Last raised 01
$100M Series D [CO005] Diligence report
Semgrep
Refreshed Monthly Diligence Report — September 2026
Semgrep remains a differentiated developer-native AppSec platform with strong customer and product signals, but opaque financials and renewed license/competitive pressure keep the case in research-more territory.
Coverage and disclosure
This refresh confirms Semgrep's product momentum, Series D financing, and current pricing/launch posture, but it still lacks public ARR, NRR, burn, and an audited valuation. Headcount is an external estimate and should be treated as directional rather than exact.
Cover facts
Company profile
Semgrep is a San Francisco-based application security company founded in 2017 by Isaac Evans, Drew Dennison, and Luke O'Malley. The company started as an open-source static analysis engine and now sells a broader AppSec platform that spans Code, Supply Chain, Secrets, Assistant, and Guardian. Its commercial motion is open-core and contributor-based, with a free edition used as the distribution wedge and paid tiers layered on top for governance, cross-file analysis, and AI-assisted remediation.
- Website
- semgrep.dev
- Founded
- 2017-01-01
- Founders
- Isaac Evans, Drew Dennison, Luke O'Malley
- Founding location
- San Francisco, CA
- Headquarters
- San Francisco, CA
- Product
- Open-core application security platform with SAST, SCA, secrets scanning, AI triage, and agentic guardrails.
- Customers
- Developer-heavy software teams that want security scanning in CI, PRs, IDEs, and AI coding workflows.
- Business model
- PLG open-core motion with a free Community Edition and contributor-based paid tiers for teams and enterprises.
- Stage
- Series D
- Funding status
- $100M Series D closed in February 2025 led by Menlo Ventures; total raised $204M.
Executive summary
Top strengths
- Fast, developer-friendly AppSec workflow with strong open-core distribution
- Broadening platform stack across Code, Supply Chain, Secrets, Assistant, and Guardian
- Publicly visible enterprise logos and customer references
- Meaningful capital base and venture backer syndicate
- AI/agentic security narrative that matches current developer tooling trends
Top risks
- Open-source license backlash and OpenGrep fork risk
- GitHub-native and broader AppSec-suite competition
- No public ARR, NRR, burn, or runway disclosure
- Valuation still based on secondary signals rather than audited disclosure
- Customer retention and conversion quality remain unquantified
Open gaps
- Current ARR, revenue run-rate, and growth rate
- NRR / retention and gross margin
- Cash burn and runway
- Audited or board-approved valuation
- Current customer count and net expansion proof
Contents
01Company Overview
1.1 Identity, Origin, and Product Shape
Semgrep is headquartered in San Francisco and was founded in 2017 by Isaac Evans, Drew Dennison, and Luke O'Malley. The business began as an open-source static analysis engine and has since grown into a commercial AppSec platform that spans SAST, SCA, and secrets scanning. The current positioning is explicitly developer-centric: Semgrep says the platform is for builders and agents, not just AppSec specialists, and it emphasizes fast scans, low noise, and workflow-native delivery. The open-source roots still matter. The free Community Edition remains the acquisition wedge, while the commercial platform layers in cross-file analysis, AI triage, policy controls, and reporting. The company now uses the same core engine for code, supply chain, and secret detection, which gives the product line a coherent architecture rather than a bundle of loosely related tools. Recent product messaging shows the company moving beyond a traditional PR-check scanner. Guardian, released in 2026, is framed as an agentic security layer for AI-written code and sits alongside the broader platform messaging on autonomous remediation and real-time guardrails. [CO001, CO002, CO003, CO010, CO011]
| Metric | Value | As of | Confidence | Caveat |
|---|---|---|---|---|
| Founded | 2017 | 2017 | high | |
| Headquarters | San Francisco, CA | 2026-09 | high | |
| Latest public funding | $100M Series D | 2025-02 | high | Official company announcement |
| Total funding | $204M | 2025-02 | high | Official company announcement |
| Headcount | 266 | 2026-08-26 | medium | Tracxn point-in-time estimate |
| Pricing entry point | Free up to 10 contributors; Teams starts at $30/contributor/month | 2026-09 | high | |
| Customer count | Not publicly disclosed | 2026-09 | medium | |
| Disclosure profile | Private-undisclosed | 2026-09 | high |
Headcount is an external estimate and may lag; customer count and ARR are not publicly disclosed.
[CO001, CO004, CO005, CO007, CO009, CO012]| Date | Milestone | Why it mattered |
|---|---|---|
| 2017 | Semgrep founded in San Francisco | Company formation |
| 2020 | Open-source engine reaches mainstream usage | Community wedge strengthened |
| 2023 | Series C closed | Platform scale-up capital |
| 2025 | Series D closed | AI and GTM expansion capital |
| 2026 | Guardian launch | Agentic code-security positioning |
| 2026 | 266 employee estimate | Scaled private-company footprint |
The milestones are a compact factual timeline built from official and third-party refresh sources.
[CO001, CO005, CO007, CO010, CO013]Public scale and commercialization markers for Semgrep.
Headcount is a third-party estimate and pricing is public list pricing.
[CO003, CO004, CO005, CO007]1.2 Capital, Scale, and Commercial Traction
Semgrep's capital base is now large enough to support a broad enterprise push. The company announced a $100M Series D in February 2025 led by Menlo Ventures, bringing total funding to $204M. Earlier, TechCrunch covered the $53M Series C in 2023, when the business was still much smaller and publicly described revenue growth as strong but undisclosed in absolute terms. The current investor mix remains classic venture-backed security infrastructure: institutional, multi-round, and still privately held. The latest public headcount data point in the refreshed bundle shows 266 employees as of late August 2026 from Tracxn, which is directionally consistent with a company that has moved from open-source project to scaled platform vendor. The company also continues to market contributor-based pricing, with a free tier and a Teams tier starting at $30 per contributor per month. Customer references remain strong but incomplete. Semgrep publicly names companies such as Dropbox, Figma, Slack, Snowflake, and Notion, but it does not publish a current customer count or any audited revenue metric. That combination suggests meaningful adoption without full financial transparency. [CO004, CO005, CO006, CO007, CO008, CO009]
| Item | Status | Evidence |
|---|---|---|
| Series D lead | Menlo Ventures | PRNewswire announcement |
| Prior led round | Lightspeed-led Series C | TechCrunch coverage |
| Revenue disclosure | No public ARR or revenue | Company does not publish a filing |
| Customer references | Figma, Dropbox, Slack, Snowflake, Notion | Company website and about page |
| Product motion | Open-source wedge into paid platform | Semgrep site and docs |
This is a partial commercial snapshot; none of the financial rows are independently audited.
