Semgrep vs Veracode

From $40 per contributor/month (indicative)

Quote on request

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Enterprise annual subscriptions priced by application count and scan types.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

No free tier.

Widely used

Semgrep · since 2020

Widely used

Veracode · since 2006

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Binary scanning works on third-party and supplier software where source is unavailable.
• Policy engine and attestation reports satisfy regulated procurement directly.
• Managed service model suits organisations without a security engineering team.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

• Slow feedback compared with developer-first tools — poor fit for per-commit scanning.
• Expensive per application.
• Developer experience lags Snyk and Semgrep considerably.

Teams that want customisable static analysis and can start entirely for free.

Regulated enterprises needing formal security attestation, including for supplier software.