Our team ran Semgrep for about 18 months. The custom rules were solid, but the signal-to-noise ratio in PRs was getting rough. Too many "this is just how the code is" findings. The CLI is great, but the central management felt like an afterthought.
Switched to Snyk Code three months ago. The good:
* Integration was stupid easy (GitHub Apps). It's just there.
* Findings are more contextual. Fewer false positives on legacy patterns.
* The dashboard actually gets used by devs. Semgrep's was a ghost town.
The bad:
* You pay for the privilege. It's not cheap.
* Custom rules aren't as intuitive as Semgrep's pattern matching. More of a learning curve.
* Miss the raw speed of the Semgrep CLI for local scans.
Bottom line: For a team that doesn't want to curate rules constantly, Snyk works. You trade control and cost for a quieter, more dev-friendly experience. Wouldn't go back, but I do keep the Semgrep CLI in my toolbox for ad-hoc stuff.
Status page is my homepage.
I'm J. Carter, an IT lead at a mid-sized marketing agency. We manage about 50 devs and a mix of web apps and internal tools, and we've been running Snyk across our GitHub repositories for the last year, after a trial with Semgrep's paid tier.
Here's what I've seen:
* **Team Adoption:** This is the biggest gap. Semgrep's dashboard felt like a tool for the security team to push reports. Snyk's findings live directly in our PRs and the dashboard is simple enough that engineers actually open it to triage. For us, that shift was worth the cost alone.
* **Pricing Realities:** Semgrep's team tier starts around $4-6k/year for the platform, while Snyk Code is bundled in their developer security platform, which runs us about $60-70 per developer per year on an annual commit. The entry cost for Snyk is definitely higher.
* **Rule Management:** Semgrep's custom rules are faster to write and test locally. Snyk's custom rules (using their IR) have a steeper curve; you're not just writing patterns, you're thinking about data flow. For dedicated AppSec folks, Semgrep wins. For devs owning security, Snyk's defaults work better out of the gate.
* **Performance & Integration:** Semgrep's CLI is unbeatable for a fast, local scan - we still use it for pre-commit hooks. But Snyk's GitHub App integration was a 15-minute setup and then it just runs. The central management wasn't an afterthought; it was the product.
My pick is Snyk Code for teams where you need developer buy-in more than you need deep, custom rule creation. If your team has dedicated security engineers who will build and maintain a robust rule set, Semgrep's platform is more powerful and cost-effective. Tell us your team size and whether you have dedicated AppSec support, and the choice gets much clearer.
Migration is never smooth.
Your point about central management being an afterthought hits hard. We ran into that exact wall during a Heroku-to-AWS migration. Semgrep's CLI was our lifeline for finding hardcoded creds across 400 repos, but getting those curated rule sets synced and visible to the whole team? A mess of spreadsheets and ignored Slack channels.
That said, I'm surprised you're keeping the CLI just for ad-hoc scans. For me, the speed differential got irrelevant once I scripted Snyk's API for targeted local sweeps. It's more ceremony, but it keeps everything under one billing umbrella. The real cost isn't the license fee, it's the context switching between two rule sets and dashboards.
Expect the unexpected