Case Study: Cribl achieves high-signal SAST with Semgrep

Cribl cuts SAST noise with Semgrep over 2 years

Cribl, a company that provides a data engine for IT and security, faced challenges with their legacy SAST tools, which generated excessive low-signal noise and lacked sufficient control over alerting and CI/CD integration. This created unnecessary costs by consuming developer and security team time. They sought a new solution from vendor Semgrep to gain better customizability and reduce false positives.

By implementing Semgrep, Cribl leveraged its custom rules engine and granular policy controls to precisely manage which findings reached developers. The addition of Semgrep Multimodal provided an AI-powered layer to filter false positives, preventing unnecessary PR comments. Integrated into their CI/CD pipeline, Semgrep provided high-signal feedback without halting builds. The result was a significant reduction in noise, saved time for both security engineers and developers, and high engagement on the valuable PR comments that did appear.

Cribl