LabHub

Blog

Static Analysis / SAST 2026 — Semgrep / CodeQL / Snyk / SonarQube / Aikido / Trivy Deep Dive

2026-05-15 · 26 min read · #security#sast#static-analysis#semgrep#codeql#snyk#sonarqube#aikido#cycode#gitguardian#trivy#checkmarx#sbom#devsecops#deep-dive#english

한국어English日本語

Prologue — "The era of one security tool covering everything is over"

If you asked "which static analysis tool should we use?" around 2018, the answer was usually one of two: SonarQube if you wanted open source, Checkmarx or Veracode if you had an enterprise budget. That was basically it. You bolted one SAST onto CI, a human triaged false positives every quarter, the operator received a PDF report, and developers almost never saw it.

By May 2026, that picture has shattered. A typical company's security pipeline now looks something like this:

This post inventories where each of those tools stands in 2026, what they do well, what they fail at, and how to pick. Not just a list — we follow the four currents that have shaken the market between 2024 and 2026: Pro engines, reachability, AI autofix, and EU CRA.

1. The 2026 code security map — SAST / DAST / SCA / Secrets / Container

Big picture first. Code security tools sort into five axes.

CategoryWhat it looks atRepresentative tools
SAST (Static App Security Testing)Source code vulnerable patterns, dataflowSemgrep, CodeQL, Snyk Code, SonarQube, Checkmarx, Veracode
DAST (Dynamic App Security Testing)Running app, HTTP / surface vulnerabilitiesOWASP ZAP, Burp Suite, Invicti
SCA (Software Composition Analysis)Known CVEs in OSS dependenciesSnyk Open Source, Endor Labs, Socket.dev, Trivy, Dependabot
SecretsAPI keys and tokens in code or git historyGitGuardian, TruffleHog, Cycode, Gitleaks
Container / IaCContainer images, Terraform, K8s manifestsTrivy, Snyk Container, Aikido, Checkov

Two new categories have wedged in between 2024 and 2026:

And the trend in 2026 is unmistakable. "One platform wraps multiple tools." Snyk sells Code + Open Source + Container + IaC as a bundle, Aikido was born all-in-one, and Semgrep added Supply Chain and Secrets on top of its Pro engine. You either start as a single-point tool and become an ASPM-shaped platform, or you start as a platform.

2. Semgrep — the de facto OSS SAST and Pro engine

Semgrep emerged around 2020 using a simple model: pattern matching on the AST. It looks like grep but reads the syntax tree. That simplicity became a weapon, and by 2026 it is essentially the OSS SAST standard.

Core concepts

Strengths

Weaknesses

When to pick it

# Example Semgrep rule — SQL injection in Flask
rules:
  - id: flask-sql-injection
    pattern: |
      $CURSOR.execute("..." + $VAR + "...")
    message: SQL injection via string concatenation
    severity: ERROR
    languages: [python]
    metadata:
      cwe: CWE-89
      owasp: A03:2021-Injection

# Local run
semgrep --config=auto .

# In CI
semgrep ci --config=p/owasp-top-ten

The Pro engine goes beyond intra-function analysis: it does interprocedural dataflow and tracks taint through class members. The big difference from CE is whether you can catch "user input that reaches a sink five function hops away."

3. CodeQL — the heart of GitHub Advanced Security

CodeQL was built by Semmle and acquired by GitHub in 2019. Its distinctive model: convert code into a database and write queries on top of it. You ask, SQL-style, "find me a code path satisfying these conditions."

Core concepts

Strengths

Weaknesses

When to pick it

// CodeQL example — Java SQL injection taint flow
import java
import semmle.code.java.dataflow.FlowSources
import semmle.code.java.dataflow.TaintTracking

module SqlInjectionConfig implements DataFlow::ConfigSig {
  predicate isSource(DataFlow::Node n) { n instanceof RemoteFlowSource }
  predicate isSink(DataFlow::Node n) {
    exists(MethodCall mc | mc.getMethod().hasName("executeQuery") |
      n.asExpr() = mc.getArgument(0))
  }
}

module SqlInjectionFlow = TaintTracking::Global<SqlInjectionConfig>;

from SqlInjectionFlow::PathNode source, SqlInjectionFlow::PathNode sink
where SqlInjectionFlow::flowPath(source, sink)
select sink, source, sink, "SQL injection from $@", source, "user input"

CodeQL's true value: "one query, applied to every GitHub repo." When Log4Shell hit, GitHub shipped a query within 24 hours and it took effect across hundreds of thousands of repos instantly. That kind of scale is hard for anyone else to match.

