--- title: Semgrep Reviews meta_title: 'Semgrep Reviews 2026: Details, Pricing, & Features | G2' meta_description: Filter 56 reviews by the users' company size, role or industry to find out how Semgrep works for a business like yours. aggregate_rating: rating_value: 4.6 review_count: 56 scale: '5' date_modified: '2026-09-22' parent_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- # Semgrep Reviews **Vendor:** Semgrep **Category:** [Software Composition Analysis Tools](https://www.g2.com/categories/software-composition-analysis) **Average Rating:** 4.6/5.0 **Total Reviews:** 56 **AI Enabled:** This product embeds AI to enhance or extend its core functionality. ## About Semgrep Semgrep is a modern static analysis (SAST), software composition analysis (SCA), and secrets detection platform designed for both developers and security teams. It combines fast, deterministic analysis with context-aware AI that triages findings like a senior security engineer. The AI Assistant helps reduce false positives, prioritize meaningful results, and offers clear remediation guidance. Its “Memories” feature learns from past decisions to further reduce triage noise over time. Semgrep also supports deep analysis of transitive dependencies, not just direct ones, helping teams surface and address hidden risks in their supply chain. It integrates well into modern development workflows and is easy to customize across environments. ## Semgrep Pros & Cons Pros and Cons are compiled from review feedback and grouped into themes to provide an easy-to-understand summary of user reviews. **What users like:** - Users appreciate the **ease of use** of Semgrep, enabled by its intuitive syntax and smooth integration with CI/CD. (16 reviews) - Users appreciate the **flexibility and speed** of Semgrep in enforcing coding standards and catching vulnerabilities effectively. (14 reviews) - Users appreciate the **effective vulnerability detection** of Semgrep, facilitating quick identification and resolution of security issues. (13 reviews) - Users appreciate the **scanning efficiency** of Semgrep, benefiting from rapid scans and streamlined CI/CD integration. (12 reviews) - Users value Semgrep for its **effective security vulnerability detection** , enabling quick resolutions without hindering development speed. (12 reviews) - Users value the **fast performance** of Semgrep, allowing quick identification of security issues without slowing down development. (11 reviews) - Users value the **automated scanning** capabilities of Semgrep, effectively identifying vulnerabilities early in development. (10 reviews) - Users appreciate the **high accuracy of findings** in Semgrep, noting minimal false positives in analysis results. (9 reviews) - Users appreciate the **easy customization and fun rule creation** with Semgrep, enhancing development efficiency and accuracy. (9 reviews) - Easy Integrations (9 reviews) **What users dislike:** - Users find Semgrep **not user-friendly** due to a steep learning curve and complex initial setup requirements. (7 reviews) - Users find the **limited features** of Semgrep restrict its usability and complicate effective vulnerability management. (6 reviews) - Users find the **difficult learning** curve for Semgrep daunting, especially for creating advanced rules and setups. (5 reviews) - Users express concerns about the **lack of guidance** in creating custom rules, complicating effective use of Semgrep. (5 reviews) - Users note a **steep learning curve** for Semgrep's rule syntax, making it challenging for newcomers to master. (5 reviews) - Learning Difficulty (5 reviews) - Users find the **missing features** in Semgrep limiting, requiring supplementary tools for comprehensive security coverage. (5 reviews) - Users find **code management challenging** due to tricky setups and steep learning curves for custom rules. (4 reviews) - False Positives (4 reviews) - Setup Complexity (4 reviews) ## Semgrep Reviews ### 1. Effective, efficient and eng friendly scanner **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Insurance | Mid-Market (51-1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through a business email account **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 14, 2022 **What do you like best about Semgrep?** It's a super customizable, fast and effective tool to have as an inline scanner on the CI/CD pipeline. **What do you dislike about Semgrep?