Semgrep, an agent-native code security company, announced the release of its new AppSec Platform today. Specifically, this innovative AppSec Platform provides AI agents with the tools, context, and guided workflows needed to prevent, find, and fix software vulnerabilities. Furthermore, coding agents write code rapidly, and this AppSec Platform ensures security teams keep pace with AI-driven development. In recent benchmarks, agents equipped with the AppSec Platform and Semgrep Mandoline discovered over twice as many real vulnerabilities compared to frontier models alone. Meanwhile, this advanced AppSec Platform reduced token costs in security workflows by an average of 65%.
“Review has always been the hardest part of software development to speed up, and agents have multiplied the code waiting for it,” said Isaac Evans, CEO and co-founder of Semgrep. “Since October, attackers have been running agents against whatever ships, around the clock. Security tools designed around a person reviewing every finding cannot close that window. That’s why we’ve made Semgrep agent-native.”
Semgrep designed its analysis to work seamlessly with external coding agents, including OpenAI models. Specifically, Semgrep integrates with the OpenAI Daybreak Defense Factory. Moreover, the company holds membership in OpenAI Trusted Access for Cyber. Consequently, through their integration with OpenAI Codex Security, enterprise teams import Semgrep findings directly into the Defense Factory using OpenAI’s guidance.
“With Daybreak Defense Factory, security teams can bring findings from Semgrep together with context from their other tools to investigate vulnerabilities and prepare fixes,” said Matt Boyle, Head of Product Engineering for Cyber, OpenAI. “This helps defenders act on the findings they already have, using the tools they already use.”
Securing Code at the Speed of AI Agents
Across the ecosystem, security agents detect, triage, and remediate software vulnerabilities autonomously. Furthermore, any coding agent accesses Semgrep directly through Semgrep Guardian or the new Semgrep Model Context Protocol (MCP) server.
The integrated features of the AppSec Platform follow agent-written code everywhere. First, Semgrep Guardian secures code as agents draft it in any coding harness. Second, Agentic Workflows identify subtle business logic and authentication vulnerabilities that traditional pattern matching misses. Third, Mandoline traces control and data flow from entry points in milliseconds. Fourth, a robust Context Layer maintains a persistent knowledge graph of each organization’s unique code facts. Fifth, the Semgrep MCP server connects agents in Claude Code, Cursor, and other tools to the core AppSec Platform. Finally, flexible deployment options satisfy strict enterprise security requirements.
“Finding a real vulnerability comes down to whether attacker-controlled input can reach a dangerous operation,” said Drew Dennison, co-founder and CTO of Semgrep. “Models can reason about intent, but they can’t reliably trace that path across a large codebase. Mandoline does, so our agents spend their reasoning on the issues that matter.”
“Semgrep’s agentic workflows have transformed our code security program, expanding the coverage of the code we scan and making those scans more reliable,” said Brandon Spruth, Principal Product Security Engineer at ServiceNow.
To explore how Security Operations Centers (SOC) play a crucial role in defending against modern cyber threats, read our latest SOC News.
News Source: Businesswire.com
