What I like most about Arnica is how it delivers clear, actionable insights into code quality and security across the entire development lifecycle. It helps surface potential risks early, which makes it easier to uphold strong engineering standards without slowing delivery. I also value the intuitive dashboard, the automated recommendations, and the seamless integration with our development workflow. Together, these features save time during code reviews and help improve overall team productivity. Review collected by and hosted on G2.com.

Arnica provides valuable insights, but there’s still room for improvement. At times, some alerts feel overly noisy or require extra investigation to understand their real impact, which can slow down the review process. The user interface can also become overwhelming when working through large repositories with a high volume of findings. Better alert prioritization, stronger filtering options, and clearer contextual explanations would make it easier to focus on the most critical issues and improve the overall user experience. Review collected by and hosted on G2.com.

SAST scans help me detect a few SQL injection issues that have existed since the product was developed. Glad that there is a tool that can scan for potential security issues for each commit. Also, outdated libraries/packages detection is one feature I like the most. Earlier, we used to do this task manually, now it is automated and seamless. I loved the UI/UX of Arnica, since it is directly integrated into GitHub, it is easy for us to work. Also, the integration part is seamless. I feel the performance is quite slow in the sense that, after every commit, I have to wait for 5-10 minutes to get the results on the dashboard. But given the impact, I cannot complain much about it. (But would prefer the results to show faster) I am not sure about the pricing of the product, since my company pays for it, but given the use cases, I highly recommend integrating this tool. And also believe in the long run, the ROI from this will be huge. Review collected by and hosted on G2.com.

The performance is a little on the slower side, I have to wait for a few minutes for the results to show on my dashboard. Review collected by and hosted on G2.com.

Arnica provides a centralized view of development activity, pull requests, and security findings, making it easier to track engineering work and identify issues early. It has reduced the effort required to gather information from multiple sources and improved the efficiency of our review process. An added benefit has been the increased visibility into team activity and development trends, enabling more proactive discussions around quality and security. Arnica really helps to evaluate the risks across different projects at a glance. I like how arnica is connected with MS teams and sends the notifications directly when the associated project might have risks and provides a way to see them by providing a link from the teams itself. Review collected by and hosted on G2.com.

Arnica has been useful for providing visibility into engineering and security metrics, but the user experience could be improved through more customizable dashboards, better filtering options, and clearer prioritization of findings. These enhancements would help teams focus on the most important items and reduce the time spent navigating through data. Review collected by and hosted on G2.com.

What I like best about Arnica is that it makes security easier to incorporate into my regular development workflow. The UI/UX is intuitive and organized, making it easier to review findings and understand which security issues need attention.

I also like the integration with the development ecosystem, as it helps bring security closer to the tools and workflows developers already use. This reduces the need to treat security as a completely separate process.

From a performance perspective, the experience is straightforward when reviewing and investigating findings. The real ROI for me comes from reducing the manual effort involved in identifying and understanding security issues and helping address them earlier in the development lifecycle.

The onboarding and support experience also adds value because security platforms can become complicated very quickly. A developer-friendly experience makes adoption much easier.

I also see value in automation and intelligent security insights, particularly when they help differentiate important risks from all the security information developers receive.

Overall, Arnica provides a good combination of usability, integration, security visibility, and automation. It helps make security a more natural part of everyday development rather than something that is handled only at the end of the release cycle. Review collected by and hosted on G2.com.

The main area I would like to see improved in Arnica is making security findings even easier for developers to act on. The UI is good overall, but complex findings can sometimes require additional investigation before determining the right remediation.

I would also appreciate deeper integrations with development workflows, continued improvements in performance, and more visibility into the measurable ROI provided through security automation.

For onboarding and support, more practical developer-focused examples and troubleshooting documentation would be helpful. On the AI/intelligence side, more contextual and actionable remediation recommendations could further reduce the time developers spend investigating security findings.