** Nothing really - support is amazing and while they are still early in developing their product suite, they are super receptive to feedback **What problems is Semgrep solving and how is that benefiting you?** Shifting security left in an Eng friendly way ### 2. Lightning fast SAST **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Mid-Market (51-1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through Google using a business email account **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 08, 2022 **What do you like best about Semgrep?** It runs super quickly and consistently produces some of the highest-quality and relevant findings I've seen when comparing against other options. **What do you dislike about Semgrep?** The web app could use some polish, but they're focused on rapid improvements. **What problems is Semgrep solving and how is that benefiting you?** Greater visibility into vulnerabilities in our code. ### 3. Extremely easy to setup and use resulting in immediate value. **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Small-Business (50 or fewer emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Current User:** The reviewer uploaded a screenshot or submitted the review in-app verifying them as current user. **Validated Reviewer:** Validated through LinkedIn **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 08, 2022 **What do you like best about Semgrep?** Very easy to set up and the time to value is very short. **What do you dislike about Semgrep?** I wish the rules had more information on remediation. **What problems is Semgrep solving and how is that benefiting you?** Providing static application security analysis with high quality scanning ### 4. I got a really great experience using Semgrep to fix most vulnerabilities I had with my repo. **Rating:** 4.5/5.0 stars **Reviewed by:** Verified User in Information Technology and Services | Enterprise (> 1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through Google using a business email account **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 13, 2022 **What do you like best about Semgrep?** 1 - Security enforcement.
2 - Finding common bugs in code. **What do you dislike about Semgrep?** It was hard for to set it up with my GitHub repo, so things here can be improved for the future. **What problems is Semgrep solving and how is that benefiting you?** - Like mentioned above the ability to scan for bugs and vulnerabilities in my public repo is one of the benefits.
- CI/CD life improvement.
- Improving code security. ### 5. Semgrep review **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Computer Software | Enterprise (> 1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through Google using a business email account **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 08, 2022 **What do you like best about Semgrep?** I love how customizable semgrep is in terms of identifying static as well as prod sec vulnerabilities **What do you dislike about Semgrep?** No standard set of error checks for static analysis atleast. Has to be customized **What problems is Semgrep solving and how is that benefiting you?** Detecting prod sec vulnerabilities as well as static errors ### 6. Semgrep suited us very well **Rating:** 5.0/5.0 stars **Reviewed by:** Verified User in Financial Services | Mid-Market (51-1000 emp.) This reviewer's identity has been verified by our review moderation team. They have asked not to show their name, job title, or picture. **Validated Reviewer:** Validated through Google using a business email account **Source: Organic:** Organic review. This review was written entirely without invitation or incentive from G2, a seller, or an affiliate. **Reviewed Date:** December 09, 2022 **What do you like best about Semgrep?** Easy integration and custom rules. The CLI makes it very easy to run tests locally. **What do you dislike about Semgrep?** The new UI is a little confusing and the filter addition is a little slow **What problems is Semgrep solving and how is that benefiting you?