[CO002, CO004, CO005, CO006, CO008, CO009]1.3 Refresh Delta and Open Gaps
The 2026 refresh is most useful where the company has changed recently: Guardian is now the flagship agentic-code-security narrative, and the pricing page has converged on a clearer free/Teams/Enterprise structure. At the same time, the largest diligence gaps remain the same as before: current ARR, NRR, burn, and an externally verified valuation are still not disclosed. Those missing numbers matter because Semgrep is now beyond the point where product quality alone resolves the investment case. The business has real traction, but the refreshed evidence still does not allow a clean underwriting of growth efficiency or an exact public-market-style multiple. The right posture is therefore to treat this as a high-quality private software company with strong product evidence and incomplete financial visibility. [CO004, CO009, CO010, CO012]
| Gap | Why it matters | Next check |
|---|---|---|
| ARR / revenue run-rate | Needed to size growth and valuation | Request current management numbers |
| NRR / retention | Needed to judge expansion quality | Pull a current cohort or board metric |
| Burn and runway | Determines capital dependency | Ask for cash-flow and burn bridge |
| Externally verified valuation | Needed to anchor the multiple | Validate against secondary or board materials |
Open items are the main blocker to a higher-confidence valuation call.
[CO009, CO012]02Market Analysis
2.1 Problem Definition and Market Pull
The market pull behind Semgrep is straightforward: organizations keep shipping more code, often with AI agents involved, while security teams want higher signal and less review fatigue. Semgrep's own messaging emphasizes exactly that shift, with product pages and the Guardian launch framing the market as one in which builders and agents need guardrails directly in the workflow. Independent comparison sources make the same basic point: teams care about scan speed, actionable findings, and how well a product fits PR, IDE, and CI workflows. The buying motion is still anchored in developer experience. Semgrep's free Community Edition and low-friction pricing create a bottom-up motion, while the commercial platform solves the problems that appear once teams need cross-file analysis, team governance, and broader policy control. That means the company is not competing only on detection quality; it is also competing on adoption mechanics and the ability to move from individual usage to org-wide deployment. AI-written code makes the market bigger and more urgent, but it also raises the bar. Tools now need to understand context, not just pattern-match text, and they need to keep up with the volume of new code being produced by humans and agents alike. [CM001, CM002, CM003, CM004]
| Force | What it means for Semgrep | Evidence |
|---|---|---|
| AI-generated code | More code to scan and more guardrails needed | Guardian launch and official product messaging |
| Developer friction | Noise reduction becomes a buying criterion | Semgrep Assistant / AI triage claims |
| Bottom-up adoption | Free tier supports product-led growth | Pricing page |
| Workflow-native security | PR/IDE/CI integration matters | Docs and comparison sources |
This is a qualitative market map rather than a quantified TAM model.
[CM001, CM002, CM005, CM006]The refreshed market signals most relevant to Semgrep's 2026 positioning.
The market snapshot summarizes directional evidence rather than a quantified TAM model.
[CM001, CM002, CM004, CM005, CM006, CM007, CM009, CM010, CM011, CM012]2.2 Segmentation, Pricing, and GTM Shape
Semgrep's segmentation is unusually clear. The free Community Edition targets individual developers, security auditors, and smaller teams that are willing to tolerate some false positives in exchange for speed and control. The commercial platform targets teams that want cross-file analysis, AI triage, workflow routing, and admin controls. The pricing structure mirrors that segmentation by making the first ten contributors free and then charging on a contributor basis for paid tiers. That creates a classic product-led funnel with a strong enterprise upgrade path. Independent pricing and buyer-journey sources suggest the Team tier is negotiated enough that public list price is only a starting point. In practice, Semgrep sells an upgrade from "good enough" free scanning to organization-level security operations. The company therefore participates in both the low-end "good developer tool" market and the higher-end "operational AppSec platform" market. The market implication is that Semgrep should be judged less like a narrow scanner vendor and more like an operating layer for code-security workflows. That expands the pool of possible buyers but also places the company in more direct competition with broader platforms. [CM005, CM006, CM007, CM008]
| Segment | Buyer need | Semgrep fit |
|---|---|---|
| Individual developer / small team | Fast local scans and custom rules | Community Edition |
| Growth-stage engineering org | Team workflows and policy | Teams tier |
| Enterprise AppSec / platform | Cross-file analysis, governance, reporting | Enterprise tier |
| AI-assisted development | Real-time guardrails for agents | Guardian |
Segments are inferred from Semgrep's pricing, docs, and launch messaging.
[CM005, CM006, CM007, CM008]2.3 Adoption Signals and Market Constraints
Public adoption evidence remains strong. Semgrep's own site names a well-known set of customers, while third-party databases list active usage across mid-market and enterprise organizations. The signal is not just brand names; it is that the product appears in CI/CD, IDE, and AI-assisted coding workflows, which is where the volume of scanning decisions now lives. The constraint is that the category is crowded. Buyers can choose between Semgrep, broader enterprise AppSec suites, open-source forks, and adjacent tools that may emphasize vulnerability breadth, code quality, or AI-assisted remediation. That means Semgrep must keep proving two things at once: that it is fast enough to be developer-friendly and deep enough to be worth paying for. The current market narrative supports that position, but it does not make it uncontested. [CM009, CM010, CM011, CM012]
| Signal | Why it matters | Source |
|---|---|---|
| Named logos | Shows brand traction | Semgrep about page |
| Customer lists | Shows breadth beyond a few logos | Apps Run The World customer database |
| Usage in CI/CD and IDEs | Shows workflow fit | Semgrep docs and product pages |
| Pricing model | Shows product-led adoption path | Pricing page |
Public signals are directional and not a substitute for a customer census.
