Snyk

Name: Snyk
Brand: Snyk
Rating: 4.4 (369 reviews)

Leader

Trust AI at full speed.

Est 2015|Valuation $7.4B|Raised $1.1B|86 Ref Customers

LinkedIn 118K|Web traffic 1.0M|FTEs 1,550|HQ Boston, Massachusetts, US

MarketsApplication Security Testing (AST)Cloud-Native Application Protection Platform (CNAPP)Code Security SCA

Published Oct 22, 2026

01Common complaints

Organizations with hundreds or thousands of developers and strict budget constraints: per-developer pricing and module bundling can be a significant cost driver.
Organizations that require extensive, highly customizable rule authoring for SAST or IaC: some users report limited custom policy flexibility in certain modules.
Organizations whose primary need is GitHub-native coverage and that already pay for GitHub Enterprise: GHAS may provide sufficient capability with a simpler procurement path.
Organizations requiring a dedicated, best-possible DAST capability first: DAST/API web capabilities are provided as add-ons and may not match specialized DAST providers for advanced use cases.
Organizations requiring guaranteed high-touch support: reviews include reports of slow or ineffective support in some cases; verify support SLAs and escalation paths.
Organizations with complex on-prem SCM and strict network constraints that want to avoid additional infrastructure: the Broker component can address these requirements but adds operational components and tier implications.

Based on reviewed sources (not exhaustive):

False positives / noise still occur, particularly when configuration is suboptimal
Support responsiveness complaints appear in a minority of reviews but can be severe when encountered
Feature gating by tier (notably SSO, some prioritization features, audit logging, Broker availability)
Language/framework coverage gaps reported by some enterprise users
Operational UX limitations for managing vulnerabilities at scale reported by some users

Roadmap details are not consistently public; organizations should request documented roadmap commitments for required features.

- Organizations with hundreds or thousands of developers and strict budget constraints: per-developer pricing and module bundling can be a significant cost driver. - Organizations that require extensive, highly customizable rule authoring for SAST or IaC: some users report limited custom policy flexibility in certain modules. - Organizations whose primary need is GitHub-native coverage and that already pay for GitHub Enterprise: GHAS may provide sufficient capability with a simpler procurement path. - Organizations requiring a dedicated, best-possible DAST capability first: DAST/API web capabilities are provided as add-ons and may not match specialized DAST providers for advanced use cases. - Organizations requiring guaranteed high-touch support: reviews include reports of slow or ineffective support in some cases; verify support SLAs and escalation paths. - Organizations with complex on-prem SCM and strict network constraints that want to avoid additional infrastructure: the Broker component can address these requirements but adds operational components and tier implications. Based on reviewed sources (not exhaustive): - False positives / noise still occur, particularly when configuration is suboptimal - Support responsiveness complaints appear in a minority of reviews but can be severe when encountered - Feature gating by tier (notably SSO, some prioritization features, audit logging, Broker availability) - Language/framework coverage gaps reported by some enterprise users - Operational UX limitations for managing vulnerabilities at scale reported by some users Roadmap details are not consistently public; organizations should request documented roadmap commitments for required features.

Deal disqualifiers (poor fit)

Extremely cost-sensitive organizations with very large developer headcount
Legacy or mixed-language monolith estates with coverage gaps
Teams requiring highly customized scanning rules/policies beyond what the vendor offers in specific modules

02Why they buy

Claims supported by reviews and vendor documentation:

Integrations with development tools and CI/CD platforms to surface findings in developer workflows (IDE plugins, SCM integrations, CI/CD hooks)
Open-source dependency scanning combined with suggested remediation paths and automated PR suggestions in some contexts
Prioritization features (for example, reachability analysis) intended to reduce time spent on lower-priority findings
Broker architecture for scanning private/on-prem repositories without transferring SCM credentials outside the customer network (enterprise capability)

Competitor advantages summarized:

GHAS: native GitHub integration and CodeQL customization
Veracode/Checkmarx: enterprise governance depth and certain scanning modalities may be stronger depending on the use case

Claims supported by reviews and vendor documentation: - Integrations with development tools and CI/CD platforms to surface findings in developer workflows (IDE plugins, SCM integrations, CI/CD hooks) - Open-source dependency scanning combined with suggested remediation paths and automated PR suggestions in some contexts - Prioritization features (for example, reachability analysis) intended to reduce time spent on lower-priority findings - Broker architecture for scanning private/on-prem repositories without transferring SCM credentials outside the customer network (enterprise capability) Competitor advantages summarized: - GHAS: native GitHub integration and CodeQL customization - Veracode/Checkmarx: enterprise governance depth and certain scanning modalities may be stronger depending on the use case

