Semgrep

““What drew me in early on was Semgrep's simplicity, transparency, and power, plus the sense that this was a company that truly cared, backed by a passionate community, compared to traditional security tools that often felt like black boxes.””

““Striking the right balance between speed and risk management requires more than just better tooling. It demands ongoing communication, empathy, and a culture where security is seen as an enabler rather than a blocker.””

““Semgrep did not just help us find issues. It helped us build the security program we always intended to have.””

““Semgrep gave us the context we needed to make good decisions.””

““Being able to answer leadership quickly with confidence and evidence is exactly the capability we set out to build.””

““It felt like having another reviewer on the PRs, not a blocker but a partner.””

““Semgrep helped us understand our environment in a way we simply could not before.””

““Semgrep felt practical. It fit how our engineers already worked.””

““Our goal was not to bolt on security. It was to build a foundation that would support ICE for years to come.””

“Semgrep isn’t just another scanner,” says Tschammer. “It’s part of how we build.”

“Pairing Wiz with Semgrep gave us critical context, ” says Tschammer. “We’re no longer chasing noise. We can zero in on what’s actually reachable and prioritize what truly matters.”

“Everyone — security, engineering, leadership cares about velocity,” says Tschammer . “But it has to be safe. Semgrep gives us the confidence to move fast without cutting corners.”

“Semgrep helped us strike that balance. It gives developers just enough signal at the right moment without overwhelming them.”

“We discovered Semgrep through a mix of online research and peer feedback,” recalls Máirtín O’Sullivan, Staff Product Security Engineer. “We were immediately impressed by the transparency, the customization, and how quickly we could write new rules. But the real game-changer was reachability analysis. It helped us cut through the noise and focus on what actually mattered.”

“While getting an awesome scanner like Semgrep Code for our SAST was great, Reachability Analysis via Semgrep Supply Chain was the cherry on top.”

““Getting the developers aligned on a SAST product and making them use it is the hardest part of the job for an AppSec Engineer. We were able to achieve this with Semgrep Code.””

“Semgrep Supply Chain has helped reduce the noise by 95%”

“The goal was not to ‘add another tool,’ but to implement high-quality, scalable security automation that fits naturally into how developers work.”

““With Semgrep, we’ve not only cut scan times dramatically, we’ve also built a more automated, scalable AppSec program that meets our developers where they work.””

““We treat engineers as partners, not just stakeholders. Semgrep helps us meet them where they are.””

““Now, developers see exactly what the issue is, right in the pull request. They know what to fix and why without switching tools,””

““With Semgrep, I trust that a critical finding will be relevant to us. It saves time and helps our developers focus on the issues that actually matter.””

“Semgrep lets us treat security and code quality as first-class priorities. The combination of customizable CI/CD configurations, custom rules, and finding policies gives us a SAST program that actually fits our codebase.”