[CM009, CM010, CM011, CM012]03Competitors
3.1 Direct Competitive Set
Semgrep's direct competitive set is broader than a single SAST category. The most obvious comparison points are Snyk Code, Checkmarx, Veracode, SonarQube, DeepSource, and GitHub CodeQL / GHAS. Independent comparison pieces also point to OpenGrep as the most immediate open-source fork risk, especially for teams that want Semgrep-like scanning without the commercial restrictions on Community Edition. The important competitive distinction is not just feature breadth. Semgrep wins when the buyer values fast scans, custom rules that read like code, and a developer workflow that can start free and later expand into platform governance. Competitors win when they offer broader platform bundles, stronger enterprise procurement fit, or tighter GitHub-native distribution. The category therefore has many substitutes, but not many true like-for-like matches on Semgrep's specific product motion. [CP001, CP002, CP003, CP004]
| Competitor | Why buyers compare it | Semgrep's relative edge |
|---|---|---|
| Snyk Code | Developer security suite with broad platform bundling | Semgrep is faster to adopt and easier to customize |
| Checkmarx / Veracode | Enterprise AppSec breadth and governance | Semgrep is more developer-native and open-core |
| SonarQube | Code quality + security in one platform | Semgrep is stronger on security-focused guardrails |
| GitHub GHAS / CodeQL | GitHub-native scanning for GitHub users | Semgrep is lighter-weight and easier to write custom rules for |
| OpenGrep | Fork preserving the open-source workflow | Semgrep still has the broader commercial platform |
The set is directional and based on public comparison sources, not a formal market-share study.
[CP001, CP002, CP003, CP004, CP009, CP010, CP011, CP012]3.2 Where Semgrep Differentiates
Semgrep's best differentiation is a combination of syntax-like rule authoring, fast scans, and a commercial path that preserves the open-source wedge. The paid platform adds cross-file analysis, AI triage, and workflow controls that are materially stronger than the free Community Edition. That combination is more compelling than pure scanner breadth because it lets the company claim both openness and enterprise readiness. The Guardian launch broadens the story further by moving into AI-agent security, which is still early enough that not every competitor can match the narrative or the workflow placement. But the same move also invites closer comparison with other AI-native security products and broader AppSec suites. Semgrep therefore differentiates best when the buyer cares about developer experience and incremental adoption rather than a single all-in platform purchase. [CP005, CP006, CP007, CP008]
| Layer | Semgrep feature | Why it matters |
|---|---|---|
| Rule authoring | Rules read like code | Lower friction for developers and security engineers |
| Execution speed | Fast CLI and CI scans | Better fit for pre-merge workflows |
| Paid depth | Cross-file analysis and AI triage | Improves signal beyond Community Edition |
| AI workflow | Guardian / MCP / Hooks | Fits AI-assisted coding |
This table summarizes differentiation rather than ranking product quality.
[CP005, CP006, CP007, CP008]3.3 Competitive Risks
The biggest risk is that a buyer already on GitHub can choose GitHub-native security tooling and avoid introducing a new vendor. A second risk is that OpenGrep recreates enough of the free Semgrep experience to blunt the Community Edition funnel. A third risk is that broader suites can bundle enough adjacent functionality to make Semgrep look like a point solution rather than a platform. Semgrep's defense is execution, not uniqueness. It needs to keep scans fast, findings actionable, and the developer experience smoother than the alternatives. If it slips on noise, usability, or pricing discipline, the market has enough substitute products to make switching easy. [CP009, CP010, CP011, CP012]
| Risk | What could happen | Why it matters |
|---|---|---|
| GitHub-native substitution | Teams stay inside GHAS/CodeQL | Reduces Semgrep's wedge in GitHub-heavy orgs |
| OpenGrep funnel erosion | Free users migrate to the fork | Weakens community-to-paid conversion |
| Platform bundling | Broad suites win procurement | Makes Semgrep look narrower |
| Pricing pressure | Buyers negotiate harder or down-tier | Compresses ARPU |
These are competitive scenarios, not observed outcomes.
[CP009, CP010, CP011, CP012]The competitive signals that most affect Semgrep's moat in 2026.
This snapshot summarizes directional comparison evidence and competitive risk.
[CP001, CP005, CP006, CP007, CP009, CP010, CP011, CP012]04Financials
4.1 Funding and Capital History
Semgrep's funding history is now straightforward. The company announced a $100M Series D in February 2025 led by Menlo Ventures and said total funding reached $204M. Earlier, TechCrunch reported the $53M Series C in 2023, when the business was still much smaller and revenue-producing products had grown quickly but were not publicly detailed. Crunchbase News and Yahoo Finance both covered the Series D as a major private-market security financing. The investor set is still a familiar enterprise-software syndicate: Menlo, Lightspeed, Redpoint, Sequoia, Felicis, and Harpoon. That matters because it suggests the company is still backed by investors who can support long private runways if the business keeps compounding. The key diligence question is not whether the company can raise capital; it is whether the company can justify the next step-up in valuation with current operating efficiency. [CI001, CI002, CI003, CI004]
| Date | Round | Amount | Lead | What it changed |
|---|---|---|---|---|
| 2023-04 | Series C | $53M | Lightspeed | Expanded the platform and AI hiring |
| 2025-02 | Series D | $100M | Menlo Ventures | Accelerated AI and GTM expansion |
| 2025-02 | Total raised | $204M | N/A | Capital base for the next phase |
Round amounts are from official or widely cited coverage; the company has not published a detailed cap table.
[CI001, CI002, CI003, CI004]The public financial signals available for Semgrep in the 2026 refresh.
The valuation label is a secondary-market snapshot and the ARR item is an explicit disclosure gap.
