🧠 Humans of Cyber | Isaac Evans, Luke O'Malley, and Drew Dennison
Semgrep evolved from r2c into an AI-driven AppSec platform, blending open-source SAST with enterprise analysis and governance.
The evolution of application security has increasingly centered on developer-aligned tooling. Traditional static analysis platforms frequently delivered high detection depth at the expense of usability, performance, and developer adoption. Semgrep emerged as a structural response to this imbalance, introducing a semantic analysis engine designed for readability, extensibility, and integration into modern CI/CD environments.
By 2026, Semgrep operates as both an open-source semantic scanning engine and a commercial application security platform integrating advanced data flow analysis, supply chain intelligence, and AI-assisted remediation. Its trajectory reflects broader developments in developer-centric security, open-core business models, and automation-driven security operations.
Technical Definition and Platform Architecture
Semgrep is a polyglot static analysis engine that evaluates source code using structural and semantic matching rather than literal string or regular expression comparisons. It parses code into abstract syntax trees and performs pattern matching against structural constructs. This allows the engine to distinguish executable logic from comments or non-executable content, reducing false positives common in legacy scanning approaches.
As of 2026, the ecosystem comprises layered components:
Semgrep Community Edition (Open Source)
Licensed under LGPL-2.1
AST-based semantic pattern matching
Community-maintained rule ecosystem
Designed primarily for intra-file analysis
Integrated through CLI and CI/CD pipelines
The open-source engine remains widely adopted by individual developers and internal security teams.
Semgrep Pro Engine
The proprietary layer introduces:
Cross-file interprocedural analysis
Inter-file taint tracking
Advanced data flow modeling
Enterprise-scale scanning infrastructure
This engine addresses vulnerabilities that span multiple files and complex call chains, including injection classes and deep business logic issues.
Semgrep AppSec Platform
By 2026, the platform extends beyond static analysis to include:
Semgrep Supply Chain for dependency vulnerability analysis
Semgrep Secrets for detection of hardcoded credentials
Semgrep Assistant, an AI-driven triage and remediation system
The platform combines deterministic analysis with contextual reasoning to reduce alert fatigue and accelerate remediation.
Engine Mechanics and Semantic Matching
Semgrep’s core functionality is based on structured parsing and pattern abstraction.
Parsing Model
Uses Tree-sitter to generate Concrete Syntax Trees
Normalizes CSTs into a generic Abstract Syntax Tree representation
Enables cross-language semantic consistency
This abstraction allows pattern reuse across syntactically similar languages.
Rule Syntax and Matching
Rules are defined in YAML and rely on:
Metavariables ($VAR) to capture dynamic code elements
Ellipsis (...) to allow flexible structural matching
AST-level evaluation rather than textual scanning
This architecture permits developers to write rules that reflect coding intent rather than superficial syntax.
Advanced Analysis Features
The commercial engine incorporates:
Taint tracking across multiple files
Call graph construction
Reachability analysis for supply chain prioritization
Multicore scanning using shared-memory parallelization
These features enable scaling across monorepos and large enterprise repositories without prohibitive memory usage.
AI Integration and Automated Triage
Semgrep Assistant introduces AI-based reasoning as a secondary analysis layer.
After deterministic matching identifies a finding, the assistant:
Evaluates surrounding code context
Applies historical triage decisions
Classifies findings as actionable or informational
Suggests remediation aligned with organizational coding standards
The AI layer operates as an augmentation of deterministic analysis rather than a replacement.
Founding Leadership and Organizational Development
Semgrep was founded in 2017 under the name r2c by Isaac Evans and Drew Dennison. The company later rebranded the scanning engine as Semgrep.
Isaac Evans (CEO) provides strategic direction and has guided the transition from open-source scanning tool to enterprise AppSec platform.
Drew Dennison (CTO) led the technical architecture, translating academic static analysis research into a production-ready semantic engine.
Luke O’Malley (Chief Product Officer) formalized product strategy, expanding the offering into a comprehensive platform including SCA, secrets detection, and AI integration.
A significant technical influence came from Yoann Padioleau, original author of sgrep at Facebook, whose work informed the semantic foundations of the engine.
Under this leadership, the company expanded to over 500 employees by 2026 and secured approximately $193 million in venture funding, including a $100 million Series D in early 2025.
Licensing Transition and the Opengrep Fork
In December 2024, Semgrep modified the license governing its official rule repository. While the scanning engine remained under LGPL-2.1, the rule repository moved to a proprietary license restricting redistribution in competing commercial products.
This change prompted the formation of Opengrep in January 2025, a vendor-supported fork intended to maintain a fully open rule ecosystem.
As of 2026:
Semgrep continues to lead in enterprise adoption and AI-assisted capabilities.
Opengrep operates as an open alternative engine aligned with community governance.
Both projects remain active, reflecting structural tensions common in open-core security tooling.
2025–2026 Technical Milestones
Recent platform developments include:
Native Windows Support
Released in late 2025, enabling direct CLI and IDE usage without WSL or containerization.
Managed Scanning
Automated discovery and scanning of repositories across organizations with centralized governance.
Malicious Dependency Detection
Detection of typosquatting, dependency confusion, and credential-stealing packages within supply chains.
Business Logic Vulnerability Analysis
AI-assisted identification of vulnerabilities such as IDOR and broken authentication patterns.
These releases mark a shift from pure static scanning toward posture management and automated remediation.
Strategic Market Position in 2026
Semgrep occupies a hybrid position in the application security market:
Open-source semantic engine
Enterprise-grade AppSec governance platform
AI-assisted triage and remediation system
Integrated supply chain risk analyzer
Recognition in the 2025 Gartner Magic Quadrant for Application Security Testing reflects its maturation within the industry.
The coexistence of Semgrep and Opengrep illustrates a dual ecosystem: commercial AI-enhanced security platforms alongside community-maintained semantic analysis engines.
Subscribe and Comment.
Copyright © 2026 911Cyber. All Rights Reserved.
Follow 911Cyber on: