Snyk Reviews

I typically use Snyk for checking the security and vulnerabilities in my repositories.

Recently, I have used Snyk in one of my repositories for security and vulnerability checks, providing comprehensive knowledge about the repository, including what it does and where the security vulnerabilities are located.

I am using Snyk for the first time and did not use any vulnerability scanning solution before this. I was previously doing Red Hat vulnerability scanning locally for dependency checks, which was not what I wanted.

Snyk's main features include open-source vulnerability scanning, code security, container security, infrastructure as code security, risk-based prioritization, development-first integration, continuous monitoring and alerting, automation, and remediation. The best features I appreciate are the vulnerability checking, vulnerability scanning, and code security capabilities, as Snyk scans all open-source dependencies for known vulnerabilities and helps with license compliance for open-source components.

Snyk integrates into IDEs, allowing issues to be caught as they appear in the code dynamically and prioritizes risk while providing remediation advice.

Snyk provides actionable remediation advice on where vulnerabilities can exist and where code security is compromised, automatically scanning everything and providing timely alerts.

Snyk has positively impacted my organization by improving the security posture across all software repositories, resulting in fewer critical vulnerabilities, more confidence in overall product security, and faster security compliance for project clients.

Snyk has helped reduce vulnerabilities significantly. Initially, the repository had 17 to 31 critical and high vulnerabilities, but Snyk has helped manage them down to just five vulnerabilities, which are now lower and not high or critical.

Although Snyk is strong, sometimes it flags vulnerabilities that are not reachable, not exploitable, and not relevant to a project. Better reachability analysis and context-aware scanning could improve this.

Snyk could benefit from a more optimized scanning engine and incremental scan caching.

I have been using Snyk for the previous one year.

I have no issues with Snyk's reliability; it is stable.

Snyk is very scalable and can handle my organization's growth and changing needs, allowing us to scale up to many stages and reduce developer costs, especially when we have fewer developers.

I never reached out to customer support because I never encountered any issues.

Negative

I considered SonarQube in detail before choosing Snyk.

My experience with pricing, setup cost, and licensing is good, as the overall setup experience is smooth with easy onboarding for connection with GitHub and GitLab. I primarily use it with GitHub, requiring just a few clicks to set up Snyk.

I can see that Snyk saves the costs of hiring security developers for vulnerability scanning and security checks, as that responsibility is now managed by Snyk.

Pricing is good for small teams, with a free tier or low-usage pricing available, and the licensing experience is straightforward but not very flexible.

My advice for others looking into using Snyk is that if you are starting a repository that is free from vulnerabilities and security checks, Snyk is a good option. It automatically provides advice on how to improve for reducing vulnerabilities and security issues, allowing for easy removal of vulnerabilities. You can use it for a free trial, and if it impacts your organization positively, you can consider further usage.

Snyk is a very good product for vulnerability code scanning and can be used effectively. I would rate this product a nine point five out of ten.

My main use case for Snyk involves finding and fixing security issues during application upgrades and migrations. In my work at ADP, I primarily use it to scan applications for vulnerabilities, identify risky dependencies, and help the team remediate issues before they become production problems. We had an initiative called Mythos where we had to upgrade the application and fix all security issues, and Snyk was very helpful during that time.

In one of the Mythos upgrades, Snyk highlighted a dependency vulnerability that was buried in the package chain, which was not something we would have caught quickly by manual review. Because it surfaced early, we fixed it during the upgrade itself instead of dealing with it later, which immensely reduced the risk and kept the rollout on track. That was one of the incidents that I had with Snyk, and it was absolutely very helpful during this complete Mythos upgrade for all the team members.

Another important part of how Snyk fits into my workflow is that it helps shift security left. Instead of waiting until the end of a project to discover vulnerabilities, we can catch them while we are still upgrading, migrating, or making any code changes. It also fits well into the developer workflow because it is just another plugin that we have in Visual Studio Code to be enabled to ensure all security issues are scanned and displayed visually. Once that is done, we can fix it in a matter of time, so having it as an extension in Visual Studio Code is one of the important things for developers because it becomes easily integrated into the workflow they are working with.

I find the most useful features of Snyk to be vulnerability scanning for code dependencies, containers, and infrastructure as code, with dependency intelligence that helps identify risky open-source packages and transitive issues. In major corporations like ADP, dependency intelligence is something that we actually care a lot about. I also like the fixed guidance feature, which includes upgrade suggestions and automated fixed pull requests. It has a developer-friendly workflow, so security issues show up where engineers already work, which is Visual Studio. We, as a team, appreciate two other important features: continuous monitoring, which helps us track risks even after the initial scan, and prioritization, allowing us to focus on the most important issues first.

Dependency ingestion helps us see not just the direct package with the issue but also the transitive dependencies underneath it, which matters a lot because many security problems hide in nested libraries. Without that visibility, we might just miss the real root cause. It also helps the team judge whether a vulnerability is actually relevant to our application or just something we can safely deprioritize, saving us a lot of time during upgrades and migration work. Regarding fixed guidance, it is so valuable because it turns the scan result into an action. Instead of just telling us something is vulnerable, it often points us towards a safer version, an upgrade path, or a remediation option that we can apply quickly. That makes the team faster because developers do not have to investigate every issue from scratch, reducing back and forth between development and security review.

Snyk had a very positive outcome on ADP and our workforce. The biggest positive outcome is less time spent on security remediation and fewer vulnerabilities carrying forward into later stages. Snyk's own metrics framework tracks open issues, new issues, resolved issues, PR checks, and time to fix, which maps well to the kind of benefits we saw in the Mythos initiative. The results included a 44% reduction in mean time to fix and a 62% reduction in critical vulnerabilities, along with an average of 2.2 development full-time employment worth of productivity gains. We saw a very positive impact mainly through time savings and earlier remediation as Snyk helped us catch vulnerabilities sooner during upgrades and migrations, reducing the effort for manual security issues. In practical terms, it improved a lot of developer productivity and helped the team fix security problems faster than ever with very little disruption.

Snyk could improve by reducing the alert noise because in large projects, security tools can surface a lot of findings. It helps when the platform is even better at highlighting what is truly urgent versus what can wait. Smarter prioritization would make it easier for developers to focus on the highest-risk issues first. Another area is workflow clarity during remediation. The fixed guidance is helpful, but it could be even better if the recommended path were more contextual, especially for complex dependency chains or upgrade conflicts. That would save a lot of time when teams are dealing with older applications and migration-heavy work.

I would also like to mention reporting and governance visibility. More flexible dashboards, clearer trend views, or easier ways to track remediation progress across teams would help it be stronger for leadership and security reviews. That kind of visibility matters the most when we are trying to show improvement over time. These are the points I have in mind that could be improved by Snyk.

I have been using Snyk for about eight months now, and it is absolutely valuable.

Snyk has been stable in our environment, and I have used it consistently during upgrades and security remediation work. It performs well without causing major disruption.

Snyk scales well for our needs. As the number of applications and upgrades grows, it continues to fit into our workflow without adding much overhead, remaining useful for ongoing vulnerability detection and remediation across the team. We dealt with plenty of applications as a team, and Snyk grew with us. It was not a bottleneck, so I would say its scalability is top-notch.

Customer support has been decent overall. When we needed help as a team, we approached them, and they are generally responsive and knowledgeable, though the experience can vary depending on the support level. The documentation is very strong, which reduces the need to go to support teams in most cases. I would rate the customer support as a 9 out of 10 because they are mostly knowledgeable, and Snyk definitely has very good documentation, leading to very little chance of needing to contact customer support.

Before Snyk, we used a mix of manual dependency checks, local static scans, and an older open-source scanner as our primary tooling, but we switched to Snyk because it had the coverage and accuracy. Snyk's vulnerability database and dependency intelligence catch more transitive and emerging issues than the older scanner we used. It also integrates easily into the developer workflow because we have an extension in VS Code that we could leverage, and it offers automated fixed PRs along with clear upgrade guidance, dramatically reducing the time spent on researching remediation steps compared with our previous approach. The enterprise readiness, continuous monitoring, and analytics were other aspects that helped us choose Snyk over other older tools.

We definitely saw a measurable return on investment after adopting Snyk for the Mythos initiative, with the biggest wins being time savings and faster remediation. On average, we reduced the mean time to fix security issues by roughly 40 to 50% for the classes of vulnerabilities Snyk surfaced, which shortened our exposure window and reduced rework during upgrades. For ad hoc dependency issues and transitive vulnerability remediation, we estimate developer effort per vulnerability dropped from 8 to 16 hours down to about 2 to 4 hours, thanks to Snyk's dependency intelligence and automated fixed PRs. Across the initiative, that translated into thousands of developer hours saved and the equivalent of one to three full-time developers of effort reallocated to feature work instead of bug or patchwork.