[CI001, CI002, CI003, CI005, CI007, CI009, CI012]4.2 Revenue, Margin, and Burn Opacity
Semgrep remains private and does not publish ARR, revenue run-rate, gross margin, NRR, or cash burn. That is normal for a venture-backed private software company, but it is still a meaningful handicap for diligence because the company is now large enough that those metrics should exist internally and should drive the next financing conversation. Without them, the best public underwriting input is still product evidence plus fundraising history. Tracxn's latest employee count estimate, 266 as of late August 2026, suggests the company has moved beyond startup scale. That makes the absence of hard operating metrics more important, not less. At this stage, investors care less about the fact that the company is growing and more about the quality of that growth. [CI005, CI006, CI007, CI008]
| Metric | Public status | Why it matters |
|---|---|---|
| ARR | Not disclosed | Needed for growth and valuation |
| Revenue run-rate | Not disclosed | Needed for current scale |
| NRR | Not disclosed | Needed for retention quality |
| Burn | Not disclosed | Needed for runway and financing risk |
| Gross margin | Not disclosed | Needed for software economics |
The lack of public operating data is the central financial diligence gap.
[CI005, CI006, CI007, CI008]4.3 Valuation and Capital Markets View
Semgrep does not disclose an official valuation, but Forge's secondary-market page shows a much higher implied figure than the headline funding round alone would suggest. That is useful as a directional indicator, not as a mark to market. In a private setting, the real question is whether the operating story supports a premium multiple relative to the amount of capital raised. The current answer is "probably yes on product quality, not yet fully proven on financial quality." The company has a strong platform, a credible enterprise buyer story, and visible adoption, but the valuation call still depends on management-confirmed growth efficiency and retention. Until those data are available, valuation should remain a range-based judgment rather than a hard point estimate. [CI009, CI010, CI011, CI012]
| Indicator | Status | Interpretation |
|---|---|---|
| Official valuation | Not publicly disclosed | No audited mark available |
| Forge secondary snapshot | $799.24M valuation label | Directional, not audited |
| Stage | Series D private | Still a growth-company valuation problem |
| Capital raised | $204M | Supports a premium private mark, but not proof |
Forge is a secondary-market datapoint and should not be treated as a formal company mark.
[CI009, CI010, CI011, CI012]05Product & Technology
5.1 Platform Stack and Product Modules
Semgrep's platform now reads like a layered security system rather than a single scanner. The free Community Edition gives the company distribution and developer familiarity, while the commercial platform adds Semgrep Code, Supply Chain, Secrets, and AI layers. The official site and docs are explicit that the commercial offer is designed to unify scanning, triage, and remediation across the SDLC rather than merely emit findings. That architecture matters because each layer solves a different problem. Code handles SAST, Supply Chain handles dependency reachability, Secrets checks credential exposure, and the AI layer reduces noise and helps with remediation. Guardian extends that logic into AI-assisted coding workflows so the guardrail exists at the moment code is produced. [CE001, CE002, CE003, CE004]
| Module | What it does | Why it matters |
|---|---|---|
| Community Edition | Free open-source scanning | Acquisition wedge and developer familiarity |
| Semgrep Code | Commercial SAST with cross-file analysis | Higher-signal findings |
| Supply Chain | Reachability-aware SCA | Focuses attention on exploitable dependencies |
| Secrets | Credential detection and validation | Reduces secret leakage |
| Assistant / AI | Triage and remediation assistance | Cuts manual review time |
| Guardian | Real-time guardrails for AI-written code | Extends the product into agentic workflows |
This table summarizes the platform stack; the free and paid offerings overlap by design.
[CE001, CE002, CE003, CE004, CE005, CE006, CE007, CE008]The product capabilities that define Semgrep's current platform story.
This snapshot describes the layered product stack and its current technical limits.
[CE001, CE002, CE003, CE005, CE008, CE009, CE010, CE011, CE012]5.2 Engine Depth and Workflow Fit
Semgrep's technology story is strongest where it can claim speed and context at the same time. The company says its platform supports 35+ languages on the commercial side, includes 20,000+ Pro rules, and adds cross-file analysis beyond the Community Edition. The docs also show practical workflow depth: policy modes, PR/MR comments, Slack and Jira notifications, CI/CD integrations, and IDE support. The AI layer is equally important. The Guardian launch frames Semgrep as an always-on security layer for agents and IDEs, while the Assistant messaging focuses on triage and remediation guidance rather than generic chat. That is a meaningful technical distinction because the product is trying to reduce the manual work around findings, not just surface more of them. [CE005, CE006, CE007, CE008]
| Surface | Capability | Commercial impact |
|---|---|---|
| CI/CD | PR/MR checks and blocking | Fits existing development pipelines |
| IDE | In-line developer scanning | Moves security earlier |
| Slack/Jira | Notifications and routing | Improves triage workflow |
| MCP / agents | Hooks into AI coding tools | Keeps up with agentic development |
The workflow surface is where the platform becomes operational rather than merely analytical.
[CE006, CE007, CE008]5.3 Moat and Limits
Semgrep's moat is real but specific. The open-source engine, custom rule model, and workflow integration create a strong developer-first experience, and the AI/MCP features push the company into the agentic coding wave early. But the moat is not absolute: the Community Edition is intentionally narrower than the paid platform, and the open-source fork ecosystem means the company has to keep proving that the commercial layer is worth the upgrade. In other words, the technology moat is strongest when paired with distribution and workflow adoption. Semgrep's best technical advantage is not a single algorithmic breakthrough; it is the combination of semantic matching, fast scans, governance controls, and an increasingly agent-aware product surface. [CE009, CE010, CE011, CE012]
| Dimension | Strength | Limitation |
|---|---|---|
| Engine | Fast semantic matching | Community Edition stays limited |
| Rules | Large commercial and community rule base | Rules can be forked or copied |
| Workflow | Developer-friendly integrations | Competitors can match many integrations |
| AI | Guardian and Assistant create new value | AI features are still evolving |
This table is judgmental rather than purely factual.
