The report states a premise that shapes how we build Semgrep: “AI-accelerated software development requires new security controls…This evaluation examines vendors that help organizations govern agentic development, validate agent-generated software and AI applications, and reduce risk without slowing development velocity.” We believe Semgrep is an ideal fit for teams adapting to that reality. Here's how.
Validating agent-generated code and AI applications
AI-assisted development has increased code output by orders of magnitude, with some of our customers reporting that vulnerability counts have increased as much as 20x. Triage is where that volume piles up.
Forrester’s evaluation notes that “Semgrep stands out for AI triage using organizational context and memories of prior decisions to reduce repeat review and improve results over time.” In practice, a triage decision made once carries forward, so the same vulnerability class does not come back for review repo by repo. Users agree with Autotriage decisions 96% of the time at steady state, and most customers see about a 60% reduction in backlog on first use.
Forrester’s report also states that Semgrep's “differentiated approach to AI application flaw detection combines rules-based detection with model-based reasoning to provide coverage of flaws such as prompt injection, sensitive information disclosure, excessive agency, and system prompt leakage.”
Semgrep’s dedicated rulesets look for malicious agent patterns, track where and how LLMs are used, and check AI applications against best practices. They cover providers and tools including OpenAI, Anthropic, Bedrock, LangChain, Cursor, and Claude Code. Static analysis also covers a number of categories in the OWASP Top 10 for LLM Applications, such as prompt injection and improper output handling.
Reducing risk without slowing developers
According to Forrester’s report, “Customers praise Semgrep's flexibility and developer-friendly experience…” We believe that matches how Semgrep works day to day. Teams write custom rules for their own code and policies, see findings in the pull request, and review AI-generated fixes instead of writing them from scratch. Autofix saves 30 minutes per finding on average.
Built for agentic development
As coding agents increase the volume of code, security has to keep pace, and much of what we've shipped this year is aimed at that. Semgrep Multimodal, launched in March, pairs AI reasoning with rule-based analysis for detection, triage, and remediation. It finds issues like IDOR and broken access control that neither approach catches reliably on its own, with 3.5x more true positives at 19% lower cost per true positive than a foundation model alone. Semgrep Guardian, which arrived in June, scans and fixes AI-generated code the moment it's written. In July, Semgrep Agentic Workflows added pre-built workflows that automate deep vulnerability hunting at scale. And in September, we introduced malware detection and response automation to help teams react when a malicious package turns up in their dependencies.
Thank you
To us, this recognition reflects feedback from the customers and community who use Semgrep every day, and we're grateful for it. Access the report to see how Forrester evaluated the category, or book a demo to see how Semgrep fits your agentic development workflow.
Forrester does not endorse any company, product, brand, or service included in its research publications and does not advise any person to select the products or services of any company or brand based on the ratings included in such publications. Information is based on the best available resources. Opinions reflect judgment at the time and are subject to change. This report is part of a broader collection of Forrester resources, including interactive models, frameworks, tools, data, and access to analyst guidance. For more information, read about Forrester’s objectivity here .
