claimed outcomes:

The customer described a significant reduction in false positives for supply-chain findings and an approach that emphasizes guardrails without blocking PRs except for high-confidence findings.

Critical evaluation:

Definitions of "false positives" and how reachability or policy thresholds contributed to the reduction are not described; buyers should request definitions and measurement details.

Operational responsiveness (vendor-authored customer story)

Claimed outcomes:

The customer reported that the platform supported rapid responses to issues and that familiarity with the tool reduced false positives.

Critical evaluation:

Rapid response times can be influenced by the organization’s processes and incident types; attribution to the tool alone is not verifiable without additional data.

04Best fit

Company size

Recommended fit: mid-market to large organizations with active CI/CD practices and pull-request discipline; fits best where contributor-based pricing aligns with the organization’s value-per-contributor economics.

Industries / verticals

SaaS, fintech, developer platforms, and other software-heavy organizations. Vendor case studies reference customers across fintech, edtech, and insurtech verticals.

Roles and personas

Decision makers: Head of AppSec, CISO, VP of Engineering/Platform.
Champions: security engineers who author custom detections and developer leads seeking low-friction tools.

Qualification criteria (good fit)

Requirement for custom static checks tailored to the codebase beyond generic CWEs.
Organizational capacity to maintain rule governance (ownership, processes, and exception handling).
Preference for PR-integrated remediation paths and rapid CI feedback.

05The pitch

What the product does (objective value proposition)

Semgrep is an application security platform focused on static analysis of source code and related artifacts. It provides: - SAST ("Semgrep Code"): pattern- and semantic-based static analysis with emphasis on developer-usable results and custom rule authoring. - SCA ("Semgrep Supply Chain"): dependency vulnerability and license analysis with the ability to assess reachability (whether vulnerable dependency code paths are exercised). - Secrets detection ("Semgrep Secrets"): detection of hardcoded credentials using a combination of approaches (semantic analysis, entropy checks, and validation heuristics). - AI features ("Semgrep Assistant"): triage and noise filtering with suggested remediation guidance. Semgrep's distinguishing features include its rule-writing model (rules look like code) and low-latency feedback intended for CI and PR workflows, plus commercial add-ons such as Pro rules, cross-file analysis, assistant features, and centralized management. The vendor positions reduced false-positive rates and AI-based noise filtering; customer evidence indicates a more nuanced outcome, with many users reporting lower noise than legacy SAST while also describing tuning and governance overhead at scale. Official positioning references an "AI AppSec Engineer" concept and other AI-driven claims; these statements reflect vendor messaging and should be validated in deployment and trials.

Target market and market positioning

Primary buyers: AppSec leaders, security engineering, platform engineering. Secondary buyers: developer productivity owners and engineering leadership.
Primary users: developers (local CLI and PR feedback) and AppSec analysts (triage workflows and policy enforcement).
Market position: a SAST/SCA/secrets platform oriented toward developers, positioned against broader AppSec suites (Snyk, GHAS) and code-quality analyzers (Sonar).

Get a comprehensive analysis of Semgrep including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Published Oct 15, 2026

01Common complaints

If broader runtime and configuration coverage (containers, IaC, DAST, API scanning) is required from a single vendor without integrating multiple tools.
If the organization cannot allocate ownership for rule lifecycle, exceptions, and rollout across many repositories, given governance demands reported at scale.
If sensitivity to open-source licensing dynamics requires a fully community-driven engine and rules ecosystem without commercial constraints—evaluate Opengrep.
If the organization is GitHub-centric and prefers first-party security features bundled into GitHub with simpler SKU and operational models—GitHub Advanced Security may be more straightforward to operationalize.

Deal disqualifiers (poor fit)

Requirement for a single product to cover SAST, SCA, secrets, containers, IaC, and DAST without integrating multiple tools.
Strict need for clearly documented enterprise security features (SCIM, data residency, BAAs) prior to procurement.
Requirement for a fully open ecosystem without commercial licensing constraints, in which case an independent open-source fork may be considered.

Vendor-acknowledged / review-observed limitations

Learning curve for advanced rule creation and ongoing tuning.
Potential misses for complex, multi-function or multi-file patterns unless advanced or commercial features are used.
Governance overhead at scale for exception and rule lifecycle management.