4. Snyk Code / Snyk Open Source — after the DeepCode integration

Snyk started in SCA (dependency scanning). It expanded into SAST in 2020 by acquiring DeepCode (an ETH Zurich spinoff doing ML-based SAST), and today is a bundled platform of Code + Open Source + Container + IaC.

Core products

Strengths

Weaknesses

When to pick it

# Snyk CLI usage
snyk auth
snyk code test                  # SAST
snyk test                       # SCA (dependencies)
snyk container test alpine:3    # container
snyk iac test terraform/        # IaC

# CI integration (GitHub Actions)
- uses: snyk/actions/setup@master
- run: snyk test --severity-threshold=high

Snyk's big shift was accelerating the DeepCode AI integration in 2024. SAST moved from pattern-based to ML + LLM autofix. Field reports now cite "30 to 40 percent false positive reduction, autofix adoption above 50 percent." That said, the classic ML weakness — "weak explanation of why this is vulnerable" — is also raised as a concern.

5. SonarQube 11 — how the classic evolves

SonarQube has been around since 2008, the static analysis classic. Originally focused on code quality (duplication, complexity, test coverage), it strengthened security rules (SonarSource Security) in the late 2010s and entered the SAST market.

Core concepts

Strengths

Weaknesses

When to pick it

# SonarQube + Maven build
sonar:
  image: sonarsource/sonar-scanner-cli
  command: >
    sonar-scanner
    -Dsonar.projectKey=my-app
    -Dsonar.host.url=$SONAR_HOST
    -Dsonar.login=$SONAR_TOKEN
    -Dsonar.qualitygate.wait=true

The core changes in SonarQube 11 (released 2024) are twofold. One is the strengthened Clean Code model — issues are now classified not by simple severity but by attributes (Consistency, Intentionality, Adaptability, Responsibility). The other is AI-assisted code rules — a ruleset that recognizes patterns generated by Copilot was added.

6. Aikido Security — the all-in-one newcomer

Aikido Security is a Belgian startup founded in 2023, raising a Series A of 17M USD in 2024 and a Series B of 50M USD in 2025. It's an all-in-one AppSec platform that grew fast.

What's different

Strengths

Weaknesses

When to pick it

# Aikido CLI integration
aikido scan --severity high

# Once the GitHub App is installed
# - automatic comments per PR
# - severity-based blocking
# - AI Autofix PRs generated automatically

Aikido's real differentiator is noise management. A typical SAST tool throws thousands of issues at a big monorepo, and security engineers close more than half as false positives. Aikido uses ML to dedupe + context (which environment, which path) to prioritize, and surfaces "the 30 you actually need to look at this week." That UX difference creates large value for small teams.

7. Cycode / GitGuardian — secrets + supply chain

The category of catching exposed secrets (API keys, tokens, certificates) in code and git history was essentially created by GitGuardian around 2020. Cycode bundled supply chain on top and went broader as an ASPM.

GitGuardian

Cycode

Strengths and weaknesses

ItemGitGuardianCycode
Strength#1 secret-detection precision, generous free tierFull-stack ASPM, large-org visibility
WeaknessWeaker outside secretsNarrower than GitGuardian if only secrets matter
PricingBest value if you only need secretsEnterprise pricing

When to pick it

# GitGuardian ggshield pre-commit hook
repos:
  - repo: https://github.com/gitguardian/ggshield
    rev: v1.32.0
    hooks:
      - id: ggshield
        language_version: python3
        stages: [commit, push, manual]

The hard part about secret detection is that regex alone is not enough. AWS access keys have an obvious pattern, but JWT tokens or Stripe restricted keys need context (surrounding variable names, functions) and entropy. GitGuardian and Cycode both added ML classifiers to cut false positives, and around 2025 they started adding LLM-based features that judge "is this an actual secret or a placeholder?"

8. Trivy (Aqua) — containers + dependencies + IaC

Trivy is an OSS container scanner from Aqua Security. Starting as a simple CLI, it became the de facto standard. It scans not just container images but dependencies, IaC, K8s manifests, and SBOMs — all from one binary.

