SemGrep: cybersecurity software

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list.

What SemGrep is

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list. The vendor site is semgrep.dev. This profile is an entry in the oneNorma directory, not a vendor landing page.

What SemGrep covers

SemGrep is in the catalog for these capabilities. Categories: ASPM, SAST, SCA, Secret Scanning, and Agentic Development Security. Catalog tags: Best for Startups, Hands-on, Open Source, and Nerdy.

How to evaluate SemGrep in a security program

Use SemGrep as a stack candidate, not as diligence evidence. The oneNorma score for SemGrep is 5.5/10 (percentile 65). If the real gap is in ASPM, SAST, SCA, Secret Scanning, and Agentic Development Security, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what semgrep.dev publishes. Contrast it with pentesting and Security Cloud & Compliance.

Classification

Categories

ASPMSASTSCASecret ScanningAgentic Development Security

Tags

Best for StartupsHands-onOpen SourceNerdy

Capabilities by category

SAST

ReachabilityEnterpriseAI

Secret Scanning

Platform

ASPM

Scanning

Agentic Development Security

AI SAST

Frequently asked questions

What is SemGrep?

For what Snyk offers in usability across functions, SemGrep excels in customization. Their tool offers extensive customizations and rule sets, and their reachability analysis, a critical aspect of SCA, beat Snyk to market. Also, their open source tooling is powering many other tools on this list. Site: semgrep.dev.

Which categories does SemGrep fall into?

SemGrep appears in the oneNorma directory under ASPM, SAST, SCA, Secret Scanning, and Agentic Development Security. Use those labels to compare it with other vendors for the same problem, not as an official ranking.

Does oneNorma resell or implement SemGrep?

No. The SemGrep profile (semgrep.dev) is for inventory and comparison. oneNorma delivers offensive and compliance evidence (pentesting, cloud compliance), not a vendor license.

Other cybersecurity vendors

More profiles from the vendor directory.