Detection without action is just anxiety. With Semgrep Supply Chain, malware findings trigger automated responses as soon as a finding lands: open a Jira ticket, Slack sec-ops, fire a single-rule-scan to confirm removal of the compromised package. So a zero-day goes from “we heard about an incident, and are trying to find out if and how we’re affected” to “Semgrep flagged the incident, scanned our environment, comms went out, and tickets were assigned, all with no human in the loop.

Semgrep is featured in @latiotech 's latest AI Security industry report — and we’re excited to see Guardian included in the conversation. 🐸 AI agents are changing how software gets built, and security needs to evolve alongside them. As more code is generated by AI, securing it earlier in the development process is becoming increasingly important. Guardian brings security directly into AI coding workflows, helping developers catch issues in AI-generated code before they reach the PR.

Another week, another supply chain incident... 🙃 If you’ve ever wondered, “Are we affected by this?” and then had to scramble to find the answer, this one’s for you. Join us September 23 at 8:00 AM PDT for a practical workshop on protecting your software supply chain and responding when new threats pop up. We’ll show how Semgrep can help block malicious packages, secure GitHub Actions, alert teams to new incidents, and quickly identify which projects need attention. Come learn with us! 👋

AI can write code faster than humans can review it. So what happens to security when that becomes the norm? AI agents are changing not only how quickly software gets built, but who can build it. Experienced engineers are shipping more code, while a new wave of citizen developers is building applications that touch real customer and company data. Join Semgrep’s Milan Williams and Latio Tech’s James Berthoty for a fireside chat on what happens when software creation scales faster than the controls designed to secure it — and how security needs to evolve when humans can’t review every line. We’ll dig into: 🔹 The rise of citizen developers 🔹 What AI means for traditional code review 🔹 How security controls need to evolve for AI-generated code

AI is changing the SDLC. Your security controls need to keep up. Tools like Cursor, Copilot, and Claude Code are helping developers ship more code, faster — putting even more pressure on traditional review cycles. Join Semgrep + BridgeIT for Securing the AI-Native SDLC to explore how teams can build security into AI-assisted development from the start. We’ll cover how Semgrep finds real, reachable vulnerabilities in AI-generated code without overwhelming teams with noise, alongside BridgeIT’s experience building security into GitOps-driven landing zones from day one. 🎁 Plus, attendees can pick their favorite piece of Semgrep swag after the event. September 24 | 9:00 AM PT