Semgrep

““Now, developers see exactly what the issue is, right in the pull request. They know what to fix and why without switching tools,””

“Semgrep isn’t just another scanner,” says Tschammer. “It’s part of how we build.”

“Pairing Wiz with Semgrep gave us critical context, ” says Tschammer. “We’re no longer chasing noise. We can zero in on what’s actually reachable and prioritize what truly matters.”

“Everyone — security, engineering, leadership cares about velocity,” says Tschammer . “But it has to be safe. Semgrep gives us the confidence to move fast without cutting corners.”

“Semgrep helped us strike that balance. It gives developers just enough signal at the right moment without overwhelming them.”

“We discovered Semgrep through a mix of online research and peer feedback,” recalls Máirtín O’Sullivan, Staff Product Security Engineer. “We were immediately impressed by the transparency, the customization, and how quickly we could write new rules. But the real game-changer was reachability analysis. It helped us cut through the noise and focus on what actually mattered.”

““With Semgrep, I trust that a critical finding will be relevant to us. It saves time and helps our developers focus on the issues that actually matter.””

“Semgrep Supply Chain has helped reduce the noise by 95%”

“The goal was not to ‘add another tool,’ but to implement high-quality, scalable security automation that fits naturally into how developers work.”

“Semgrep empowers our developers with real-time security insights, cutting remediation time by 50% while seamlessly integrating into our workflow.”

“Semgrep lets us treat security and code quality as first-class priorities. The combination of customizable CI/CD configurations, custom rules, and finding policies gives us a SAST program that actually fits our codebase.”

““Semgrep did not just help us find issues. It helped us build the security program we always intended to have.””

““Semgrep gave us the context we needed to make good decisions.””

““Being able to answer leadership quickly with confidence and evidence is exactly the capability we set out to build.””

““It felt like having another reviewer on the PRs, not a blocker but a partner.””

““Semgrep helped us understand our environment in a way we simply could not before.””

““Semgrep felt practical. It fit how our engineers already worked.””

““Our goal was not to bolt on security. It was to build a foundation that would support ICE for years to come.””

““We’ve seen measurable improvements in remediation time because findings are clearer, more actionable, and easier to prioritize. Developers now view the tool as part of their natural workflow rather than an external gate.””

““With Semgrep, that experience changed dramatically. The introduction of features like Assistant, which combines auto-triage noise filtering with clear remediation recommendations, has made findings far more actionable.””

““Onboarding Semgrep was straightforward, with quick integration into our pipelines. A pleasant surprise was the low barrier to writing custom rules, which gave the team early wins and built confidence in the program.””

““What drew me in early on was Semgrep's simplicity, transparency, and power, plus the sense that this was a company that truly cared, backed by a passionate community, compared to traditional security tools that often felt like black boxes.””

““Striking the right balance between speed and risk management requires more than just better tooling. It demands ongoing communication, empathy, and a culture where security is seen as an enabler rather than a blocker.””