Core features

Strengths

Weaknesses

When to pick it

# Trivy usage
trivy image alpine:3.20
trivy fs ./src
trivy repo https://github.com/user/repo
trivy config terraform/
trivy k8s --report summary cluster

# SBOM generation
trivy image --format cyclonedx -o sbom.json alpine:3.20

Trivy's big strength is "one tool does five things." For a small team, the combo of Trivy + Semgrep CE + GitGuardian free tier alone covers SAST + SCA + Container + IaC + Secrets. It nearly always appears as the starting point for OSS-friendly teams.

9. Checkmarx / Veracode — the enterprise camp

Checkmarx (Israel, 2006) and Veracode (US, 2006) are the two classic enterprise SAST platforms. Both target large enterprises, finance, and government.

Checkmarx

Veracode

Strengths

Weaknesses

When to pick it

# Checkmarx One CLI
cx scan create --project-name "my-app" \
  --branch main \
  --scan-types sast,sca,iac-security \
  -s ./source

# Veracode CLI
veracode static scan \
  --source-file my-app.jar \
  --app-name my-app

The enterprise camp is being chased by modern tools. As Snyk, Semgrep Pro, and GHAS eat into the enterprise market, Checkmarx and Veracode have accelerated UX improvements and AI autofix (Checkmarx AI Security Champion, etc.). At similar prices, modern tools have an increasingly clear edge.

10. OWASP ZAP, Bearer, Endor Labs, Socket.dev — other heavyweights

The notable tools that didn't fit into the eight chapters above but cannot be skipped in 2026.

OWASP ZAP

Bearer

Endor Labs

Socket.dev

Comparison matrix

ToolCategoryStrengthWeakness
ZAPDASTOSS, big communityClassic UI, many false positives
BearerPrivacy SASTBest at PII flow trackingWeak for general SAST
Endor LabsSCA + ReachabilityStrong on prioritizationEnterprise pricing
Socket.devnpm supply chainReal-time supply chain signalsWeak outside npm

11. SBOM (SPDX / CycloneDX) — standards maturing

An SBOM (Software Bill of Materials) is a list of "which components this software is made of." Since US Executive Order 14028 in 2021, momentum toward de facto requirement has built up, and EU CRA in 2024 set the direction for mandatory adoption in the EU market.

Two standards

Both survive in 2026, and tools usually support both. CycloneDX feels slightly ahead among security tools (Trivy, Snyk, Anchore, Syft).

What it contains

FieldMeaning
ComponentPackage name, version, type (library, OS, container, ...)
SupplierWho made it
HashFor integrity verification
LicenseLicense (SPDX ID)
RelationshipGraph: depends-on, contains, etc.
Vulnerabilities(optional) known CVEs and VEX

Generation tools

# SBOM generation from a container with Syft
syft alpine:3.20 -o cyclonedx-json > sbom.json
syft alpine:3.20 -o spdx-json > sbom.spdx.json

# Same with Trivy
trivy image --format cyclonedx -o sbom.json alpine:3.20

# GitHub SBOM API
gh api /repos/OWNER/REPO/dependency-graph/sbom > sbom.json

VEX (Vulnerability Exploitability eXchange)

The standard that pairs with SBOM. It standardizes a vendor response like "this CVE on this component does not affect our product." Tools started ingesting VEX in 2025, and combined with reachability analysis, it became the key infrastructure for "prioritize only the truly risky CVEs."

12. Reachability analysis — Endor, Snyk

If you've ever received a report saying "your dependencies have 100 CVEs," you've probably wondered how many of them are actually called from your app. Reachability analysis automates that.

What is reachability?

According to industry measurements, 70 to 95 percent of Level 1 CVEs become unreachable when you push to Levels 3 to 4. In other words, most don't need patching, or have low priority.

Major providers

ToolDepthLanguage coverageNotes
Endor LabsLevel 4 (call-graph)Java, JS/TS, Python, Go, Rust, etc.Reachability specialist
Snyk Open SourceLevel 3 (symbol)Java, JS/TS, PythonSmooth UX
Semgrep Supply ChainLevel 3Java, JS/TS, Python, Ruby, GoUses the Semgrep engine
Socket.devLevel 1 + behavioral analysisnpm-focusedA different axis

The effect

One field case — a large monorepo (JS/TS, 300K LOC, 1500 dependencies).

This effect made reachability a near-mandatory feature when picking an SCA tool after 2024.

13. LLM-powered SAST + Autofix

The biggest current between 2023 and 2026. LLMs changed two things about SAST.

