No more typing reviews! Try our Samantha, our new voice AI agent.

Harness vs Semgrep comparison

 

Comparison Buyer's Guide

Executive Summary

Review summaries and opinions

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

ROI

Sentiment score
7.3
Harness enhanced deployment efficiency and error reduction, yielding significant ROI through automation and AI-driven cost-saving strategies.
Sentiment score
6.3
Semgrep improves ROI by accelerating development, reducing manual labor, and addressing vulnerabilities early, enhancing efficiency and profitability.
The AI features that they have and with which we can rewrite the pipeline and troubleshoot issues significantly saved time.
Cloud Architect at a outsourcing company with 51-200 employees
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
Technical Associate at ZS
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
Software Engineer at Citi
This can be translated to being able to do the same amount of work with less technicians.
SecOps Engineer at IriusRisk
Tasks that previously took days are completed in significantly less time.
DevOps Engineer at Exponential Craft
I can say it saves us time related to coding and also saves money, making it a very reliable tool for our organization with great features.
Angular Developer at Flourish Software
 

Customer Service

Sentiment score
7.7
Harness offers reliable, responsive customer service and well-structured documentation, providing efficient issue resolution and high user satisfaction.
Sentiment score
6.1
Semgrep's customer service is efficient, with comprehensive documentation and community support reducing the need for direct assistance.
We have rarely faced issues with Harness tech support.
IT Analyst | Aws Cloud Ops | Dev Ops | Fin Ops at Tata Consultancy
We have not faced any customer support issues, with tickets resolved in less than a four-day SLA.
Quality Engineering Lead at a logistics company with 51-200 employees
There was an instance when I faced issues with third-party plugins, and after raising a support ticket, they responded in a few hours with a documentation link that resolved my issue.
Senior Software Engineer 2 at Porch
Their documentation and community are very active, so most of the time when problems occur, I get a solution.
Security Researcher at a tech vendor with 10,001+ employees
Customer support and services for Semgrep are very reliable and good.
Angular Developer at Flourish Software
Customer support is really good and there is also strong community support.
SecOps Engineer at IriusRisk
 

Scalability Issues

Sentiment score
7.5
Harness effectively scales SaaS environments, supports complex workflows, but may face stability issues with simultaneous service integrations.
Sentiment score
8.1
Semgrep scales efficiently for both small and large teams, adapting well to diverse environments with cloud-native features.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
Senior Software Engineer at a financial services firm with 10,001+ employees
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
Technical Associate at ZS
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
Software Engineer at Citi
I was able to control it from 10 repositories or 10 services to thousands of repositories in a couple of minutes very simply.
Cloud & Application Security at Sixt SE
This is an open-source tool, so it absolutely does the job, but if you were to implement a tool such as this in an enterprise, this would probably not be scalable.
DevSecOps Security Engineer at a manufacturing company with 10,001+ employees
Semgrep makes it easy to integrate and grow within any environment without concern for crashes.
DevOps Engineer at Exponential Craft
 

Stability Issues

Sentiment score
8.1
Harness is considered stable and reliable, although integration with many applications may occasionally affect stability.
Sentiment score
7.8
Semgrep generally operates stably, though AI scanning limitations and integration improvements are needed for large repositories.
Harness is completely stable, and we are using it in production without facing any stability issues at all.
Quality Engineering Lead at a logistics company with 51-200 employees
We have rarely faced issues with Harness tech support.
IT Analyst | Aws Cloud Ops | Dev Ops | Fin Ops at Tata Consultancy
Harness is decently stable.
Technical Associate at ZS
If there is no master branch or default branch, the tool fails to identify it and will never scan it unless manually somebody looks into it and fixes the issue.
Cloud & Application Security at Sixt SE
Since I have been using it, I have not experienced any downtime.
Angular Developer at Flourish Software
 

