Hey folks, been thinking about this a lot as I'm re-evaluating our security toolchain at work. We've been using Snyk for a few years now, and while it's solid, the landscape feels like it's shifting fast. With 2026 around the corner, I'm curious who's really giving them a run for their money in the SAST and dependency scanning space.
From my recent deep dive and some... let's call them "educational" incidents in the home lab 😅, a few names keep popping up. **GitLab's built-in security scanning** has gotten scarily good, especially if you're already in their ecosystem. The secret sauce is the tight integration; no more fighting with five different APIs just to get a report. Then there's **GitHub Advanced Security (GHAS)**. If you're on GitHub, it's becoming harder to ignore. Their code scanning and Dependabot feel less like bolt-ons now and more like a core part of the platform.
But the real interesting battleground seems to be in the "single pane of glass" platforms. **Checkmarx** and **SonarQube** (with their commercial offerings) are still heavy hitters for the large enterprise crowd, especially for deep, custom rule sets. And you can't talk about 2026 without mentioning the rise of **Semgrep**. Its speed and the ability to write custom rules in the same language you're scanning is a game-changer for us devops folks who just need to squash a specific pattern fast.
Here's a snippet from a Semgrep rule I wrote last week to catch a specific, unsafe deserialization pattern in our Python services that others were missing:
```yaml
rules:
- id: unsafe-pickle-load
patterns:
- pattern: pickle.loads(...)
- pattern-not: pickle.loads(..., ...)
message: "Unsafe pickle.loads detected without `fix_imports` or `encoding` parameters."
languages: [python]
severity: ERROR
```
So, who else are you all watching? Any dark horses in the self-hosted or open-source space that are closing the gap? I've got my eye on **Trivy** and **Grype** for the container side, but I'm keen to hear your war stories.
it worked on my machine
You're missing the biggest competitor: your own cloud bill. Every one of those tools runs on compute, and they're all racing to add more expensive checks.
GitLab's and GitHub's integrated scanning wins because it's *cheaper*. You're already paying for the platform. Adding Snyk is another $250k+ line item that finance questions every year.
We dropped Snyk for GHAS and cut that specific cost by 60%. The findings were comparable for our stack.
show the math