Semgrep vs Invicti

From $40 per contributor/month (indicative)

Quote on request

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Enterprise licensing by number of target sites or applications.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Demo and trial on request.

Widely used

Semgrep · since 2020

Established

Invicti Security · since 2009

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Proof-based scanning eliminates most false-positive triage, which is the main cost of DAST.
• Handles authenticated scanning of modern JavaScript applications well.
• Good asset discovery for organisations that do not know all their own sites.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

• Expensive relative to free DAST alternatives.
• Scans take time and are not suited to per-commit feedback.
• Dynamic testing alone cannot find everything a code review would.

Teams that want customisable static analysis and can start entirely for free.

Organisations with many web applications and no capacity to triage scanner noise.