03Field reports

Review platform sentiment snapshot

G2: very highly rated on G2, with pros focused on integrations and vulnerability identification; recurring negatives include false positives, bugs, scanning issues, and support responsiveness.
Capterra: very highly rated on Capterra, with positives around reporting and GitHub integration; negatives include pricing/feature gating and training quality.
TrustRadius: generally positive on TrustRadius for CI/CD integration and dependency vulnerability detection, with complaints about day-to-day vulnerability management UX, setup complexity, gaps in language support, and cost.

- G2: very highly rated on G2, with pros focused on integrations and vulnerability identification; recurring negatives include false positives, bugs, scanning issues, and support responsiveness. - Capterra: very highly rated on Capterra, with positives around reporting and GitHub integration; negatives include pricing/feature gating and training quality. - TrustRadius: generally positive on TrustRadius for CI/CD integration and dependency vulnerability detection, with complaints about day-to-day vulnerability management UX, setup complexity, gaps in language support, and cost.

Direct quotes (positive)

From Capterra:

"I can see a report of my code, vulnerabilities, and how to fix it by suggestions... it automatically sync with my GitHub..."
"Snyk simplifies security... scan ... during development or when you run a pipeline..."

From G2:

"Accurate, Beginner-Friendly SAST Tool with CI/CD Integration"
A reviewer highlights reachability as a time-saver: identifying imported-but-not-used vulnerable packages as lower priority.

From TrustRadius:

"Snyk Code ... gives a very precise outline of code level vulnerabilities... low false positive rate..."
"Offers real-time alerts as new CVEs are published... Suggests automated fix PRs..."

From Capterra: - "I can see a report of my code, vulnerabilities, and how to fix it by suggestions... it automatically sync with my GitHub..." - "Snyk simplifies security... scan ... during development or when you run a pipeline..." From G2: - "Accurate, Beginner-Friendly SAST Tool with CI/CD Integration" - A reviewer highlights reachability as a time-saver: identifying imported-but-not-used vulnerable packages as lower priority. From TrustRadius: - "Snyk Code ... gives a very precise outline of code level vulnerabilities... low false positive rate..." - "Offers real-time alerts as new CVEs are published... Suggests automated fix PRs..."

Direct quotes (negative)

From G2:

"Bad Customer support, Lots of bugs and a non-working product"
"Customer support is slow to respond... clear bug that prevents us from using the product."
"...starts providing false-positives issues as well."

From Capterra:

"The training session was not adequate... many buzzwords..."
"You have to pay for the enterprise plan to enable SSO..."

From TrustRadius:

"Setting up is complex and when not done properly provides too many false positives."
"We use another tool in parallel because it does not cover all of our languages..."

From G2: - "Bad Customer support, Lots of bugs and a non-working product" - "Customer support is slow to respond... clear bug that prevents us from using the product." - "...starts providing false-positives issues as well." From Capterra: - "The training session was not adequate... many buzzwords..." - "You have to pay for the enterprise plan to enable SSO..." From TrustRadius: - "Setting up is complex and when not done properly provides too many false positives." - "We use another tool in parallel because it does not cover all of our languages..."

Why customers choose Snyk (observed factors)

Common decision factors in reviews and community sentiment include:

Wide set of integrations (GitHub/GitLab/Bitbucket/Azure Repos; CI/CD)
Developer-oriented UX elements (IDE plugins, PR-based workflows)
Guidance for fixing issues (upgrade paths, automated PR suggestions)

Why some customers leave or consider alternatives

Common churn/avoidance drivers observed in reviews:

Cost at scale (seat-based pricing; module bundling)
Support responsiveness concerns (reported in some reviews)
Noise / false positives, especially when setup/policies are not tuned
Gaps in language/framework coverage for certain legacy codebases

Vendor-published customer outcomes (use cautiously)

Critical evaluation:

Methodologies, baselines, and sample sizes are often not fully disclosed in marketing materials.
Outcomes depend on repository hygiene, dependency management practices, and degree of developer adoption, and will vary by organization.