Ecosystem risk: open-source/community dynamics

The Opengrep fork was launched in response to changes in Semgrep’s licensing and packaging, introducing ecosystem fragmentation risk and a credible alternative for buyers prioritizing a fully open engine.

Roadmap / not-yet-available

No authoritative roadmap commitments or dated feature delivery commitments were collected in the sources reviewed.

02Why they buy

Validated by review evidence:

Custom rules that are reported by reviewers to be more approachable than some AST-level programming approaches; reviewers cite the YAML-based rule format as readable and authorable.
Fast scan performance and CI/CD friendliness reported in multiple user reviews.

Claims requiring validation:

Vendor marketing about eliminating false positives or very large percentage reductions in noise should be validated with baseline measurements and test data in the buyer’s environment.

Competitive considerations:

Competitors such as Snyk may offer broader platform consolidation.
GitHub’s security add-ons may offer lower operational friction for organizations already standardized on GitHub.
SonarQube may be preferable where code quality governance is as important as security scanning.

03Field reports

Vendor-authored customer stories are published but are self-reported; claimed metrics should be validated during procurement.

Review platform signal (G2)

Semgrep is very highly rated on G2. Pricing references on G2 aligned with vendor pricing materials.

Positive review summaries (G2):

Reviewers reported effective security scanning, straightforward setup with pipeline integration, comparatively low false-positive rates, and actionable findings.
Several reviewers described a flexible and transparent rule engine, CI/CD integration, and autofix functionality that contributed to reduced remediation time.

Critical/constructive review summaries (G2):

Reviewers referenced a learning curve for the custom rule syntax and noted that Semgrep may miss complex security patterns that span multiple functions or files unless advanced features are used.
Multiple reviews commented on governance overhead at scale, including maintenance of organization-wide rule sets, exceptions, and updates across many repositories.
Some reviewers noted initial tuning effort to reduce false positives and mentioned limitations in built-in reporting and export capabilities.

Community discussion and open-source context:

Community discussions referenced changes to the open-source project and the creation of an independent fork. Sentiment varies and includes concerns about licensing and feature placement between open-source and commercial editions.

Why customers cited selecting Semgrep (themes across reviews):

Speed and CI-friendliness.
Rule transparency and customization (YAML rules interpreted as readable and authorable by developers).
Lower noise compared with some legacy SAST tools in several reported deployments.

Why some customers consider alternatives or leave:

Preference for a broader, consolidated AppSec platform covering IaC, container, DAST, and API scanning without integrating multiple tools.
Governance and operational overhead when rolling out at large scale.
Concerns about open-source licensing and community changes leading some to evaluate open-source forks.

Deal-breakers implied by negative feedback:

Organizations unwilling to invest in rule tuning and governance.
Buyers that require deep multi-repo, cross-service contextual analysis beyond static pattern matching.
Buyers needing fully documented enterprise security posture (SCIM, data residency, BAA) prior to procurement.

Supply-chain analysis (vendor-authored customer story)

Claimed outcomes:

The customer reported substantially reduced noise in detecting supply-chain vulnerabilities through the vendor’s reachability analysis.
The customer reported a high remediation/fix rate for issues found using custom rules.

Critical evaluation:

Methodology for these metrics is not disclosed (baseline definition, measurement window, and counting rules are not provided). Metrics should be validated and contextualized during evaluation.

Security SLOs (vendor-authored customer story)

Claimed outcomes:

The customer described a significant reduction in false positives for supply-chain findings and an approach that emphasizes guardrails without blocking PRs except for high-confidence findings.

Critical evaluation:

Definitions of "false positives" and how reachability or policy thresholds contributed to the reduction are not described; buyers should request definitions and measurement details.

Operational responsiveness (vendor-authored customer story)

Claimed outcomes:

The customer reported that the platform supported rapid responses to issues and that familiarity with the tool reduced false positives.

Critical evaluation:

Rapid response times can be influenced by the organization’s processes and incident types; attribution to the tool alone is not verifiable without additional data.

