Semgrep's rules describe vulnerable code; Keygraph demonstrates vulnerable behavior. By exploiting your running application on top of pattern-matching its source, Keygraph surfaces what attackers can actually reach, not just what looks suspicious.
Semgrep is the best rule-based scanner in the business: fast, deterministic, deeply loved by developers, and free to start.
It matches your code against tens of thousands of rules and flags what looks wrong, and because those rules are written to resemble the code they catch, the results are transparent, customizable, and easy to reason about. For many teams, that's a genuinely strong place to begin. But the same design that makes Semgrep fast is also its ceiling. A rule can only catch what someone already thought to write a rule for, and every finding it returns is a maybe until something proves it actually matters. Keygraph takes a different approach: rather than matching patterns, it reasons about how your code actually behaves, validates each candidate vulnerability by exploiting it against the running application, and re-runs that exploit after remediation to confirm the issue is closed.
Semgrep parses source into ASTs and matches rules written to mirror the code they catch, with cross-file taint analysis in the Pro Engine. That design is exactly why it's fast, deterministic, and easy to extend. It's also the limit: detection is bounded by what the rule set describes, and a match carries no evidence of reachability or impact. Keygraph reasons over program behavior instead, then validates each candidate by exploiting it.
Semgrep
rule-based
Output: a static match, unvalidated.
Deterministic and CI-fast on known vulnerability classes, extensible with custom rules and policy-as-code. Bounded by the signature set: severity is assumed from the rule, not demonstrated against the target.
Keygraph
reasoning + exploitation
Output: an exploit-validated vulnerability.
Surfaces the interprocedural, multi-step, and business-logic flaws no signature describes, then labels each result exploited, potential, or false positive, with a reproducible PoC and static-dynamic correlation into one finding per vulnerability.
Semgrep's strongest argument is that rules are deterministic and AI is probabilistic, and security teams want reproducible, audit-grade results. It's a fair point, and it's why Keygraph doesn't bet everything on reasoning: it runs deterministic engines for dependencies and secrets, and brings reasoning in where rules fall short.
But the deepest form of reproducibility isn't a pattern match; it's a working exploit. It either fires or it doesn't, every time. A reproduced exploit proves impact; a rule match only proves presence. And the industry already agrees rules alone aren't enough: Semgrep itself now ships AI-powered detection for flaws like IDOR and broken authorization. The real question was never rules versus AI. It's who pairs reasoning with proof.
After Find, Semgrep hands the queue to your team to triage, fix, and re-scan. Keygraph carries each finding through Prove, Fix, and Verify: exploit validation, a fix delivered for your review, and re-exploitation to confirm closure.
Detection across the code-side surface: SAST, SCA, and secrets. Semgrep pairs its rules with AI detection through Semgrep Multimodal; Keygraph runs CPG plus LLM reasoning at every node.
Keygraph exploits each finding against the running app and ships a reproducible PoC, labeling every result exploited, potential, or false positive. Semgrep returns candidates to triage; it does not exploit the running app.
Keygraph drives the remediation: source-level fixes delivered as reviewable pull requests, managed on one deduplicated, Jira-synced findings list with SLA tracking, rather than handing the team a list of candidates.
Keygraph re-runs the original exploit after the fix. If it fails, it means the vulnerability is actually gone, not just that the rule stopped matching, and the result rolls into the system of record.
Identification is scanner work; validation is pentest work, and that split is where a platform that validates and re-verifies pulls away from a scanner that hands back candidates.
| Capability | Keygraph | Semgrep |
|---|---|---|
| Static analysis | ||
| SASTReasoning, not just patterns | ✓CPG plus LLM reasoning at every node | ✓rule/pattern-based; Pro Engine adds cross-file dataflow plus 20,000+ Pro rules; AI detection, triage, and remediation built into every tier through Semgrep Multimodal, metered by AI credits |
| SCA + reachabilityReachable CVEs first | ✓advisory to function to real call chain, then confirms reachability by exploiting it | ✓Supply Chain prioritizes reachable dependency vulns |
| Secret scanningValidated secret detection | ✓40+ types + LLM context pass; masking | ✓semantic + entropy analysis with validation |
| AI false-positive triageLess noise to review | ✓ | ✓ |
| Dynamic testing & exploitation | ||
| Dynamic pentest of the running appAttacks the live app | ✓autonomous agents exploit the live app in a real browser | ✕static only; DAST needs a third-party integration |
| Black-box testingExternal attacker view, zero knowledge | ✓zero-knowledge agents attack from outside, no code access | ✕static analysis only |
| Gray-box testingBlack-box plus provided context and steerability | ✓optional credentials, focus areas, business context, and OpenAPI specs steer the agents | ✕ |
| Exploit validation / PoCProof, not theory | ✓every pentest finding exploited, with a reproducible PoC; static findings reported separately | ✕findings are candidates to triage |