[CE009, CE010, CE011, CE012]06Customers
6.1 Named Logos and Referenceability
The most visible customer signal remains the same: Semgrep publicly names companies such as Dropbox, Figma, Slack, Snowflake, GitLab, Shopify, HashiCorp, and Notion. Those logos matter because they are all software-heavy organizations with serious engineering throughput and meaningful security surface area. The product therefore appears to have landed not just with hobby users, but with teams that operate code at scale. Semgrep's own pages and customer-facing content also emphasize that the product improves remediation speed and reduces false positives. Those are the outcomes customers care about once a scanner becomes part of the daily workflow. The customer signal is therefore not just "many users"; it is that the platform has moved from experimentation into recurring operational use. [CU001, CU002, CU003, CU004]
| Signal | What it indicates | Source |
|---|---|---|
| Named logos | Engineering-heavy enterprise use | Semgrep about page |
| Customer database | Broader adoption list | Apps Run The World |
| Case-study quotes | Operational value in triage and remediation | Semgrep blog |
| Guardian messaging | AI-era workflow relevance | Semgrep Guardian launch |
Public customer signals are indicative rather than a complete customer census.
[CU001, CU002, CU003, CU004, CU009, CU010, CU011, CU012]The most visible customer signals in the refreshed Semgrep report.
The snapshot emphasizes public referenceability rather than a full customer census.
[CU001, CU002, CU003, CU005, CU007, CU009, CU010, CU011, CU012]6.2 Adoption Pattern and Segment Mix
Third-party customer databases and company references suggest a mixed customer base: mid-market teams, larger software companies, and security practitioners who adopt the product through CI, PR comments, or local scanning. That pattern is consistent with a bottom-up product-led tool that later becomes a team-wide policy layer. The strongest implication is that Semgrep is not locked into one vertical. Its logos and use cases span software, fintech, cloud, and developer-tool companies, which gives the business a broad addressable base. At the same time, that breadth means the company needs to keep proving value across many codebases rather than relying on a single horizontal niche. [CU005, CU006, CU007, CU008]
| Pattern | Observed evidence | Implication |
|---|---|---|
| PLG to enterprise | Free edition plus paid upgrade path | Likely bottom-up adoption |
| Software-heavy buyers | Dropbox/Figma/Slack/Snowflake logos | Tool resonates with dev teams |
| Cross-team use | CI, PR, and policy workflows | Not just an individual developer tool |
| AI-era extension | Guardian and MCP narrative | Potentially broader usage ahead |
The pattern is inferred from public references, not a disclosed customer database.
[CU005, CU006, CU007, CU008]6.3 What Customers Get
Semgrep's public customer content consistently returns to three outcomes: faster triage, fewer false positives, and earlier remediation. That fits the company's overall narrative that the right security product should reduce friction rather than add it. The 2026 Guardian launch extends that same logic into AI-written code, where customers can catch issues at the moment they are introduced. The main diligence point is that the company has enough referenceability to support a real enterprise sales motion, but not enough public reporting to quantify customer retention, expansion, or churn. The customer story is positive, yet still qualitative. [CU009, CU010, CU011, CU012]
| Outcome | Evidence | Why it matters |
|---|---|---|
| Faster triage | Assistant / customer quotes | Reduces review burden |
| Fewer false positives | Platform claims and testimonials | Improves trust |
| Earlier remediation | PR and IDE workflows | Moves fixes upstream |
| Agentic guardrails | Guardian launch | Matches AI coding reality |
Outcome claims are partly qualitative and should be validated in diligence.
[CU009, CU010, CU011, CU012]07Risks
7.1 License and Reputation Risk
The biggest durable risk is still the 2024 license change and the backlash that followed. The OpenGrep launch made that backlash concrete: competitors and ecosystem participants publicly framed the fork as a defense of open-source access and as a reaction to Semgrep's commercial restrictions. That creates reputational drag even when the commercial platform is technically stronger than the free fork. The risk is not only moral or narrative. The more Semgrep's community edition looks restricted, the more likely it is that some users will treat the free path as transient and move earlier to a competing tool or a fork. That turns a brand event into a funnel event. [CR001, CR002, CR003, CR004]
| Risk | How it shows up | Why it matters |
|---|---|---|
| Open-source backlash | Community criticism and fork launch | Damages goodwill |
| Fork migration | OpenGrep as a free alternative | Reduces funnel control |
| Brand trust | Questions about openness | Can slow adoption |
| Contributor fatigue | Users stop contributing rules | Weakens ecosystem |
This table emphasizes reputational and ecosystem effects rather than legal conclusions.
[CR001, CR002, CR003, CR004]7.2 Competitive and Pricing Risk
Semgrep also sits in a market where buyers can switch to GitHub-native tooling, broad AppSec suites, or lower-friction alternatives if the product becomes expensive or hard to justify. Public pricing makes the product accessible, but the contributor model also gives buyers a clear line of sight into cost, which makes procurement comparison easy. In practice, this means Semgrep has to keep its signal-to-noise advantage intact. If the product becomes just another scanner, the market will happily compare it against tools that bundle more capabilities or live inside an existing vendor relationship. Competitive risk is therefore less about whether alternatives exist and more about how quickly those alternatives can match enough of the workflow to be acceptable. [CR005, CR006, CR007, CR008]
| Risk | Pressure source | Likely effect |
|---|---|---|
| GitHub-native substitution | GHAS / CodeQL | Lower willingness to add a vendor |
| Platform bundling | Broader AppSec suites | Harder procurement case |
| Price visibility | Contributor-based pricing | Easier vendor comparison |
| Alternative scanners | Developer-first competitors | More switching options |
Competitive pressure is structural and ongoing.
[CR005, CR006, CR007, CR008]The main risk signals that shape the Semgrep diligence view.
This snapshot ranks the main competitive and disclosure risks rather than quantifying them.
