Semgrep is attractive to teams that want code security to feel close to engineering rather than imposed from outside. It can be fast, flexible and very specific to how the team writes software. The downside is that it needs ownership: rules, triage and reporting do not magically become a full security program.
Narrow code-security scope; value depends on rule quality and engineering ownership
Semgrep publishes Free and Teams from $30/month per contributor for Code or Supply Chain; Free has repository/contributor limits, Secrets is priced differently, and Enterprise is custom.
Semgrep is strongest in its core category. If the goal is audit-ready evidence, supplier risk, backup proof or cross-tool remediation, pair it with a separate evidence workflow rather than expecting this tool to cover the whole compliance program.
Evidence, remediation and reporting layer when this tool needs to support audits.
Endpoint and identity baseline.