| Business-logic testingInvariant discovery + PoC | ✓invariant discovery + violation + PoC | Partialcustom rules, plus AI IDOR/broken-auth detection via Semgrep Multimodal (launched 2026); no dynamic exploit of the running app |
| Correlation & remediation | ||
| Static-dynamic correlationThe source map directs the pentest | ✓static map directs the pentest; one correlated result set | ✕ |
| Findings system of recordOne canonical record | ✓one canonical, deduplicated finding per vuln across tools, with SLA tracking and bidirectional Jira sync | Partialconsolidated within its own suite; no cross-vendor canonical record or remediation-SLA policy |
| Deployment & trust | ||
| Runs air-gappedEngine runs in your perimeter | ✓on-prem or self-hosted in your own perimeter; Keygraph never receives your source or scan results; inference goes straight to the model endpoint you configure, so a full air-gap needs a local model endpoint | Partialself-hosts, but Semgrep Multimodal sends code to OpenAI and Bedrock by default for AI features |
| BYOK: model traffic stays yoursYour key, your gateway | ✓your own key, model, or AI gateway, with usage tracking: Anthropic, OpenAI, xAI, AWS Bedrock, an OpenAI- or Anthropic-compatible gateway such as a self-hosted LiteLLM, or a local model through Ollama, vLLM, or LM Studio | PartialOpenAI and Bedrock by default; BYO key (OpenAI, Bedrock, Azure OpenAI, Gemini, xAI) on Enterprise only, and it drops Semgrep's fine-tuned models; no fully air-gapped inference |
| Open source & pricing | ||
| Open sourceRead it before you buy | ✓Shannon, AGPL-3.0, 48k+ stars | PartialCE engine is LGPL-2.1, but rules moved proprietary (Dec 2024), prompting the OpenGrep fork |
| Pricing (public, sourced)What you actually pay | Pro from $50 / developer / mo; Enterprise custom. Shannon (OSS) is free | Free ≤10 contributors / 10 private repos; Teams: Code $30, Supply Chain $30, Secrets $15 per contributor / mo (as of 2026-09-18) |
Swipe to compare →
A scanner seat next to a platform seat is the wrong comparison. The real one is a single platform against a scanner plus the separate pentest it still needs, plus the gap between them. Semgrep is static-only, so a team that needs assurance about the running app still buys a third-party penetration test on top.
A contributor is anyone who made at least one commit to a Semgrep-scanned private repo in the last 90 days. Pricing sources: Semgrep Teams: Code $30 and Supply Chain $30 per contributor per month, sold per product, and Secrets $15 (semgrep.dev/pricing, checked September 18, 2026). A third-party web-application penetration test runs an industry range of $10,000 to $30,000 per engagement (TCM Security, Redfox Security, DeepStrike, 2026). Keygraph Pro from $50/developer/month, a floor price, computed here at the same headcount. Estimates for comparison only; actual costs vary by scope.
A pattern, not proof
A Semgrep rule fires when code resembles a known vulnerability, so your team is still left sorting real findings from false ones. Keygraph exploits each finding against the running app and puts only exploit-validated findings, each with a reproducible PoC, in the pentest report. A rule match indicates presence; an exploit demonstrates impact.
Detection, then closure
Semgrep hands you candidates and triage; the fix and the proof it worked happen elsewhere. Keygraph drives remediation and re-exploits to confirm: find, prove, fix, verify in one place, so the finding that goes in is the closure that comes out. The fix-and-verify half runs as tracked work: each response chosen, prioritized, and followed to closure.
The running app
A novel flaw, or one that emerges from how components interact, matches nothing, because nobody thought to write a rule for it, and a static scanner cannot exploit it against the deployed app. Keygraph runs data-flow and behavioral analysis, then validates against the live app, so reachable, exploitable risk is the result, not a list of candidates.
A cleared rule is not a closed bug
Re-scanning only confirms a pattern no longer matches, which a clever patch can satisfy without fixing the bug. Keygraph re-runs the original exploit to confirm the vulnerability is genuinely gone, and, self-hosted, runs the whole loop inside your own environment, with inference going only to the model endpoint you configure.
Keygraph's agentic pentester attacks the live app in a real browser and labels every result EXPLOITED, POTENTIAL, or FALSE POSITIVE with a reproducible PoC. Semgrep is static only; dynamic testing needs a third-party DAST integration.
Learn moreThe static map directs the pentest, and both stages merge into one correlated result per vulnerability. Semgrep has no dynamic side to correlate against.
Learn moreKeygraph discovers an application's invariants, then exploits IDOR, broken auth, and tenant-isolation flaws against the running app. Semgrep Multimodal now flags these statically with AI reasoning, but never exploits them against the running app to prove they are real.
Learn moreRe-scanning confirms the pattern no longer matches, which a clever patch can satisfy without actually fixing the bug. Keygraph re-runs the original exploit. If it fails, the vulnerability is actually gone. That's verification, not a green checkmark.
Learn moreClaims about Semgrep on this page are drawn from the primary references below, verified September 18, 2026.
Run Keygraph against your own environment and judge the evidence: working exploits against your running application, and fixes proven closed by re-exploitation.