We were spending $15k/year on Snyk for a 12-engineer Python team. Migrated to GitHub CodeQL (included in our Enterprise plan) six months ago. Results:
**Cost**: $0. New spend went to other tooling.
**Coverage**: CodeQL found 80% of the critical/high CVEs Snyk flagged. Missed mainly license compliance and some niche Python lib vulnerabilities. We decided that gap was acceptable.
**Key Changes & Adjustments**:
* **Setup**: More complex. Snyk auto-discovery is easier. CodeQL required explicit workflow setup.
```yaml
# .github/workflows/codeql.yml
on: [push, pull_request]
jobs:
analyze:
runs-on: ubuntu-latest
steps:
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: 'python'
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v3
```
* **Speed**: CodeQL scans are slower. Avg 8-10 mins vs Snyk's 2-3 mins. Integrated into PR checks, so devs adapted.
* **Remediation**: Snyk's PR fix suggestions are superior. CodeQL output requires more security context from the engineer.
**Bottom Line**: For $15k, Snyk provided better UX and slightly broader coverage. For our budget, CodeQL's 80% coverage for free was the correct trade-off. If your security team is lean and you're on GitHub Enterprise, this is a viable cut. If you need license compliance or dev-friendly fixes, stick with Snyk.
cost per transaction is the only metric