Room For Improvement

Simplify configuration, improve UI, expand features, clarify pricing, and enhance security to improve accessibility and functionality for smaller teams.
Semgrep needs user-friendly enhancements, better documentation, efficient scanning, integration flexibility, AI advancements, and improved notifications and databases.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
Technical Associate at ZS
Improved documentation and onboarding tutorials would help accelerate adoption.
Cloud Platform at Futurescape
Harness can be improved by providing more clarity on the credits it issues for Harness Cloud, as it has a tiered pricing structure involving license and credit costs, which can get confusing.
Quality Engineering Lead at a logistics company with 51-200 employees
The UI and additional dashboarding and other details would definitely make the tool more user-friendly and more of a candidate to be implemented in an enterprise.
DevSecOps Security Engineer at a manufacturing company with 10,001+ employees
Currently, they are working on identifying business logic vulnerabilities or privilege escalation vulnerabilities by looking at the code, and they should continue to focus on and improve this effort.
Cloud & Application Security at Sixt SE
More advanced dependency analysis features in the SCA part and deeper vulnerability databases would be beneficial.
SecOps Engineer at IriusRisk
 

Setup Cost

Harness pricing is higher than open-source but justified by benefits, with room for improvement in licensing cost noted.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
Technical Associate at ZS
The licensing cost is a little bit too high.
Cloud Architect at a outsourcing company with 51-200 employees
It is basically open-source, so the cost to set up is no cost.
Security Researcher at a tech vendor with 10,001+ employees
It offers very reasonable pricing and costs.
Angular Developer at Flourish Software
 

Valuable Features

Harness simplifies CI/CD automation with AI-driven processes, enhancing deployment speed and reliability while reducing risks and manual effort.
Semgrep enhances security and efficiency with customizable rules, seamless integration, and user-friendly interfaces for rapid issue detection.
Harness uses AI to suggest errors in case of deployment failures.
Senior Software Engineer at a financial services firm with 10,001+ employees
The platform also supports cloud-native environments and Kubernetes deployments, making pipeline management easier, and its automation capabilities significantly improve speed and reliability.
Cloud Platform at Futurescape
If something goes wrong, I can use AI troubleshooting to build or test my fails and analyze the logs, suggesting the fixes.
Cloud Architect at a outsourcing company with 51-200 employees
When you triage with AI, it gathers context around the finding and reduces the noise about 80 to 90 percent of the time, asking you to focus only on findings that really matter.
Cloud & Application Security at Sixt SE
The Software Composition Analysis is the most valuable feature in Semgrep.
DevSecOps Security Engineer at a manufacturing company with 10,001+ employees
The best feature of Semgrep is its ability to highlight high priority issues during scanning, making it critical for developers to address these vulnerabilities promptly.
DevOps Engineer at Exponential Craft
 

Categories and Ranking

Harness
Ranking in Static Application Security Testing (SAST)
7th
Average Rating
8.0
Reviews Sentiment
7.3
Number of Reviews
11
Ranking in other categories
Build Automation (5th), Cloud Cost Management (6th), Feature Management (2nd)
Semgrep
Ranking in Static Application Security Testing (SAST)
13th
Average Rating
7.6
Reviews Sentiment
7.2
Number of Reviews
7
Ranking in other categories
Supply Chain Management Software (4th), Software Composition Analysis (SCA) (9th), Static Code Analysis (5th)
 

Mindshare comparison

As of August 2026, in the Static Application Security Testing (SAST) category, the mindshare of Harness is 0.7%, up from 0.3% compared to the previous year. The mindshare of Semgrep is 2.4%, down from 2.9% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Static Application Security Testing (SAST) Mindshare Distribution
ProductMindshare (%)
Harness0.7%
Semgrep2.4%
Other96.9%
Static Application Security Testing (SAST)
 

Featured Reviews

MK
Technical Associate at ZS
Templatized pipelines have improved efficiency while limitations in code-based development remain
Harness UI can do a lot of good things. Harness's UI should not feel very complicated. At the current stage, it feels very commercialized and compared to other platforms such as Argo CD or Jenkins, which feel much more lively and much more simple. Infrastructure as code or pipeline as code is something that Harness severely lacks. There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code. Pipeline as code is definitely one of the disadvantages when it comes to Harness. Additionally, the entire platform feels very commercialized, which is something that a lot of developers, especially open-source enthusiasts, might not appreciate even within the organization. One of the very important key factors I observed was that there is no way to execute nested pipelines, which means that we cannot execute child pipelines within child pipelines and child pipelines even within those child pipelines. There is no way to execute nested pipeline execution, which may or may not be required based on the use case, but it is definitely one of those features that I wish the platform had.
Manjunath Maneppagol - PeerSpot reviewer
Cloud & Application Security at Sixt SE
Context-aware code analysis has reduced noise and now improves developer experience with actionable security findings
I have consistently observed that their scan time is an issue for mono repos. Sometimes with their AI-based scanning, when you triage that scan, the scan never completes or finishes(, which makes it difficult. Another consistent issue is that whenever you have a new repo to onboard to the platform, the tool ideally should detect the master branch by default. However, sometimes the tool fails to identify it and will never scan it unless manually somebody looks into it and fixes the issue. Although their support team is really good, this issue was present six or eight months ago during the POC and is still present now. If it is affecting multiple customers, it should be prioritized and fixed. I would say that their integration aspects could have been improved. I see a lot of different security solutions that provide flexibility to the security teams based on Jira project, team divisions, Slack, and all those can be very much easily customized. Semgrep needs to work on the enhancement of their notification capabilities. Currently, they are working on identifying business logic vulnerabilities or privilege escalation vulnerabilities by looking at the code, and they should continue to focus on and improve this effort. Regarding stability, whenever you have a mono-repo which is a very large repository, the scan never finishes or the scan never kicks in. At that time, you have to reach out to the support team and ask them to expand the resources in the back end to fix it. This is an issue I keep seeing often on that platform.
report
Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.
908,800 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
25%
Outsourcing Company
8%
Manufacturing Company
8%
Computer Software Company
6%
Financial Services Firm
14%
Manufacturing Company
11%
Comms Service Provider
8%
Computer Software Company
7%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise1
Large Enterprise10
By reviewers
Company SizeCount
Small Business4
Midsize Enterprise1
Large Enterprise5
 

Questions from the Community

What needs improvement with Harness?
There are some UI components that can be improved. The needed UI improvements include more graphs, more history, the ability to create pipelines through the UI, and more interactions, with UI compo...
What is your primary use case for Harness?
My main use case for Harness is to create pipelines, deploy applications, and manage security pipelines. I use Harness to deploy applications to EC2 instances and Kubernetes instances, and I create...
What advice do you have for others considering Harness?
My advice for others looking into using Harness is to use AI capabilities, create pipelines, and then use it to deploy. Harness is a good tool. I would rate this review a nine out of ten.
What needs improvement with Semgrep?
Semgrep can be improved by making it more user-friendly. There are tools in the market, such as Aqua Security, that have features worth utilizing. However, there are some comprehensive scanning cap...
What is your primary use case for Semgrep?
My main use case is to perform SAST, static application security testing. I have been using it for the last 10 months. Initially, I was planning to use it just for the code review part so that deve...
What advice do you have for others considering Semgrep?
It streamlines with the governance and compliance of the country where the company operates. It follows GDPR guidelines and EU guidelines. In India, I follow certain guidelines, so it also passes t...
 

Comparisons

 

Also Known As

Armory
Semgrep Code, Semgrep Supply Chain, Semgrep AppSec Platform
 

Overview

 

Sample Customers

Linedata, Openbank, Home Depot, Advanced
Policygenius, Tide, Lyft, Thinkific, FloQast, Vanta, and Fareportal
Find out what your peers are saying about Harness vs. Semgrep and other solutions. Updated: August 2026.
908,800 professionals have used our research since 2012.