[CR001, CR002, CR003, CR004, CR005, CR006, CR009, CR010, CR011, CR012]7.3 Financial and Execution Risk
The final risk category is financial opacity. Semgrep has strong funding support, but it still does not disclose the operating metrics that would tell us whether growth is efficient or expensive. That matters because private security software can raise capital for a long time, but valuation eventually depends on proof, not narrative. The company is also now large enough that execution risk is broader than product release quality. It must keep shipping AI features, preserve developer trust, support enterprise sales, and keep the open-source community from feeling abandoned. That is a difficult balancing act, and it becomes harder if customer growth slows or if competing products get "good enough." [CR009, CR010, CR011, CR012]
| Risk | What could go wrong | Why it matters |
|---|---|---|
| Opaque metrics | Cannot prove efficient growth | Limits valuation confidence |
| AI roadmap drift | Guardian may not deliver expected lift | Could weaken differentiation |
| Community balance | Open-source users feel alienated | Hurts funnel quality |
| Enterprise scaling | Sales motion outruns product clarity | Could raise churn risk |
These are forward-looking risk hypotheses, not confirmed issues.
[CR009, CR010, CR011, CR012]08Valuation
8.1 What the Public Market Mark Says
Forge's secondary-market page is the cleanest public valuation breadcrumb in the refreshed bundle and shows a $799.24M valuation label for Semgrep. That is useful as an external signal, but it is not an audited company mark and should not be treated as a formal post-money valuation. The key point is simply that third-party market data places the company above a mere seed or Series A profile. The other public inputs all point in the same general direction: Semgrep has raised a meaningful amount of capital, has visible enterprise traction, and is still private. Those facts support a valuation view that is at least solidly in growth-company territory. The question is whether the premium should be above, at, or below the Forge indication. [CV001, CV002, CV003, CV004]
| Input | Observed signal | Interpretation |
|---|---|---|
| Forge secondary page | $799.24M valuation label | Directional market signal |
| Capital raised | $204M | Supports a meaningful private-company mark |
| Funding stage | Series D | Growth-company profile |
| Revenue disclosure | None public | Prevents a precise multiple |
Forge is a secondary-market datapoint and not a formal company valuation.
[CV001, CV002, CV003, CV004]The public signals that frame Semgrep's valuation range in 2026.
This snapshot is a range-setting view, not a board-approved mark.
[CV001, CV002, CV003, CV004, CV005, CV006, CV007, CV008]8.2 Valuation Range and Stance
Because Semgrep does not disclose revenue or ARR, any valuation range has to be grounded in comparable private-company logic rather than a hard revenue multiple. The practical judgment is that the company is probably above the range of a lightly funded developer tool, but still not well enough disclosed to justify a precise mark. That argues for a fair-to-uncertain stance rather than a strong buy thesis on valuation alone. The valuation debate therefore depends less on the exact number and more on the quality of the operating evidence. If management can show strong retention, efficient growth, and durable AI-driven product expansion, the market mark can hold or rise. If not, the lack of public metrics will keep the valuation case fragile. [CV005, CV006, CV007, CV008]
| Question | Answer | Implication |
|---|---|---|
| Is Semgrep a tiny startup? | No | Too much funding and scale for that |
| Is the valuation precise? | No | Public data are insufficient |
| Is the stance still attractive? | Potentially fair | Depends on private metrics |
| Is disclosure the blocker? | Yes | ARR/NRR/burn remain missing |
The stance is a judgment call based on public evidence, not a board mark.
[CV005, CV006, CV007, CV008]8.3 What Would Change the Mark
The fastest way to improve confidence is to disclose current ARR, growth rate, and NRR. Those metrics would let us compare Semgrep against other private security and developer-platform names on something closer to a standardized basis. The second-best improvement would be a current board-approved post-money or secondary reference that is easier to trust than a marketplace snapshot. Until then, the valuation call remains a synthesis of product quality, adoption evidence, capital raised, and external market snippets. That is enough for a working diligence view, but not enough for a crisp investment-grade mark. [CV009, CV010, CV011, CV012]
| Needed data | Why it matters |
|---|---|
| Current ARR | Anchors the revenue multiple |
| NRR / retention | Shows expansion quality |
| Burn and runway | Shows financing dependence |
| Board-approved mark | Provides a trustworthy reference |
These are the fastest ways to turn a range-based view into a tighter mark.
[CV009, CV010, CV011, CV012]Disclaimer
This report is an analytical research product generated as of September 24, 2026. It is based on public materials, third-party databases, and company-published content that may change over time. It is not investment advice or a solicitation to buy or sell securities.
