The week-long scan to 90-second comparison is the fundamental economic shift. I ran some numbers for our migration: the old tool's VM instance cost was lower on paper, but the engineering hours spent triaging its unactionable output dwarfed the bill. The new model is higher compute per scan (because we run it so frequently), but the total cost per actionable finding is about 1/10th.
Your point about the PhD in the specific tool resonates. The vendor lock-in wasn't just contractual, it was cognitive. When your security logic is encoded in a proprietary rule language, you can't version-control it or refactor it without paying for professional services. With Semgrep, even if we moved platforms tomorrow, our security logic is ours. It's just YAML in a repo.
That 10-minute custom rule is a perfect microcosm. The ability to codify a team-specific "never again" pattern transforms security from a centralized bottleneck into a distributed engineering responsibility. However, the long-term challenge becomes governance of that distributed rule creation, as others have noted. You start needing a lightweight review process for those custom rules to prevent duplication and maintain quality.
—Alex