Konvu vs Semgrep: Deciding Which Semgrep Findings Are Exploitable (2026)

Quick verdict: Keep Semgrep to find issues, and add Konvu when the Semgrep backlog outgrows your team and you need to know which Semgrep Code and Supply Chain findings an attacker can use. Konvu reproduces the exploit against its own copy of your app, ships the fix, and re-runs the attack to confirm the fix holds.

Semgrep wins on custom rules, merge blocking, malware blocking, secrets validation and a free tier, and Multimodal triages Semgrep Code findings inside Semgrep. Semgrep Supply Chain runs reachability on direct dependencies in 13 language entries, Swift included, but "does not perform reachability analysis" on transitive dependencies, and its conditionally reachable findings "require manual review" (supported languages and Supply Chain overview, checked Oct 13, 2026). Konvu checks environment, configuration and attacker-controlled input on each finding, and Supply Chain dismissals sync back to Semgrep.

The question each one answers

Semgrep answers detection questions: whether your code matches a rule, and whether a vulnerable dependency version is installed with its vulnerable code pattern used in your code (glossary). Semgrep Multimodal, formerly Semgrep Assistant, "combines AI reasoning with rule-based analysis for detection, triage, and remediation" (launch post, March 19, 2026). For triage, it suggests whether a finding, mostly from Semgrep Code, can safely be ignored.

Konvu answers the question after detection: whether an attacker can use a given finding in your deployment, and what the evidence is. Konvu is not a scanner. It starts from findings your scanners already produced, Semgrep included.

Semgrep's glossary says "Proving exploitability is often the last step of triaging a vulnerability." Its December 2025 whitepaper says "a true positive under the reachability lens can be a false positive from the point of view of exploitability," and argues that dataflow reachability helps make that distinction. In its Django example, dataflow analysis marks a function unreachable because it passes the vulnerable code only a static string (whitepaper, PDF).

The whitepaper also names the limit. For findings that hinge on "factors extraneous to static code analysis," such as an external firewall or a vulnerability that "only works in a Unix OS," "static analysis on its own cannot determine exploitability with certitude, so runtime or pentesting would be needed." Konvu does the runtime part. It checks OS, runtime, platform and configuration conditions against your code, then runs the exploit to prove it. When the code does not settle a condition, Konvu asks your team.

Side-by-side

How Semgrep decides a finding

Semgrep Code and Multimodal

Multimodal, renamed from Assistant in March 2026 (release notes), "primarily supports findings generated by Semgrep Code." It draws on your code and triage history to "suggest whether a finding can safely be ignored," with an explanation. It "explains why a finding is a true positive by connecting the rule's message to the code that triggered it," and for security rules it "connects the finding back to the threat model." Explanations "are not available for custom rules or community rules." Agreeing with a suggestion closes the finding, and disagreeing reopens it. Noise filtering, in beta, holds back a PR comment when Multimodal thinks a finding may be a false positive (Multimodal overview).

Triage also learns from your team. When someone ignores a finding with a comment, Multimodal tries to turn it into a memory, and "it will use the memory to assess if similar findings are safe to ignore and hide from developers" (Customize Multimodal). Semgrep's Multimodal docs do not describe checking deployment configuration, operating system or internet exposure when it triages a finding (checked Oct 13, 2026). Some of Semgrep's Agentic Workflows, in beta, prioritize findings "by exploitability" (Agentic Workflows).

Semgrep's accuracy figures are vendor-reported. On January 22, 2025, when the product was Assistant, it matched Semgrep's researchers on "true positives" in 96% of cases across 2,000+ labeled findings, and "The agreement rate on false positives was 41%." Semgrep says the tool is designed to be conservative, "more likely to suggest a developer fix a FP than ignore a TP" (blog). Its metrics page reports a 96% false positive confidence rate, meaning how often Multimodal is right when it calls a false positive, and adds that this "does not mean that Multimodal catches all false positives." The March 2026 launch post reports "a 95% user agreement rate with decisions made by the Autotriage" at steady state.

Semgrep Supply Chain

"In Semgrep Supply Chain, both a dependency's vulnerable version and code pattern must match for a vulnerability to be considered reachable" (glossary). Each finding is flagged reachable, unreachable, conditionally reachable, or no reachability analysis.

A finding is conditionally reachable "if the vulnerability can be exploited when specific conditions are met," such as "the use of a specific operating system." "Semgrep cannot determine whether such factors are true, so conditionally reachable findings require manual review." Supply Chain scans transitive dependencies for vulnerabilities, "but it does not perform reachability analysis" on them (Supply Chain overview). Transitive reachability for JavaScript entered private beta in April 2025 (release notes), and Semgrep's docs give no later status (checked Oct 13, 2026).

Cortex lets you "prioritize findings based on deployment status and internet exposure status" (Cortex), and Sysdig adds deployment status (Sysdig). Semgrep's docs describe both as prioritization inputs and do not describe either one changing a finding's triage state (checked Oct 13, 2026).

How Konvu decides a finding

Konvu runs an exploitability assessment on each finding in your assessment scope (How assessments work). For a dependency finding it checks four preconditions, in order. All four must hold for the finding to be exploitable (Reading an assessment).

Each precondition is reported as met, not met or inconclusive, with the evidence behind it, such as the file paths and code snippets where the vulnerable function is referenced. The result follows from the four:

• All met: Exploitable.
• Any one not met: False Positive, with the failing condition named.
• Some inconclusive, and Konvu has a question to ask: Needs input. A typical question is whether the service is internet-facing (Dependencies).
• Some inconclusive, and no question would settle it: Inconclusive.

Reachability is the third check of four. A reachable finding that fails the environment or attacker-controllability check comes back as False Positive.

The conditions come from Konvu's vulnerability database, which cross-references OSV, GHSA and NVD and adds vulnerable method signatures (Vulnerability enrichment). For CVE-2026-27904 in minimatch, the conditions on the product page include Node.js on the server, a vulnerable symbol reachable from an exposed entry point, extglob parsing enabled, and nested extglob patterns reaching minimatch from input that is untrusted or not strictly length-limited.

For a Semgrep Supply Chain finding, Konvu imports Semgrep's reachability result, then runs its own investigation (Semgrep integration).

For a Semgrep Code finding, an agent follows the flagged code path in your repository. It checks where the input comes from, whether an attacker controls it and from which position (unauthenticated, logged in or administrator), what validation, sanitization or authorization check sits on the way, and what the attacker would gain. Konvu's Code (SAST) docs give an example. Semgrep flags cursor.execute(f"SELECT * FROM users WHERE id = {user_id}"). If user_id comes from a route parameter parsed as an integer, the finding is a False Positive. If it comes from a raw query string, it is Exploitable.

Proof by reproduction. Konvu also attacks the finding. It builds and deploys its own copy of your application in an isolated lab, runs the exploit from a separate host, and records the requests, the responses and the observed impact. A reproduced finding carries that proof. When the attack disproves the finding, its verdict changes to False Positive, with the evidence. If the lab cannot build what the exploit needs, Konvu records why, and the verdict from the checklist stands (How reproduction works). For exploitable findings, Konvu opens a fix PR that runs your tests or hands a plan to your coding agent, and after the fix it re-runs the same exploit against the fix branch to confirm it no longer fires.

At a Fortune 500 retailer, Konvu cut the SCA triage queue by 93% (case study). That is one customer's queue, not a benchmark.

Where Semgrep is stronger

Semgrep leads on each of these, and Konvu's triage does not replace any of them.

• Detection and custom rules. Semgrep finds the issues, and "you can write custom rules to determine what Semgrep detects in your repositories" (Write rules). Konvu has no rule engine.
• Merge blocking. "When Semgrep identifies one or more blocking findings, it returns exit code 1" (blocking findings).
• Triage where the findings live. Multimodal runs inside Semgrep, keeps likely false positives out of PR comments, and applies your team's ignore comments to similar findings. Konvu is a second tool with its own queue.
• Malware and secrets in agent output. Guardian scans "every file an agent generates to detect malware, hardcoded secrets, and common security mistakes," with plugins for Claude Code and Codex and a local Semgrep CLI setup for other agents (Guardian). Konvu Guardrails runs in Claude Code and Codex too, and enforces your team's security guidelines rather than scanning for malware or secrets.
• Malware blocking. Malicious dependencies are critical findings, which a blocking policy stops at the pull request (Supply Chain overview). The Malware Firewall, in private beta, "prevents malicious packages from being installed on developer machines" for npm, pip, uv, Maven, Gradle, Go modules and Cargo (Malware Firewall).
• Secrets validation. Semgrep Secrets uses a validator "to determine if a secret is actively being used," and "All validations, such as API calls, are done locally in your environment" (Secrets overview).
• Upgrade guidance. Upgrade Guidance, in beta, runs the package manager's resolver and labels a fix Safe to upgrade, Breaking changes or No patch available, for JavaScript and Python projects on GitHub Cloud or GitLab Cloud (Upgrade Guidance).
• Reachability languages. Semgrep lists Supply Chain reachability as generally available for 13 language entries, Swift included (supported languages). Konvu assesses Java, Scala, Kotlin, Python, Ruby, JavaScript, TypeScript, C#, Go, PHP and Rust, without Swift (What is Konvu).
• SBOM and license compliance. Supply Chain generates SBOMs and checks open source licenses (Supply Chain overview).
• Free tier and per-contributor pricing. Semgrep's free edition covers up to 10 contributors and 10 private repos, with Code, Supply Chain and 60 AI credits (pricing). Konvu has a free trial but no free tier.

Konvu's limits

• Not a scanner. Konvu needs findings from Semgrep or another source. Its Code (SAST) docs say it "does not run static analysis itself."
• Write-back to Semgrep covers Supply Chain only. When a person dismisses a Supply Chain finding in Konvu, Semgrep's triage state becomes Ignored, with the reason "False Positive" and the note "Dismissed in Konvu" (Dismissing false positives). The evidence stays in Konvu. Konvu does not change Semgrep Code findings (integration).
• No Semgrep Secrets. Konvu does not process Semgrep Secrets findings (Semgrep setup).
• Some findings stay open. When Konvu cannot settle a precondition, the result is Needs input or Inconclusive, and a person decides.
• No published accuracy benchmark. Semgrep publishes figures for Multimodal. Konvu publishes none. It attaches the evidence to every verdict, and the exploit run to every reproduced finding.
• Source control. Konvu reads code from GitHub and GitLab. Enterprise adds GitHub Enterprise Server, GitLab self-managed, Bitbucket Data Center and Azure DevOps Server (pricing). Konvu's docs list the cloud versions of Azure DevOps and Bitbucket as coming soon (What is Konvu).
• Enterprise-only features. API and CLI access and self-hosted analysis are on the Enterprise plan (pricing).

Running both

This is the default setup, and the one the Semgrep integration is built for.

1. Keep Semgrep in CI with your rules, policies and blocking modes.
2. Create a Semgrep API token with the Web API scope and add it in Konvu (Semgrep setup). The same token reads findings and sets triage state.
3. Konvu pulls Semgrep Code and Supply Chain findings once a day and on demand. It reads your code from your source control, not through Semgrep.
4. Each finding gets a verdict with evidence. Exploitable ones are reproduced and fixed: a version-upgrade PR for Supply Chain, a code fix for Semgrep Code, or a plan for your coding agent (Fix pull requests).
5. When your team dismisses a Supply Chain finding in Konvu, Semgrep marks it Ignored.

What stays in Semgrep: detection, rules, policies and blocking, Multimodal, Secrets, Guardian, and the triage state of every Semgrep Code finding. When Multimodal and Konvu both judge a Code finding, decide which one your team treats as the record.

Pricing models

The two price different units. Semgrep charges per contributor. Konvu charges for confident verdicts and fix PRs that land.

Sources: semgrep.dev/pricing and konvu.com/pricing, both checked October 13, 2026. Running both means paying for both.

Sources checked

All sources checked on October 13, 2026.

• Semgrep: Homepage, Pricing, Multimodal overview, Customize Multimodal, Multimodal metrics, Introducing Semgrep Multimodal, 96% agreement blog post, March 2026 release notes, April 2025 release notes, Supply Chain overview, Supply Chain glossary, Supported languages, Supply Chain feature support, Reachability whitepaper, Cortex integration, Sysdig integration, Code Autofix, Supply Chain Autofix, Upgrade Guidance, Malware Firewall, Secrets overview, Blocking findings, Write rules, Guardian, Agentic Workflows
• Konvu: Semgrep integration, Product, Guardrails, Pricing, What is Konvu, Code scanners, Semgrep setup, How assessments work, Reading an assessment, Dependencies, Vulnerability enrichment, Code (SAST), Dismissing false positives, Fix pull requests, Reproducing scanner findings, Answering Konvu's questions

Related comparisons

• Snyk vs Semgrep: Snyk's SCA platform against Semgrep's customizable SAST engine, with independent benchmark data.
• Semgrep vs CodeQL: fast pattern matching against deep semantic analysis, and when teams run both.
• Semgrep vs SonarQube: Semgrep's security focus against SonarQube's quality gates.
• Reachability vs exploitability: why a reachable function is not the same as an exploitable one.