Evidence index
| ID | Statement | Confidence | Sources |
|---|---|---|---|
| CO001 | Semgrep was founded in 2017 by Isaac Evans, Drew Dennison, and Luke O'Malley and is headquartered in San Francisco. | High | SO002, SO007 |
| CO002 | Semgrep sells a developer-native application security platform that spans SAST, SCA, secrets scanning, and AI-assisted triage. | High | SO001, SO004 |
| CO003 | The company still uses an open-source wedge and says the platform supports more than 40 coding languages, 3,000+ community rules, and roughly 75M scans per year. | High | SO001, SO002 |
| CO004 | Semgrep's public pricing shows a free tier and a Teams tier starting at $30 per contributor per month, with third-party pricing coverage echoing the same contributor model. | High | SO003, SO009 |
| CO005 | Semgrep announced a $100M Series D in February 2025 led by Menlo Ventures and said total funding reached $204M. | High | SO005, SO008 |
| CO006 | TechCrunch previously reported Semgrep's $53M Series C and described the company as having about 90 employees and $93M raised at that point. | Medium | SO006 |
| CO007 | Tracxn lists Semgrep at 266 employees as of late August 2026, which is a useful but lagging external headcount estimate. | Medium | SO007 |
| CO008 | Semgrep publicly names customers and users such as Figma, Dropbox, Slack, Snowflake, and Notion. | High | SO001, SO002 |
| CO009 | Semgrep does not publicly disclose ARR, revenue run-rate, NRR, or cash burn. | Medium | SO001, SO007 |
| CO010 | Guardian is Semgrep's 2026 launch for real-time security on AI-written code and is positioned as an always-on layer for agents and IDEs. | High | SO004, SO001 |
| CO011 | Semgrep describes its mission as improving software security and reliability without slowing developers down. | High | SO002, SO005 |
| CO012 | The refreshed evidence still places Semgrep in private-undisclosed territory rather than a fully transparent public-company disclosure regime. | Medium | SO001, SO007 |
| CO013 | The open-source license change created a reputational overhang and helped trigger the OpenGrep fork. | Medium | SO010 |
| CM001 | Semgrep is positioned for teams that want code security guardrails inside the developer workflow rather than heavyweight security review outside it. | High | SM001, SM003 |
| CM002 | AI-written code increases the amount of code that needs to be checked and raises the value of real-time guardrails. | Medium | SM002, SM001 |
| CM003 | Semgrep's product-led motion uses the free Community Edition as the acquisition wedge and paid tiers as the upgrade path. | High | SM006, SM001 |
| CM004 | The company's pricing and packaging make contributor count a central buyer consideration. | Medium | SM006, SM008 |
| CM005 | Independent adoption sources show Semgrep is used by a mix of mid-market and enterprise software teams rather than only hobbyists. | Medium | SM005, SM003 |
| CM006 | The market still rewards tools that are fast, easy to deploy, and easy to extend with custom rules. | Medium | SM001, SM007 |
| CM007 | Semgrep's upgrade path is strongest where teams need team-wide policy, AI triage, and broader governance after bottom-up adoption. | Medium | SM006, SM002 |
| CM008 | The category is crowded enough that buyers can compare Semgrep against alternative scanners, open-source forks, and broader AppSec suites. | Medium | SM004, SM007 |
| CM009 | Semgrep's public logos imply the product has already crossed from niche developer tool into broader security-team adoption. | Medium | SM001, SM005 |
| CM010 | The market problem remains high-noise, low-context static analysis rather than a lack of findings. | Medium | SM001, SM004 |
| CM011 | Open-source forks and adjacent tools raise switching pressure and keep pricing discipline relevant. | Medium | SM004, SM008 |
| CM012 | The market opportunity is still expanding because AI coding increases both output volume and security exposure. | Medium | SM002, SM001 |
| CP001 | The main buyer comparisons around Semgrep are Snyk, Checkmarx, Veracode, SonarQube, DeepSource, GitHub CodeQL/GHAS, and OpenGrep. | Medium | SP003, SP004, SP005, SP006 |
| CP002 | Semgrep's comparison advantage is usually framed as faster developer workflow and easier custom rule authoring. | Medium | SP001, SP008 |
| CP003 | OpenGrep is the clearest open-source fork threat because it targets the same Community Edition workflow. | Medium | SP004, SP007 |
| CP004 | GitHub-native security remains a real substitute for organizations that are already standardized on GitHub. | Medium | SP002, SP006 |
| CP005 | Semgrep differentiates most strongly on the combination of speed, custom rules, and a low-friction open-core funnel. | Medium | SP001, SP008 |
| CP006 | The commercial platform's cross-file analysis and AI triage are the main reasons buyers upgrade from the free edition. | High | SP001, SP002 |
| CP007 | Broad AppSec suites compete on bundling and procurement convenience rather than just scanner depth. | Medium | SP003, SP005 |
| CP008 | Semgrep's platform story is stronger than its Community Edition story because the paid tier adds governance and broader analysis. | Medium | SP001, SP006 |
| CP009 | Semgrep remains exposed to pricing pressure because buyers can compare many adjacent tools with overlapping claims. | Medium | SP003, SP005, SP008 |
| CP010 | The open-source fork dynamic can compress the Community Edition funnel even if the paid platform remains differentiated. | Medium | SP004, SP007 |
| CP011 | Public comparisons still describe Semgrep as developer-friendly and fast enough for CI and PR workflows. | Medium | SP003, SP005, SP008 |
| CP012 | The market remains crowded enough that Semgrep needs to keep proving signal quality and ease of use. | Medium | SP001, SP003, SP005 |
| CI001 | Semgrep announced a $100M Series D in February 2025 led by Menlo Ventures. | High | SI001, SI004 |
| CI002 | The Series D brought Semgrep's total funding to $204M. | High | SI001, SI003, SI004 |
| CI003 | Semgrep's Series C was a $53M round reported by TechCrunch in 2023. | Medium | SI002 |
| CI004 | The financing story is still backed by the same core enterprise software investors across multiple rounds. | Medium | SI001, SI002, SI003, SI004 |
| CI005 | Semgrep does not publicly disclose ARR, revenue-run-rate, gross margin, or NRR. | Medium | SI006, SI009 |
| CI006 | Semgrep also does not publicly disclose cash burn or runway. | Medium | SI006, SI009 |
| CI007 | Tracxn lists Semgrep at 266 employees as of late August 2026. | Medium | SI005 |
| CI008 | That headcount estimate implies the company has moved beyond early-startup scale even without public revenue disclosure. | Medium | SI005, SI007 |
| CI009 | Forge's secondary-market page shows a $799.24M valuation label for Semgrep. | Medium | SI007 |
| CI010 | The valuation datapoint should be treated as directional rather than audited market value. | Medium | SI007, SI008 |