1. Rule writing / dataflow

Traditionally, SAST rules were regex or explicit rules over a dataflow graph. LLMs generalize "natural-language description to code pattern" to some degree. The result is a chance to catch "new vulnerable patterns never seen before."

2. Autofix

LLMs auto-generate patch PRs for findings.

The field caveats

Just because an LLM autofix produces a PR doesn't mean it's always correct.

The 2026 best practice is "LLM autofix is a PR draft requiring mandatory human review, and only trivial cases like dependency upgrades may be auto-merged." Code patches still need human eyes.

# A pattern that autofix often gets wrong
# Before — SQL injection
query = f"SELECT * FROM users WHERE name = '{name}'"
cursor.execute(query)

# LLM autofix v1 (wrong) — only adds escape
query = f"SELECT * FROM users WHERE name = '{name.replace(chr(39), chr(39)+chr(39))}'"
cursor.execute(query)

# LLM autofix v2 (right) — parameterized
cursor.execute("SELECT * FROM users WHERE name = ?", (name,))

14. EU CRA (2024) — software regulation begins

The EU Cyber Resilience Act was passed by the EU Parliament in October 2024 and came into force in November 2024. It imposes security requirements on "products with digital elements" (including software) placed on the EU market.

What it requires

Timeline

When Korean or Japanese companies are affected

Tool impact

Because EU CRA requires SBOM, vulnerability management process, and 24-hour reporting, tool selection now requires:

  1. SBOM generation + storage + external disclosure.
  2. A 24-hour workflow from discovery to classification to patch to report.
  3. Audit logs — who decided what, kept for 5 years.

ASPM platforms like Cycode, Aikido, and Snyk quickly added EU CRA support, and GHAS reinforced its Security Advisory workflow. Korean and Japanese teams considering EU market entry in 2026 should verify CRA support when choosing a SAST tool.

15. Korea / Japan SAST adoption

Korea

Korea is a market where security audits are effectively mandatory under the Information and Communications Network Act, the Personal Information Protection Act, and ISMS-P certification. Traditionally these tools were strong:

Modern tools have been gaining ground since the mid-2020s.

Japan

The Japanese SAST market is conservative but has seen rapid penetration by global tools in the 2020s.

Japanese market characteristics:

  1. Preference for self-hosting — SonarQube on-prem is strong.
  2. Consulting + tool bundles are typical — standalone SaaS adoption is cautious.
  3. Government and defense prefer Japanese vendors (FFRI etc.).

Conclusion — regional recommendations

ScenarioKoreaJapan
Startup (10-50)Semgrep + Trivy + GitGuardianAikido or Snyk
Mid-size (50-500)Snyk or GHAS + AikidoSnyk + Cycode
Enterprise (500+)Checkmarx + Cycode + in-houseVeracode + FFRI consulting
FinanceSparrow + Fortify + CheckmarxCheckmarx + GMO + self-hosted SonarQube
EU market entryCycode or Aikido (SBOM + CRA)Snyk or Aikido (SBOM + CRA)

Closing — "You don't buy a tool, you buy a workflow"

The 2026 SAST market is not a single category but a five-axis tournament. And five currents are shaking it:

  1. All-in-one platform consolidation — Snyk, Aikido, Cycode bundle SAST/SCA/Secrets/Container.
  2. Reachability — automated judgment of "is this CVE actually risky?"
  3. LLM autofix — automation from finding to fix PR.
  4. EU CRA — SBOM + 24-hour reporting + 5-year patch obligation.
  5. Developer-first UX — IDE integration, immediate PR feedback, automatic false-positive dedup.

The starting point for small teams is simple — Semgrep CE + Trivy + GitGuardian free tier. From there, as the team grows, you wrap them in one ASPM (Aikido, Cycode, Snyk), or you integrate via GHAS if you're on GitHub Enterprise. Large organizations standardize on a combination of enterprise tools (Checkmarx, Veracode) and an ASPM (Cycode).

One truth — "You don't buy a tool, you buy a workflow (discover, triage, patch, report)." Whatever tool you pick, if this workflow doesn't run in under 5 minutes, you'll just pile 10,000 issues into a backlog. The first question of any tool evaluation is always "if a PR gets a red mark from the SAST, can it reach a mergeable state within an hour?"

References

Comments

No comments yet.

Sign in to leave a comment