WillItSurvive
Cloud and infrastructure providers · United States

Semgrep

semgrep.dev ↗

Semgrep makes code scanning software that finds security bugs across many languages and platforms.

Losing its protection
Assessed 21 July 2026 · Evidence as of 21 July 2026
The structural protection is eroding.
On the recordSince 21 July 2026 · Checkable from 2026 · Every call on the record Checkpoint: Next disclosed revenue or renewal-retention update showing whether AWS Inspector is eating mid-market deals
The call

Semgrep still has a cross-platform niche, but AWS, GitHub, and the OpenGrep fork are closing in on the core scanning business it built its name on.

Semgrep finds bugs in software code across different platforms and programming languages. It was hard to replace because it worked everywhere and locked into developer workflows, but Amazon just released Inspector Code Security and GitHub released CodeQL, both free with their existing services, which undercuts Semgrep's pricing. Also, a competitor called OpenGrep forked Semgrep's free engine and removed the paywall, so companies can now get the same scanning for nothing. The only way Semgrep stays relevant is if its new AI tool for finding bugs in code written by AI (called Guardian) becomes something customers will actually pay for, before Amazon and GitHub add similar AI features to their free offerings.

Why
01
AI pressure: Cursor, Claude Code, GitHub Copilot code review features. Basic AI code review is getting bundled free into coding tools, squeezing the low end Semgrep used to own. Could AI do the core job? Only partly.
02
Bigger players: AWS Inspector Code Security, GitHub CodeQL/Advanced Security. AWS launched Inspector Code Security in 2025 and GitHub bundles CodeQL, both threaten mid-market renewals with free or cheap native scanning. Could a giant copy it? Yes, easily.
03
What protects it. Cross-cloud, cross-SCM neutrality plus CI/CD workflow lock-in that single-cloud native tools cannot match.
What would change this call
Semgrep discloses net dollar retention or renewal rates in next funding round or press. Would show whether AWS/GitHub bundling is visibly eroding mid-market accounts.
OpenGrep fork reports adoption numbers or becomes default free SAST tier for vendors. Would show the core scanning layer commoditizing away from Semgrep.
Guardian is cited by name as category leader in independent AI-code-security coverage within a year. Would show the AI-generated-code security bet is converting to a defensible category.
Key numbers
  • $100M Series D closed (Feb 2025)
  • Guardian runs 3M+ scans weekly, 95% under 5s (2026)
  • ARR estimated $33.6M to $57.6M range (Sep 2025)
Named risks
  • Core SAST scanning commoditizing under AWS Inspector and GitHub CodeQL bundling. Severity: high
  • OpenGrep fork (Jan 2025) could become default free tier, eroding community goodwill and CE adoption. Severity: medium
  • Revenue and valuation figures conflict widely across third-party trackers, indicating limited disclosure. Severity: medium
  • AI-generated-code security bet (Guardian, Custom Workflows) remains unproven as a revenue-material category. Severity: medium
Rivals, as read in July 2026
RivalDirectionEvidence
AWSgaining onLaunched Inspector Code Security at re:Inforce 2025, bundling scanning into cloud platform
GitHub/Microsoftgaining onGitHub Advanced Security/CodeQL live natively, no separate purchase needed, as of 2025-2026
OpenGrepcontesting10+ vendors forked Semgrep's engine into OpenGrep in Jan 2025 after Dec 2024 licensing change
SnykcontestingSnyk reported as bigger developer-first incumbent per Peerspot comparison, 2026-06-27
Wiz (Google)gaining onWiz, now part of Google, extends code-to-cloud coverage overlapping Semgrep's scanning territory
Questions people ask
Is Semgrep profitable?
No profitability figures have been disclosed by Semgrep. Third-party estimates put ARR around $33.6M as of Sept 2025 (Latka) or revenue near $57.6M (Datanyze), but the company has not released official financials as of 2026.
Could AI replace Semgrep?
Unlikely to fully replace it soon. Semgrep claims its hybrid deterministic+LLM engine finds 8x more true positives than LLM-only tools (vendor-claimed), but basic pattern scanning is being commoditized by AWS Inspector (2025) and the OpenGrep fork (Jan 2025).
Who owns Semgrep?
Semgrep, Inc. (formerly r2c) is privately held and venture-backed, headquartered in San Francisco. It has raised $204M total, including a $100M Series D led by Menlo Ventures that closed Feb 5, 2025. No IPO has been filed as of 2026.
Who is Semgrep's biggest competitor?
Snyk is the closest developer-first incumbent and reportedly bigger than Semgrep as of mid-2026 (Peerspot comparison). AWS Inspector Code Security (launched re:Inforce 2025) and GitHub Advanced Security/CodeQL also compete by bundling scanning into existing platforms.
How much funding has Semgrep raised?
Semgrep has raised $204M total as of Feb 5, 2025, including a $100M Series D led by Menlo Ventures with Felicis, Harpoon, Lightspeed, Redpoint, and Sequoia participating, following a $53M Series C in April 2023 and $13M Series A in October 2020.
What is the OpenGrep fork and why does it matter for Semgrep?
OpenGrep is a community fork of Semgrep's engine created in January 2025 by 10+ competing vendors after Semgrep moved previously-open features behind a commercial license in December 2024, threatening to become the default free-tier alternative.
Timeline
  • 2026-06-30Headcount reaches 269 employees, up 38% YoY (Crustdata)
  • 2025-10-27Standalone MCP server deprecated and folded into main Semgrep repo
  • 2025-02-05Closes $100M Series D led by Menlo Ventures, total funding hits $204M
  • 2025-0110+ vendors fork Semgrep engine into OpenGrep community project
  • 2024-12Semgrep moves previously-open features behind a commercial license
  • 2023-04Closes $53M Series C led by Lightspeed Venture Partners
  • 2020-10Closes $13M Series A backed by Redpoint Ventures and Sequoia Capital
Revision history
21 July 2026
First assessed. Losing its protection. The text above is fixed as of this date and is not edited afterwards.
In the same band
Cognition AILovableReplit
More in Cloud and infrastructure providers →
Sources