** Helped with our SAST program - [View Semgrep pricing details and edition comparison](https://www.g2.com/products/semgrep/reviews?page=2§ion=pricing&secure%5Bexpires_at%5D=2026-09-29+08%3A17%3A40+-0500&secure%5Bsession_id%5D=5f184f8f-3837-420f-ab63-c4f4e054dd2d&secure%5Btoken%5D=e17893c2f898eb8a6d4aebf70cedb758423862bfe7bd0195fb4d42fda99a288d&format=llm_user) ## Semgrep Features **Additional Functionality** - Tagging - Natural Language Processing - Data Extraction - Multi-Language - Predictive Analytics - Drag & Drop - Speech Recognition - Reporting/Analytics - Data Storage Management - Virtual Personal Assistant (VPA) - AI Copilot - Customer Segmentation - Collaboration Tools - Data Import/Export - Generative AI - For eCommerce - Role-Based Permissions - Customizable Branding - Search/Filter - Monitoring - Document Management - API - Data Visualization - Trend Analysis - Machine Learning - Access Controls/Permissions - Alerts/Escalation - Performance Metrics - Real-Time Data - Third-Party Integrations - Mobile App - Multiple Data Sources - For Sales Teams/Organizations - Sentiment Analysis - Activity Dashboard - Chatbot - Workflow Automation **Additional Functionality** - Code Generation - Text to Image - Generative AI - API - Natural Language Processing - Virtual Characters and Avatars - Content Generation - Personalization and Recommendation - Conditional Generation - Transformer Model - Automated Image & Video Editing - Interactive and Co-Creative Systems - Text Summarization - Data Augmentation - Variation Autoencoder Models - Adversarial Training - Transfer Learning and Fine-tuning - Simulation and Scenario Generation - Creative Design - AI Copilot - Prompt Engineering - Foundation Model **Administration** - API / Integrations - Extensibility **Performance** - Issue Tracking - Detection Rate - False Positives - Automated Scans - Anomaly/Malware Detection **Functionality - Software Composition Analysis ** - Language Support - Integration - Transparency **Documentation** - Feedback - Prioritization - Remediation Suggestions **Agentic AI - Static Code Analysis** - Adaptive Learning - Natural Language Interaction - Proactive Assistance **Performance - AI AppSec Assistants** - Remediation - Real-time Vulnerability Detection - Accuracy **Analysis** - Real-Time Analytics - Issue Tracking - Static Code Analysis - Code Analysis - Integrated Development Environment **Analysis** - Reporting and Analytics - Issue Tracking - Static Code Analysis - Vulnerability Scan - Code Analysis **Network** - Compliance Testing - Perimeter Scanning - Configuration Monitoring - Vulnerability Scanning - Source-Code Scanning - Web Scanning **Effectiveness - Software Composition Analysis** - Remediation Suggestions - Continuous Monitoring - Thorough Detection **Security** - False Positives - Custom Compliance - Agility **Integration - AI AppSec Assistants** - Stack Integration - Workflow Integration - Codebase Contextual Awareness **Testing** - Command-Line Tools - Compliance Testing - Source-Code Scanning - Detection Rate - False Positives - Multi-Language Scanning **Testing** - Black-Box Scanning - Detection Rate - False Positives **Application** - Static Code Analysis - Black Box Testing - Risk Analysis **Agentic AI - Interactive Application Security Testing (IAST)** - Autonomous Task Execution **Agentic AI - Vulnerability Scanner** - Autonomous Task Execution - Proactive Assistance **Agentic AI - Static Application Security Testing (SAST)** - Autonomous Task Execution **Additional Functionality** - SSL Security - HIPAA Compliant - API - Threat Response - Endpoint Protection - Maintenance Scheduling - Third-Party Integrations - Security Auditing - Application Security - Encryption - Network Security - Real-Time Reporting - AI Copilot - Reporting/Analytics - Authentication - Financial Data Protection - Anti Virus - Secure Data Storage - Virus Definition Update - Activity Dashboard - VPN - Audit Trail - Anti Spam - Access Controls/Permissions - Data Visualization - Alerts/Escalation - Data Security - Runtime Container Security - Asset Discovery - Threat Intelligence - Vulnerability Protection - Alerts/Notifications - Vulnerability/Threat Prioritization - Generative AI - SQL Injections - Real-Time Analytics - Threat Protection - Web-Application Security - Password Protection - Website Crawling - Vulnerability Assessment **Additional Functionality** - Debugging - Generative AI - AI Copilot - For Developers - Deployment Management - Application Security - Dashboard ## Top Semgrep Alternatives - [SonarQube](https://www.g2.com/products/sonarqube/reviews) - 4.4/5.0 (152 reviews) - [Snyk](https://www.g2.com/products/snyk/reviews) - 4.5/5.0 (136 reviews) - [Aikido Security](https://www.g2.com/products/aikido-security/reviews) - 4.6/5.0 (265 reviews)