

Find out in this report how the two Static Application Security Testing (SAST) solutions compare in terms of features, pricing, service and support, easy of deployment, and ROI.
The AI features that they have and with which we can rewrite the pipeline and troubleshoot issues significantly saved time.
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
This can be translated to being able to do the same amount of work with less technicians.
Tasks that previously took days are completed in significantly less time.
I can say it saves us time related to coding and also saves money, making it a very reliable tool for our organization with great features.
We have rarely faced issues with Harness tech support.
We have not faced any customer support issues, with tickets resolved in less than a four-day SLA.
There was an instance when I faced issues with third-party plugins, and after raising a support ticket, they responded in a few hours with a documentation link that resolved my issue.
Their documentation and community are very active, so most of the time when problems occur, I get a solution.
Customer support and services for Semgrep are very reliable and good.
Customer support is really good and there is also strong community support.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
I was able to control it from 10 repositories or 10 services to thousands of repositories in a couple of minutes very simply.
This is an open-source tool, so it absolutely does the job, but if you were to implement a tool such as this in an enterprise, this would probably not be scalable.
Semgrep makes it easy to integrate and grow within any environment without concern for crashes.
Harness is completely stable, and we are using it in production without facing any stability issues at all.
We have rarely faced issues with Harness tech support.
Harness is decently stable.
If there is no master branch or default branch, the tool fails to identify it and will never scan it unless manually somebody looks into it and fixes the issue.
Since I have been using it, I have not experienced any downtime.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
Improved documentation and onboarding tutorials would help accelerate adoption.
Harness can be improved by providing more clarity on the credits it issues for Harness Cloud, as it has a tiered pricing structure involving license and credit costs, which can get confusing.
The UI and additional dashboarding and other details would definitely make the tool more user-friendly and more of a candidate to be implemented in an enterprise.
Currently, they are working on identifying business logic vulnerabilities or privilege escalation vulnerabilities by looking at the code, and they should continue to focus on and improve this effort.
More advanced dependency analysis features in the SCA part and deeper vulnerability databases would be beneficial.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
The licensing cost is a little bit too high.
It is basically open-source, so the cost to set up is no cost.
It offers very reasonable pricing and costs.
Harness uses AI to suggest errors in case of deployment failures.
The platform also supports cloud-native environments and Kubernetes deployments, making pipeline management easier, and its automation capabilities significantly improve speed and reliability.
If something goes wrong, I can use AI troubleshooting to build or test my fails and analyze the logs, suggesting the fixes.
When you triage with AI, it gathers context around the finding and reduces the noise about 80 to 90 percent of the time, asking you to focus only on findings that really matter.
The Software Composition Analysis is the most valuable feature in Semgrep.
The best feature of Semgrep is its ability to highlight high priority issues during scanning, making it critical for developers to address these vulnerabilities promptly.
| Product | Mindshare (%) |
|---|---|
| Harness | 0.7% |
| Semgrep | 2.4% |
| Other | 96.9% |

| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 1 |
| Large Enterprise | 10 |
| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 1 |
| Large Enterprise | 5 |
Harness offers a comprehensive toolset for automating deployment processes and enhancing software update efficiency. It's lauded for its CI/CD capabilities, feature flagging, and real-time deployment monitoring. Key features include an intuitive UI, secret management, and robust rollback functionalities, all contributing to improved productivity and reduced errors in DevOps environments.
Semgrep is an advanced static analysis tool designed to identify vulnerabilities and enforce coding standards, catering primarily to professionals with a focus on enhancing code security and quality.
Engineered for software development environments, Semgrep delivers efficient security feedback with minimal setup. By offering a rich collection of rule sets, it allows customization and integration into CI/CD pipelines, supporting continuous code examination. Semgrep not only uncovers hidden flaws but also enforces best practices, making it a valuable asset for development teams seeking to build secure and reliable software.
What are the most important features of Semgrep?In industry applications, Semgrep is a popular choice for sectors such as finance and healthcare, where code integrity and security are paramount. Its integration capabilities allow for effective oversight of compliance and secure coding standards without disrupting existing workflows. This adaptability ensures it meets sector-specific requirements, making it a trusted tool in fields where data privacy and protection are critical.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.