Overview
Semgrep is an application security company built around a fast, open-source static analysis engine that scans source code for vulnerabilities and bugs using lightweight, pattern-based rules. Originally created at r2c, Semgrep has grown into a full code security platform that combines SAST, software composition analysis, and secrets detection with increasingly autonomous, AI-assisted triage and remediation.
Platform and AI
Semgrep's engine supports dozens of languages and lets teams write custom rules that look like the code they are checking. Its commercial platform layers on dataflow analysis, dependency scanning, and an AI assistant that reduces false positives and proposes fixes, allowing security programs to scale without slowing developers. The approach emphasizes integrating security directly into developer workflows and CI pipelines.
Funding and Adoption
Semgrep raised a $100M Series D led by Menlo Ventures in February 2025, with participation from Felicis, Harpoon, Lightspeed, Redpoint, and Sequoia, bringing total funding to $204M. The platform is widely adopted across engineering organizations that want cost-effective, high-signal code security embedded in their development process.