Vendor case studies and marketing materials cite savings and remediation improvements (for example, reductions in remediation time or large nominal savings). These claims are typically based on vendor-commissioned studies or selected customer examples. Critical evaluation: - Methodologies, baselines, and sample sizes are often not fully disclosed in marketing materials. - Outcomes depend on repository hygiene, dependency management practices, and degree of developer adoption, and will vary by organization.

Example: Government / FedRAMP context

The vendor announced FedRAMP Moderate Authorization for a government-targeted offering.

Critical evaluation:

FedRAMP authorization applies to a specific offering/environment. Organizations should verify the exact scope (which services, regions, and features are covered) and whether it meets their compliance needs.

04Best fit

Company sizes

Typical fit:

Mid-sized to large engineering organizations when standardizing AppSec across many repositories and pipelines
Small teams can use Free/Team tiers, but cost/value depends on required modules and coverage

Industries

Common fits:

SaaS and cloud-native companies
Fintech and regulated technology firms (when compliance reporting is required)
Retail/ecommerce engineering organizations

Roles/personas

Decision makers: CISO, VP Security, Head of AppSec, VP Engineering, Platform Engineering leadership
Daily users: developers, DevOps engineers, security engineers managing triage and policies

Pain points addressed

Large numbers of vulnerable dependencies without consistent patch processes
Lack of visibility across repositories, containers, and IaC
Slow remediation and limited developer adoption of security tooling

Qualification criteria (good fit)

Git-based workflows and CI/CD in place
Willingness to invest in developer enablement and policy tuning
Need for broad scanning (SCA + SAST + containers + IaC) under a unified program

05The pitch

What the product does (core value proposition)

Snyk is an application security platform designed for development teams to identify, prioritize, and remediate security issues across:

Open source dependencies (SCA): vulnerable libraries, transitive dependencies, license risk
Custom code (SAST): code-level vulnerabilities with developer-oriented remediation guidance
Containers: base image/package vulnerabilities; Dockerfile-related issues
Infrastructure as Code (IaC): misconfigurations in Terraform/CloudFormation/Kubernetes manifests
API & Web / DAST: runtime/dynamic discovery and testing (vendor describes capabilities that use machine learning/AI techniques)

The core workflow follows a shift-left AppSec approach: integrate scanning into developer tools (IDE), source control (SCM), and CI/CD, then route findings into developer workflows (PRs, Jira, etc.). The vendor emphasizes reducing noise (for example, reachability/prioritization) and supporting faster remediation.

Vendor materials position the platform as AI-oriented with integrated semantic code analysis capabilities supporting fix guidance and prioritization. Organizations should validate the accuracy and actionability of any AI outputs for their specific languages and frameworks.

Vendor product materials describe modules (Snyk Code, Open Source, Container, IaC, API & Web) and the integrated code analysis capabilities.

Snyk is an application security platform designed for development teams to identify, prioritize, and remediate security issues across: - Open source dependencies (SCA): vulnerable libraries, transitive dependencies, license risk - Custom code (SAST): code-level vulnerabilities with developer-oriented remediation guidance - Containers: base image/package vulnerabilities; Dockerfile-related issues - Infrastructure as Code (IaC): misconfigurations in Terraform/CloudFormation/Kubernetes manifests - API & Web / DAST: runtime/dynamic discovery and testing (vendor describes capabilities that use machine learning/AI techniques) The core workflow follows a shift-left AppSec approach: integrate scanning into developer tools (IDE), source control (SCM), and CI/CD, then route findings into developer workflows (PRs, Jira, etc.). The vendor emphasizes reducing noise (for example, reachability/prioritization) and supporting faster remediation. Vendor materials position the platform as AI-oriented with integrated semantic code analysis capabilities supporting fix guidance and prioritization. Organizations should validate the accuracy and actionability of any AI outputs for their specific languages and frameworks. Vendor product materials describe modules (Snyk Code, Open Source, Container, IaC, API & Web) and the integrated code analysis capabilities.

Target market and positioning

Primary buyers: AppSec leaders, security engineering, platform engineering, DevOps/DevSecOps
Primary users: software engineers, tech leads, SRE/DevOps
Typical organizational fit: teams using CI/CD with Git-based workflows, seeking to standardize vulnerability management across multiple artifact types

The vendor differentiates on developer-oriented usability and integrations rather than workflows targeted exclusively at security analysts.

Get a comprehensive analysis of Snyk including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →