Semgrep Report Shows Which Code Vulnerabilities Teams Fix—and What Helps
Summary
Semgrep’s 2025 analysis of remediation across 50,000+ repositories found large fix-rate gaps by OWASP category and linked stronger remediation to actionable PR scans, selective merge blocks, reachability analysis, and 90-day escalation.
Key points
- Semgrep’s report analyzed anonymized 2025 remediation patterns across 50,000+ repositories and hundreds of organizations, comparing the top 15% by fix rate with the remaining 85%.
- The report found a 48-percentage-point leader–field fix-rate gap for Authentication Failures (A07) and a 38-point gap for Cryptographic Failures (A02).
- Leaders fixed 69% of findings confirmed through interfile analysis, compared with 43% of single-file findings.
- PR-detected SAST findings took leaders an average of 4.8 days to resolve, compared with 43 days for findings from full scans.
- Organizations using high-confidence rules to block pull-request merges had a 12-point SAST and SCA fix-rate improvement among leaders and a 5-point improvement in the field.
- Leaders fixed 92% of reachable SCA findings, compared with 67% of non-reachable findings.
- Findings open for more than 90 days accounted for 9% of leader SAST remediations and 16% in the field; the report recommends escalating them for remediation, risk acceptance, or false-positive disposition.
Article Details
- Publisher
- Semgrep
- Report Period
- 2025
- Scope
- Remediation patterns for SAST and SCA findings, including fix-rate differences by OWASP category and organizational practices.
- Sample Size
- More than 50,000 repositories across hundreds of organizations.
- Key Statistics
- Authentication Failures (A07) had a 48-percentage-point leader–field fix-rate gap; leaders fixed nearly 60% of findings versus roughly 12% for the field.
- Cryptographic Failures (A02) had a 38-percentage-point leader–field fix-rate gap.
- Leaders resolved PR-detected SAST findings in an average of 4.8 days, compared with 43 days for findings from full scans; the report describes PR-level scanning as accelerating remediation by up to 9×.
- For findings open more than 90 days, 9% of leaders’ SAST remediations and 16% of the field’s SAST remediations came from that backlog.
- Reachable SCA findings were fixed at 92% by leaders, compared with 67% for non-reachable findings.
- Recommendations
- Treat findings open for more than 90 days as an escalation point: remediate them, formally accept the risk with documented justification, or mute confirmed false positives.
- Make PR-level findings actionable by providing developers with sufficient context and a clear fix path.
- Use merge-blocking rules selectively for high-confidence findings, with workflows that support developers in resolving them; avoid rules with high false-positive rates.
- Use reachability analysis to prioritize SCA findings based on whether code calls the vulnerable package function.
- If the critical SAST fix rate is below 50%, investigate whether findings reach developers with enough context, have clear owners, and have an escalation path.