Disclosure: This is written by Lorikeet Security. The Semgrep column reflects Semgrep's public product, pricing, and whitepaper material as of this writing. We'd rather say this up front than pretend otherwise: Semgrep and Lory are not really substitutes for each other, and a comparison that treats them as head-to-head rivals would be misleading. Read on for why, and where each one actually earns its place.
The One-Line Difference
Semgrep is a static analysis platform - it reads your source code and flags patterns that could be a vulnerability, in seconds, on every commit.
Lory is an AI pentester - it attacks a running system (or reviews a repo as one engagement among several) and proves what's actually exploitable, with a human signing every finding.
Semgrep's own reachability documentation is candid about the boundary: a static scanner can find a vulnerable-looking pattern, but it can't always tell you whether that pattern is reachable and exploitable at runtime without dynamic testing. That's the whole reason a category like AI pentesting exists alongside SAST rather than instead of it.
At a Glance
| Dimension | Semgrep | Lory by Lorikeet |
|---|---|---|
| Category | Static application security testing (SAST) + SCA + secrets | AI-driven penetration testing, human-signed |
| What it tests | Source code, on every commit or CI run | A running system, or a repo as one engagement type among several |
| Speed | Sub-minute scans, results in the pull request | Hours to days per engagement, depending on depth |
| Proves exploitability | Reachability analysis narrows it; doesn't confirm at runtime | Yes, reproduced with request/response and the chain it unlocks |
| Human review | AI-assisted triage (Semgrep Multimodal), not a named pentester | A named Lorikeet Security pentester signs every finding |
| Scope model | Every connected repo, continuously | A declared target and rules of engagement, enforced as an allowlist |
| Asset coverage | Source code only | Web, API, mobile, network, cloud, and source code |
| Pricing | Free tier; $35/contributor/month (Team); custom (Enterprise) | Prepaid credits, itemised quote within 24 hours, no seats |
| Recognition | Named in the 2025 Gartner Magic Quadrant for AST | Not published |
| Recurring coverage | Continuous, on every commit | Weekly, biweekly, monthly, quarterly, or yearly, queued and started automatically |
These Solve Different Problems
Worth stating plainly rather than forcing a false rivalry:
- Semgrep is fast because it doesn't run anything. It pattern-matches against source, which is why it can scan on every commit in under a minute. Lory attacks a live target (or clones and analyses a repo as one engagement), which takes longer but produces proof rather than a flagged pattern.
- Semgrep's reach is every repo, all the time. Its AppSec Platform's Pro Engine does cross-file dataflow analysis, and Semgrep's own material claims 50-70% more true positives than single-file analysis, plus reachability-based SCA that Semgrep says cuts false positives in high/critical findings by up to 98%. That's real, useful noise reduction for a developer triaging dependency alerts.
- Semgrep's AI layer (renamed Multimodal in March 2026, folding in the former Semgrep Assistant) triages automatically - Semgrep reports a 95% user agreement rate across more than six million findings for its Autotriage feature. That's automated agreement with a human reviewer's later judgment, not a human signing off on each result before it ships.
- Neither product replaces the other's job. A clean Semgrep scan tells you the code you can see doesn't match a known-bad pattern. It says nothing about your network, your cloud config, your mobile app, or whether a "safe-looking" pattern is actually reachable by an attacker. A Lory engagement proves the latter, on whichever surface you scope it to.
Where Lory Differentiates
- Proof, not a pattern match. Every Lory finding is reproduced with request/response evidence and the chain it unlocks - not a static flag that still needs a human to determine if it's actually reachable.
- A named human signs every finding. Semgrep's Multimodal layer assists triage; it is not a pentester standing behind the result the way Lory's countersignature is.
- Coverage beyond source. Web, API, mobile, network (internal and external), and cloud are all in scope for a Lory engagement - none of which a SAST tool touches by design.
- Scope as a security boundary. Lory only ever touches a declared, signed allowlist of targets; Semgrep by design scans everything connected to it.
Honest Weak Spots for Lory
Semgrep is dramatically faster and cheaper for the specific job of continuous code scanning - sub-minute results on every commit for $35/contributor/month, versus a scoped, queued Lory engagement. Its cross-file dataflow and reachability analysis are purpose-built and mature; Lory's source review is one engagement type among several rather than a dedicated multi-year SAST product. And Semgrep's Gartner Magic Quadrant recognition is a market-maturity signal we can't match with a comparable claim.
Picking Between Them
Semgrep may fit if...
- You want a security gate on every pull request, in seconds, before code ships
- Your primary risk surface is what's visible in source: known-bad patterns, vulnerable dependencies, leaked secrets
- You want per-contributor pricing that scales with your engineering team
Lory may fit if...
- You need proof of exploitability, not a flagged pattern, for a customer, auditor, or board
- Your risk surface includes a running application, network, or cloud environment - not just source
- You want a named human accountable for every finding that reaches you
- You want a scheduled, recurring engagement across your whole estate under one credit balance
Most security-mature teams run both, and that's the honest recommendation: Semgrep in CI catching what's visible in the code on every commit, Lory for the signed, cross-surface engagement that proves what's actually exploitable once it's live.
See What a Signed Engagement Actually Proves
Book a scoping call and we'll show you the difference between a flagged pattern and a reproduced exploit chain - and how a named pentester signs off before anything reaches your report.
Book a Consultation
-- views
Link copied!