| CI011 | The company has not publicly confirmed debt, secondary sale detail, or an official post-money mark. | Medium | SI006, SI009 |
| CI012 | The fundraising proceeds were framed as fuel for AI capabilities, program-analysis talent, and GTM expansion. | High | SI001, SI010, SI012 |
| CE001 | Semgrep's current platform is a layered stack of Community Edition, Code, Supply Chain, Secrets, Assistant, and Guardian. | High | SE001, SE004, SE010 |
| CE002 | The platform is designed to unify scanning, triage, and remediation rather than just emit findings. | High | SE001, SE002 |
| CE003 | Semgrep says the commercial stack supports 35+ languages and 20,000+ Pro rules. | High | SE003, SE005 |
| CE004 | Guardian extends the product into real-time security for AI-written code and agentic workflows. | High | SE004, SE009 |
| CE005 | Semgrep's workflow surface includes CI/CD, PR/MR comments, IDE support, Slack/Jira routing, and MCP integrations. | Medium | SE002, SE004, SE012 |
| CE006 | The paid platform adds cross-file analysis, AI triage, and remediation guidance beyond Community Edition. | High | SE001, SE010 |
| CE007 | Semgrep Assistant's public narrative centers on triage and remediation rather than a generic chatbot. | High | SE010, SE007 |
| CE008 | The company claims high user agreement with AI triage and faster remediation feedback loops. | Medium | SE010, SE007 |
| CE009 | The platform's moat is strongest where fast scans, semantic rules, and workflow fit meet. | Medium | SE001, SE002, SE012 |
| CE010 | The open-source wedge is still central because the free edition drives familiarity and adoption. | Medium | SE006, SE011 |
| CE011 | The technical limit of Community Edition is still narrower analysis than the paid platform. | Medium | SE001, SE006, SE008 |
| CE012 | Semgrep's technology moat is real but not absolute because rules and workflow integrations can be replicated by serious competitors. | Medium | SE001, SE006, SE008 |
| CU001 | Semgrep publicly names Dropbox, Figma, Slack, Snowflake, GitLab, Shopify, HashiCorp, and Notion as users or customers. | High | SU001, SU002 |
| CU002 | Those logos point to a customer base of engineering-heavy organizations rather than casual consumers. | Medium | SU001, SU002 |
| CU003 | Apps Run The World maintains a customer database page specifically for Semgrep AppSec Platform. | Medium | SU003 |
| CU004 | Third-party customer references support the view that Semgrep has moved into a real enterprise sales motion. | Medium | SU003, SU004, SU005 |
| CU005 | Semgrep's customer story spans software, cloud, fintech, and infrastructure-heavy organizations. | Medium | SU001, SU003, SU005 |
| CU006 | The company emphasizes faster remediation and fewer false positives as customer outcomes. | High | SU006, SU009, SU010 |
| CU007 | Guardian extends the customer story into AI-written code and agentic development workflows. | High | SU007, SU011 |
| CU008 | The public evidence still does not quantify customer retention, expansion, or churn. | Medium | SU001, SU004 |
| CU009 | Semgrep's public references suggest the product is used in day-to-day triage rather than only in annual audits. | Medium | SU006, SU009, SU010 |
| CU010 | The customer narrative is strong enough to support an enterprise sales motion but still lacks disclosed cohort data. | Medium | SU004, SU005, SU008 |
| CU011 | The 2026 refresh continues to show customer references as a major part of Semgrep's credibility story. | Medium | SU001, SU007, SU012 |
| CU012 | Semgrep's customer proof is qualitative and logo-led rather than quantified with public retention data. | Medium | SU003, SU004, SU008 |
| CR001 | The 2024 licensing change created a persistent reputational overhang for Semgrep. | Medium | SR001, SR002 |
| CR002 | OpenGrep makes the open-source backlash operational by giving users a fork path. | Medium | SR001, SR003 |
| CR003 | That fork risk can weaken the free-to-paid funnel if community users decide to migrate earlier. | Medium | SR001, SR003 |
| CR004 | The reputation issue matters because Semgrep depends on community trust as part of its distribution model. | Medium | SR009, SR011 |
| CR005 | GitHub-native security remains a practical substitute for teams that already standardized on GitHub. | Medium | SR005, SR007 |
| CR006 | Contributor-based pricing makes Semgrep easier to evaluate but also easier to compare on cost. | Medium | SR004, SR006 |
| CR007 | Broader AppSec suites can bundle enough adjacent functionality to make Semgrep look narrow. | Medium | SR007, SR012 |
| CR008 | Semgrep's differentiation still depends on keeping scans fast, findings actionable, and the developer workflow pleasant. | Medium | SR009, SR011 |
| CR009 | The company still does not publicly disclose ARR, NRR, burn, or runway. | Medium | SR008, SR009 |
| CR010 | The AI roadmap is a differentiator, but it also raises expectations that can cut both ways if product quality slips. | Medium | SR010, SR011 |
| CR011 | Execution risk now includes community trust, enterprise scaling, and AI feature delivery at the same time. | Medium | SR009, SR010, SR011 |
| CR012 | If customers treat Semgrep as 'good enough' rather than best-in-class, switching pressure will intensify. | Medium | SR006, SR007, SR012 |
| CV001 | Forge's page gives Semgrep a $799.24M valuation label. | Medium | SV001 |
| CV002 | That Forge number should be treated as a directional secondary-market signal rather than an audited mark. | Medium | SV001 |
| CV003 | Semgrep has enough funding and public adoption to support a premium private-company valuation framework. | Medium | SV002, SV003, SV004 |
| CV004 | Semgrep still lacks public revenue, ARR, or NRR disclosure, which keeps the mark imprecise. | Medium | SV007, SV008 |
| CV005 | The current stage is still Series D private, which supports a growth-company valuation rather than a mature software mark. | Medium | SV002, SV005 |
| CV006 | The lack of public financial metrics is the main reason the valuation stance remains range-based. | Medium | SV004, SV007, SV008 |
| CV007 | A current ARR, growth rate, or NRR disclosure would tighten the valuation range materially. | Medium | SV007, SV008, SV011 |
| CV008 | Management has not published a board-approved post-money mark that can be treated as definitive. | Medium | SV005, SV009 |
| CV009 | The product and adoption story are strong enough to justify a fair rather than distressed stance. | Medium | SV003, SV007, SV010 |
| CV010 | The company can still argue for a premium mark if AI features and enterprise adoption keep compounding. | Medium | SV010, SV012 |
| CV011 | The valuation case remains sensitive to future disclosure because the same product quality can support very different multiples. | Medium | SV007, SV008, SV009 |
| CV012 | A reasonable current stance is fair-to-unknown rather than aggressively expensive or cheap. | Medium | SV001, SV003, SV006 |