Semgrep

Static analysis tool for finding bugs and enforcing code standards.

semgrep.dev

HQ: San Francisco, CA, USA

Cybersecurity

Company research

Public company, workplace, funding, and market signals

Updated Jul 29, 2026

Overview

Semgrep is a San Francisco-based software security company that builds an application security platform for scanning source code and dependencies, surfacing real vulnerabilities, and helping teams triage and fix issues faster. Its platform combines SAST, SCA, secrets detection, and newer AI-assisted detection/remediation workflows.

Primary product

Semgrep AppSec Platform

Founded

2017

Headquarters

799 Market Street, San Francisco, CA 94103, USA

Team size

201-500

Work style

Hybrid

Industry

Software Development

Sub-industry

Application Security / Static Application Security Testing (SAST)

Offices

San Francisco, California, United States

New York, New York, United States

Business model

open-core

freemium

SaaS subscription

enterprise licensing

Funding

Stage

Series D

Total raised

$204M

Latest round

Series D · Feb 2025

Latest amount

$100M

Series D

Feb 2025 · Menlo Ventures

$100M

Series C

Apr 2023 · Lightspeed Venture Partners

$53M

Series B

Jul 2021 · Felicis Ventures

$27M

Series A

Oct 2020 · Redpoint Ventures and Sequoia Capital

$13M

Pre-Seed Round

Dec 2017

Seed Round

May 2017

$3M

People & investors

Leadership

Founder, CEO

Co-founder, CTO

Founder, CPO

Vice President of Worldwide Sales

Cathy Polinsky

Co-CTO and VP of Engineering

Pablo Estrada

VP of Marketing

Investors

Felicis Ventures

Harpoon Ventures

Lightspeed Venture Partners

Work & culture

Mission-driven and developer-centric, with a strong emphasis on speed, honest debate, humility, inclusiveness, and shipping useful security tooling. Public hiring materials describe a hybrid-first culture that still supports remote work and encourages time off.

Work style

Hybrid

Compensation

Public signals point to competitive, market-aligned total rewards with equity and broad benefits, but no public salary bands were found. Public materials emphasize equity, flexible work, and an unlimited-PTO style policy.

Benefits

health insurance

dental insurance

vision insurance

401(k)

equity

unlimited PTO

at least 3 weeks off encouraged

market-aligned total rewards

flexible remote work

Product & market

Pricing

Freemium/open-core with a free Community Edition and paid Team/Enterprise tiers; larger deployments are quote-based.

Differentiators

—fast, developer-friendly scans
—customizable YAML rules in code-like syntax
—cross-file and cross-function analysis in paid tiers
—reachability analysis for dependency vulnerabilities
—AI-assisted triage and autofix
—open-source community edition and large rule ecosystem
—integrates into CI/CD, IDEs, and ticketing workflows

Technology

OCaml

Python

tree-sitter

OpenAI

AWS Bedrock

GitHub

GitLab

Bitbucket

Azure DevOps

CircleCI

Jira

VS Code

JetBrains

Slack

Datadog

React

Vercel

Customers

Snowflake

Dropbox

Figma

Slack

GitLab

Stripe

Netflix

Chef

Vanta

Thinkific

Acrisure

Replit

Homebase

Okta

Lyft

Competitors

GitHub CodeQL / GitHub Advanced Security

Snyk

Checkmarx

Veracode

SonarQube

OpenGrep

Scale & contact

Estimated revenue

approximately $25M-$50M (2025 ARR estimate around $33.6M)

Estimated monthly visits

249.2K

Traffic estimate as of Jul 2026

support@semgrep.com

Signals & risks

Other

Jan 2025

Semgrep's licensing changes around its rules repository triggered community backlash and the launch of the OpenGrep fork, a notable open-source ecosystem risk signal.

Source

Latest news

Semgrep chosen to be part of OpenAI's Trusted Access for Cyber Program

Semgrep blog · Apr 2026

OpenAI selected Semgrep for its Trusted Access for Cyber program, giving Semgrep access to frontier cyber-focused model credits to improve detection and remediation capabilities.

Attackers Can't Have All the Advantage: Introducing Semgrep Multimodal

Semgrep blog · Mar 2026

Semgrep launched Multimodal, combining AI reasoning with rule-based analysis for detection, triage, and remediation. The post claims up to 8x more true positives and 50% fewer false positives versus base models.

From idea to (secure) app: Semgrep + Replit

Semgrep blog · May 2025

Semgrep partnered with Replit so Replit Agent can run Semgrep CE scans before deployment and auto-fix issues, extending Semgrep into AI-assisted app building workflows.

Semgrep Announces $100M Series D Funding to Advance AI-Powered Code Security

PR Newswire · Feb 2025

Semgrep announced a $100M Series D led by Menlo Ventures, bringing total funding to $204M and adding Garrett Souza as VP of Sales and Mark McLaughlin as an angel investor/advisor.

Open-source security spat leads companies to join forces for new tool

CyberScoop · Jan 2025

Community backlash over Semgrep licensing changes helped spur the OpenGrep fork, a notable ecosystem and open-source governance risk signal for Semgrep.

Jobs and careers at Semgrep

10 jobs at Semgrep

Head of Field Engineering - North America

Remote

Sales Org

San Francisco Office; San Francisco, United States

1w ago

Remote

Full-time