Overall, I don’t see these as major negatives, but rather areas where Arnica could further improve an already useful developer security experience. Review collected by and hosted on G2.com.

I use Arnica to check code changes in my PRs for security risks, hardcoded secrets, dependency issues, and vulnerabilities before I push to production, which is very helpful every time. I like that it’s pipelineless, so there’s zero CI cost per repo, and that it gives us uniform, unbypassable coverage. I trust it as the single gate for automation: some repos wait for the Arnica check before cutting release tags or auto-merging PRs. Setup was very easy and automated; I just had to log in, and other teams handled the repo-level setup. Review collected by and hosted on G2.com.

I’d like Arnica to do more than check secrets; I’d like it to check code coverage too. I’d also like a check at the push-commit level, not just the PR level, and a scoped trusted automation identity policy so a signed bot committing to a known path doesn’t need a synthetic PR round trip. Review collected by and hosted on G2.com.

I use Arnica as a security check across our repositories before code changes can move to the main branch. It helps us find and address vulnerabilities earlier, before they get into a build or production, which has reduced remediation costs. I find Arnica easy to set up and integrate with our CI/CD process, GitHub, Jira, and Teams. Its portal gives me a central place to view vulnerabilities and prioritize critical and high-severity issues. I can also use Teams to interact with Arnica, create and assign Jira tickets, and track issues through resolution. These integrations reduce manual effort and make it easier to move from detection to remediation. Review collected by and hosted on G2.com.

I’d like Arnica to reduce false positives and overly high-severity alerts by considering the application’s context, intended audience, and deployment environment. The risk can vary depending on whether an application is internal or externally facing and how it’s deployed. Getting context about the application being scanned would help me prioritize genuine high-risk vulnerabilities and avoid unnecessary investigation. Review collected by and hosted on G2.com.

Arnica gives us strong coverage across our full pipeline — IaC scanning, SAST, secrets detection, and AI-generated code scanning all in one platform. Having a single tool cover these areas instead of stitching together multiple point solutions has simplified our security workflow considerably. The secrets detection is particularly reliable and has caught real exposures before they reached production, and the AI-SAST capability is a nice forward-looking addition as more of our code is now AI-assisted. Review collected by and hosted on G2.com.

Honestly, there isn't much to complain about from our experience so far — the platform has covered our IaC, SAST, secrets, and AI-SAST scanning needs well. If I had to name something, it would be that with so much scan coverage running across the pipeline, it occasionally takes a little time to triage the full set of findings, so better prioritization or grouping of lower-severity results would be a nice enhancement. Review collected by and hosted on G2.com.

I like Arnica’s focus on securing source code repositories while making access management easier for DevOps teams. It provides better visibility and control without making the workflow unnecessarily complicated. Review collected by and hosted on G2.com.

Arnica offers an intuitive UI/UX, useful integrations, reliable performance, and good overall value. The support and onboarding make adoption easier, while its AI and intelligence capabilities can help simplify security-related workflows and improve visibility. Review collected by and hosted on G2.com.

I like that Arnica keeps all the repos safe from leaked credentials and scans every PR for possible attack vectors. Its triggers and alerts are very detailed and helpful. The static code analysis helps me pre-emptively identify risks like SQL injection and XSS, and fixing code risks boosts my confidence. Setup was pretty easy. Review collected by and hosted on G2.com.

I’d like more educational information about the CVEs Arnica identifies, and more agent-friendly interfaces and features. A CLI, playbook, or skills could help agents interact with Arnica better. I’d also love to use it with T3Code, but right now I rely on the gh CLI. Review collected by and hosted on G2.com.

The overall report and the filters—like marking an item for release and marking it as complete—often show false positives. Overall, everything in Arnica has really helped me manage and maintain things better. Review collected by and hosted on G2.com.

All the features currently included look good overall. That said, it would be better to have static code analysis enabled by default, rather than offering it only as an optional add-on. Review collected by and hosted on G2.com.