Free forks threaten Semgrep conversions

This risk goes straight at Semgrep's cheapest growth engine, because its best leads start as free users before they become a security budget line. Developers adopt Semgrep CE because it is fast to install in a repo or local terminal, then security teams upgrade when they need cross file taint analysis, reachable dependency findings, secrets validation, and AI triage. If free Semgrep and forks like Opengrep cover enough of that workflow, the jump to paid becomes much smaller.

• Semgrep's commercial plan is not just hosted open source. Paid tiers add specific workflow upgrades, PR comments tied to dashboards, Pro Engine analysis across many files, Supply Chain reachability, Secrets validation, and Assistant driven triage and autofix. Those extras are what convert a developer tool into an enterprise purchase.
  1 sacra
• The open source funnel matters because Semgrep prices by contributing developer, so one successful grassroots install can later expand with engineering headcount. That is a different motion from incumbent AppSec vendors that start with top down procurement. If grassroots usage stops creating pain that only paid solves, Semgrep loses that built in sales handoff.
  1 sacra 3 sacra
• Competitors are attacking the same conversion step from both sides. Forks like Opengrep pressure the free to paid upgrade path from below, while GitHub, GitLab, AWS, Snyk, Endor Labs, and DryRun keep adding low noise scanning, PR review, and AI remediation from above, shrinking the set of reasons to buy a standalone upgrade.
  1 sacra 2 sacra 3 sacra 4 sacra

The path forward is for Semgrep to keep moving paid value into places free tools and forks struggle to follow, especially deeper data flow analysis, better false positive suppression, and tighter integration with AI coding workflows. If it stays meaningfully better at helping large teams fix the right issues inside everyday developer workflows, the community funnel can still convert at enterprise scale.