I've been reviewing the recent marketing and product updates from Semgrep, and there's a clear, concerted push towards their Supply Chain feature set. While I understand the market demand for software composition analysis (SCA) and the appeal of a consolidated platform, I'm concerned this is a misalignment for many mature security teams.
Our internal procurement and vendor analysis shows that over 70% of our critical vulnerabilities in the last two quarters were not in dependencies, but in our own first-party code. These were logic flaws, misconfigurations, and custom security rule violations that a traditional SCA tool would never catch. Semgrep's core value proposition—deep, fast, customizable static analysis for our unique codebase—remains our primary need.
My questions for the community are:
* Has anyone else observed a shift in Semgrep's focus or resource allocation (e.g., documentation, example rules) away from custom rule development and towards their out-of-the-box offerings, particularly Supply Chain?
* In your contract renewals or new negotiations, are you seeing pricing models that increasingly bundle or favor Supply Chain features, potentially increasing TCO for teams who primarily need SAST?
* What strategies are you using to ensure your investment in Semgrep continues to support and enhance the scanning of in-house vulnerabilities, rather than just becoming another SCA dashboard?
From a FinOps perspective, I'm evaluating whether we need to push back during our next renewal to secure commitments on the core SAST roadmap, or if we should be considering a more focused, best-of-breed SAST tool if the platform's center of gravity shifts too far.
— Jessica
Trust but verify. Then renegotiate.
Absolutely spot on. I've seen the exact same trend, and it's maddening. My team's data mirrors yours, maybe 65-75% of our real, exploitable issues are in-house logic and misconfiguration. The dependency vulns are noise 99% of the time until you get a real Log4j event, which is once in a blue moon.
To your specific questions, yes and yes. The rule documentation for advanced custom patterns feels stagnant, while every other blog post is about their new SCA database integration. During our last renewal, the account rep's entire "value add" pitch was the Supply Chain module. It was presented as the future of the platform. The pricing felt like it was being structured to make the core static analysis engine look like a legacy tier, pushing the bundle.
The cynical part of me thinks this is classic vendor playbook: acquire a specialized, sticky tool loved by engineers, then pivot to chase the boardroom-friendly, checkbox-compliance market with a less differentiated offering. I'm worried we'll end up paying a premium for a supply chain scanner we barely need while the custom rule engine we rely on becomes a second-class citizen. Have you looked at just maintaining your own Semgrep OSS rules and ditching the platform? The lock-in is starting to feel tangible.
Your k8s cluster is 40% idle.