Semgrep vs CodeQL vs Checkmarx - which gets better results?

I'm a lead security engineer at a mid-sized fintech (about 200 developers), and my team runs SAST across our Go, Python, and TypeScript services. We've had Semgrep in CI for two years, ran a CodeQL POC last year, and I used Checkmarx extensively at a previous enterprise employer.

My breakdown focuses on the operational realities of each tool based on the criteria you're likely weighing:

1. **Integration and Speed for Developers:** Semgrep is fastest and simplest. The CLI is a single binary, and scans for a typical service complete in 20-45 seconds. CodeQL requires you to build a database, which adds 2-5 minutes to our Go pipeline, often doubling CI time. Checkmarx scan times were highly variable, from 5 minutes to 25+ minutes on larger projects, which was a constant source of developer complaints.

2. **Rule Customization and Learning Curve:** Your example highlights Semgrep's biggest win. Writing a custom rule is a 15-minute task for an engineer. CodeQL's learning curve is severe. While its interprocedural analysis is powerful, you need to learn a dedicated query language and understand its abstract syntax trees. Creating a new CodeQL query for a novel vulnerability took me days. Checkmarx rule customization was contractually possible but required direct vendor engagement in my experience, a process taking weeks.

3. **False Positive Burden and Signal Quality:** Semgrep's pattern-matching excels at clear, syntactic issues (secrets, misconfigurations) but inherently misses complex data-flow vulnerabilities. Its false positives are predictable and easy to audit. CodeQL, when tuned, produced the most precise findings for vulnerabilities like SQLi or XSS with taint tracking, but the initial out-of-the-box rule set had a high false-positive rate we had to filter down. Checkmarx, in my last environment, generated the highest volume of findings, many of which were speculative ("potential" issues), leading to significant triage overhead.

4. **Total Cost and Commercial Reality:** Semgrep's free tier is generous, and its paid Pro tier was quoted at ~$35 per developer per year for us. CodeQL is free for public repos and has a complex license for enterprises; GitHub Advanced Security pricing scales with seats and is typically bundled. Checkmarx is purely enterprise, with annual contracts starting in the tens of thousands of dollars and scaling with codebase size or developer count. The hidden cost with Checkmarx is the operational overhead of managing the server and tuning results.

For a team just getting started with security scanning, I would recommend beginning with Semgrep. Its low friction allows you to establish a scanning habit and quickly catch the "low-hanging fruit" vulnerabilities without bogging the team down. The choice becomes clearer if you can specify two things: the percentage of your codebase that handles user input (e.g., web APIs), and whether your primary need is catching known patterns or discovering novel vulnerability flows in custom code.

> Semgrep felt super straightforward to write rules for

I'm also a big fan of Semgrep's rule-writing experience - it's like patching a monitoring alert but for code. Since you're coming from a monitoring background, I bet you'll appreciate how Semgrep lets you iterate on rules quickly without rebuilding a whole database or waiting on a heavy scanner.

That said, the "deeper flows" tradeoff is real. In my streaming/data pipeline world, we often have cross-service authentication patterns or async message passing that Semgrep's single-file analysis misses. CodeQL can catch those if you're willing to invest in query writing and the database build time, but for a team just starting out, I'd argue the false positive rate on Semgrep's community rules is low enough that you won't be overwhelmed.

What kind of vulnerabilities are you most worried about missing? If it's injection or auth bypass in async flows, maybe start with Semgrep and add a lightweight taint-tracking rule later. But if you're just looking for hardcoded secrets and shallow patterns, Semgrep's probably all you need for now.

>Semgrep is fastest and simplest. The CLI is a single binary, and scans for a typical service complete in 20-45 seconds.

Sure, it's fast. But speed is cheap. That 2-5 minute CodeQL database build you're complaining about? It's a one-time cost per commit that runs on a Spot Instance. At scale, your real cost isn't CI minutes; it's engineer hours lost to triaging shallow findings.

Semgrep's single-file analysis misses the expensive bugs - the auth flows that leak data between microservices. Fixing one of those in production costs more than a year of extra compute time.

You save pennies on pipeline runtime and waste dollars on incident response.

You're right that Semgrep's iterative rule writing is great for new teams. It feels like fast, direct feedback, which helps build security awareness quickly.

That said, I've seen teams get stuck in that "shallow pattern" comfort zone. You can start with hardcoded secrets, but you need a plan for graduating to more complex vulnerabilities. The trick is using Semgrep's good signal-to-noise ratio to build trust first, then layer in taint tracking or even a quarterly CodeQL scan for those cross-service flows. It doesn't have to be all-or-nothing.

What's your plan for handling the first "deep" bug that Semgrep misses? Having a process for that keeps the team from overcorrecting and abandoning the tool that catches 90% of their issues.