04Best fit

Company size

Recommended fit: mid-market to large organizations with active CI/CD practices and pull-request discipline; fits best where contributor-based pricing aligns with the organization’s value-per-contributor economics.

Industries / verticals

SaaS, fintech, developer platforms, and other software-heavy organizations. Vendor case studies reference customers across fintech, edtech, and insurtech verticals.

Roles and personas

Decision makers: Head of AppSec, CISO, VP of Engineering/Platform.
Champions: security engineers who author custom detections and developer leads seeking low-friction tools.

Qualification criteria (good fit)

Requirement for custom static checks tailored to the codebase beyond generic CWEs.
Organizational capacity to maintain rule governance (ownership, processes, and exception handling).
Preference for PR-integrated remediation paths and rapid CI feedback.

05The pitch

What the product does (objective value proposition)

Semgrep is an application security platform focused on static analysis of source code and related artifacts. It provides:

SAST ("Semgrep Code"): pattern- and semantic-based static analysis with emphasis on developer-usable results and custom rule authoring.
SCA ("Semgrep Supply Chain"): dependency vulnerability and license analysis with the ability to assess reachability (whether vulnerable dependency code paths are exercised).
Secrets detection ("Semgrep Secrets"): detection of hardcoded credentials using a combination of approaches (semantic analysis, entropy checks, and validation heuristics).
AI features ("Semgrep Assistant"): triage and noise filtering with suggested remediation guidance.

Semgrep's distinguishing features include its rule-writing model (rules look like code) and low-latency feedback intended for CI and PR workflows, plus commercial add-ons such as Pro rules, cross-file analysis, assistant features, and centralized management. The vendor positions reduced false-positive rates and AI-based noise filtering; customer evidence indicates a more nuanced outcome, with many users reporting lower noise than legacy SAST while also describing tuning and governance overhead at scale.

Official positioning references an "AI AppSec Engineer" concept and other AI-driven claims; these statements reflect vendor messaging and should be validated in deployment and trials.

Target market and market positioning

Primary buyers: AppSec leaders, security engineering, platform engineering. Secondary buyers: developer productivity owners and engineering leadership.
Primary users: developers (local CLI and PR feedback) and AppSec analysts (triage workflows and policy enforcement).
Market position: a SAST/SCA/secrets platform oriented toward developers, positioned against broader AppSec suites (Snyk, GHAS) and code-quality analyzers (Sonar).

Get a comprehensive analysis of Semgrep including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →

Semgrep is very highly rated on G2. Pricing references on G2 aligned with vendor pricing materials.

Positive review summaries (G2):

Reviewers reported effective security scanning, straightforward setup with pipeline integration, comparatively low false-positive rates, and actionable findings.
Several reviewers described a flexible and transparent rule engine, CI/CD integration, and autofix functionality that contributed to reduced remediation time.

Critical/constructive review summaries (G2):

Reviewers referenced a learning curve for the custom rule syntax and noted that Semgrep may miss complex security patterns that span multiple functions or files unless advanced features are used.
Multiple reviews commented on governance overhead at scale, including maintenance of organization-wide rule sets, exceptions, and updates across many repositories.
Some reviewers noted initial tuning effort to reduce false positives and mentioned limitations in built-in reporting and export capabilities.

Community discussion and open-source context:

Community discussions referenced changes to the open-source project and the creation of an independent fork. Sentiment varies and includes concerns about licensing and feature placement between open-source and commercial editions.

Why customers cited selecting Semgrep (themes across reviews):

Speed and CI-friendliness.
Rule transparency and customization (YAML rules interpreted as readable and authorable by developers).
Lower noise compared with some legacy SAST tools in several reported deployments.

Why some customers consider alternatives or leave:

Preference for a broader, consolidated AppSec platform covering IaC, container, DAST, and API scanning without integrating multiple tools.
Governance and operational overhead when rolling out at large scale.
Concerns about open-source licensing and community changes leading some to evaluate open-source forks.

Deal-breakers implied by negative feedback:

Organizations unwilling to invest in rule tuning and governance.
Buyers that require deep multi-repo, cross-service contextual analysis beyond static pattern matching.
Buyers needing fully documented enterprise security posture (SCIM, data residency, BAA) prior to procurement.