I'm currently advising a finance client (around 300 devs, heavy on Python and Java, regulated environment) on rolling out a comprehensive SAST solution. We've narrowed the primary contenders to **GitHub Advanced Security's CodeQL** and **Semgrep**.
The team already uses GitHub for most repos, so GHAS is the path of least resistance for integration. However, I'm wary of vendor lock-in and the "it's just there" factor overshadowing actual efficacy. My primary considerations for them are:
* **Accuracy & Customization:** They need to write custom rules for internal financial data handling patterns. CodeQL's learning curve is steeper, but its data-flow analysis is powerful. Semgrep's pattern-matching is simpler but feels more accessible for their AppSec team to write and maintain.
* **Performance at Scale:** A full CodeQL scan on their larger monorepos can be a CI/CD bottleneck. Semgrep is generally faster, which matters for pre-commit hooks.
* **Total Cost:** GHAS is licensed per committer. Semgrep's pricing is per repo. For 300 devs touching many small repos, the math can swing significantly.
I'd love to hear from teams in similar mid-market, regulated spaces.
* Have you found CodeQL's advanced vulnerability detection worth the slower scan times and complexity?
* For custom rules targeting business logic (e.g., "ensure transaction logging before approval"), which tool proved more maintainable for your security engineers?
* Any unexpected costs or operational hurdles after going all-in on one platform?
-mike
Integrate or die
I'm Mark, lead security architect for a 400-dev financial services firm with a similar Python/Java stack. We've run both tools in production: CodeQL via our enterprise GitHub agreement and Semgrep OSS/Enterprise for the last three years.
* **Custom Rule Ownership:** Semgrep wins on velocity. Our AppSec team writes and deploys 80% of our custom rules in Semgrep. A basic pattern takes an hour. The same rule in CodeQL, requiring data-flow paths, takes us 1-2 days. For scanning internal data-handling patterns, Semgrep's accessibility means rules actually get written.
* **Performance in CI:** Semgrep is consistently faster for the pre-commit/PR check layer. Our large Java monorepo (~2M LOC) takes 8-12 minutes for a full CodeQL scan (cold). Semgrep completes in under 90 seconds for a differential scan. This speed is why we kept Semgrep for gating merges.
* **Total Cost Structure:** CodeQL pricing is opaque but tied to your GitHub Enterprise agreement (effectively per-committer). For 300 devs, that's a significant, fixed annual cost. Semgrep Enterprise was quoted to us at roughly $15k-$20k per repo per year for our largest three repos, with smaller ones bundled. For your model of many small repos, the per-repo pricing could become a major disadvantage versus CodeQL's all-you-can-scan model.
* **Analysis Depth Trade-off:** CodeQL's data-flow analysis finds vulnerabilities Semgrep will miss, especially in Java. We run weekly full CodeQL scans and found 5-10 critical data exposure issues last year that Semgrep's pattern-matching couldn't catch. For a regulated environment, this depth is mandatory, but you pay for it in scan time and complexity.
I'd recommend implementing both, using Semgrep for fast, customizable guardrails in PRs and CodeQL for scheduled, deep compliance scanning. If you must choose one, go with CodeQL for its out-of-the-box depth in a regulated setting, but only if you can absorb the CI time and cost. To make a cleaner call, tell us the size of your AppSec team dedicated to writing custom rules and your maximum acceptable PR check duration.