We also saw process benefits, with the number of critical, high-severity issues discovered late in testing or post-deployment dropping significantly. Roughly a 50 to 60% reduction for the targets we track, which reduced hotfix churn and decreased incident-related costs. Using Snyk in VS Code as an extension for CI pipelines meant many fixes were made pre-merge, and our PR blocking rate for high-risk vulnerabilities dropped, while the PR fix throughput increased. In terms of cost avoidance, faster fixes and fewer incidents reduced risk exposure and the potential remediation cost of production incidents. When combined with the time savings mentioned above, the team-level ROI is clear. The subscription cost is small compared to the developer hours recovered and reduced business risk during a major upgrade and migration program, so we saw a clear ROI, and it was very beneficial.

Pricing and setup were fairly straightforward overall because Snyk has a free tier, with paid plans starting around $25 per contributing developer per month, and enterprise pricing is custom, so the cost relates to the team size and the level of features needed. Since we use Snyk as a VS Code extension, the onboarding effort is low, and the licensing model is easy to understand because it scales by contributing developer. Overall, it felt manageable for the team and made sense for the value it provided.

Before choosing Snyk, we looked at a few alternatives, such as SonarQube and GitHub Advanced Security, which we were actually using previously. We switched to Snyk because we thought it would be easily integrated into our developer workflow. Snyk has very useful features and was particularly beneficial during the Mythos upgrade, leading us to switch to Snyk across the teams.

My advice would be straightforward: start with a clear use case and test Snyk in the workflow where your developers actually work. It is strongest when it is used early in the SDLC, especially for application upgrades, dependency checks, and fixing security issues before they reach production. I also suggest using it in a real project first, not just a demo, and paying attention to the dependency intelligence and fixed guidance because that is where it saves the most time. Evaluating Snyk on a real project and focusing on how well it fits into your daily development workflow is key. It is especially useful for catching vulnerabilities early, so the more closely you integrate it into your process, the more value you get. I would rate Snyk an 8 out of 10 overall.

We are a customer of Snyk, which is a SaaS solution. We are one of the tenants using Snyk services but are not doing any enhancement development. We are purely a customer availing Snyk services.

We are also using a separate DAST tool, though I am not aware of the tool name as it is managed by a different team.

We utilize two main capabilities: application vulnerability detection and SCA capabilities. The primary reason we use Snyk is for SAST, as we want to scan our applications for any security vulnerabilities and address them.

Snyk is finding all the issues we have. It suggests solutions for every vulnerability, and we are getting patches frequently. As someone from an enterprise, I want to share feedback that might help others. There are multiple teams involved in our organization. We have a separate cyber team that works with Snyk and keeps on updating, though I am not fully aware of all the details in that area.

I have not explored from that perspective. Being from an application perspective, I cannot say anything that needs real improvement. I have not explored from that angle. Till now, we did not face any scaling issues and I did not hear of any. I would rate this at 9 because I always keep one number in reserve, as there is always scope for improvement for any tool.

We have been using Snyk for more than a year.

Till now, we did not face any scaling issues and I did not hear of any. I would rate this at 9 because I always keep one number in reserve, as there is always scope for improvement for any tool.

We do not raise issues directly with Snyk. We have a common team that liaises with Snyk. Whenever we have issues, we raise them with the cybersecurity team within our company who supports Snyk, and they in turn interact with Snyk.

Positive

Earlier, I used Checkmarx, which is another SAST tool. By default, any company and any SAST tool like Checkmarx or Snyk provides a plugin.

Snyk is integrated. I have not used it directly, though I may have used it indirectly.

I am from an enterprise and want to share feedback that might help others. There are multiple teams involved in our organization. I am from the application team, so I know the vulnerabilities and how to fix them. However, there is a platform team that takes care of giving permission for Snyk and access levels, which I am not fully aware of. At a high level, we have a Snyk admin team in our company that gives permissions, though I do not know all the details of what they do. I cannot share feedback on the admin area, but I can share that vulnerability-wise, I am happy with what Snyk provides and the solutions it gives.

When Snyk identifies issues, our pull request process will not allow us to merge them in the first place. Snyk helps us by blocking critical issues and vulnerabilities. If someone bypassed the pull request check, we have another check in place before production release where we validate everything and block the code if it violates our standards. Based on Snyk categorization, we block issues from our end while raising a pull request and also before releasing to production.

We need Snyk because we are in the banking industry with thousands of applications. Every day, we deploy code to production, releasing almost every day except weekends, though we sometimes release on weekends for very large deployments. Anything that goes to production should not have any security vulnerabilities. Being in the banking industry and having applications used by end customers, we are dealing with end customer data. No one should steal data in any format, and with authentication, one user cannot see another user's data. Snyk is paramount and extremely important for us. Every application that goes into production must pass Snyk vulnerability scanning before it can be deployed. If you ask whether it is important, it is absolutely critical. I would rate it 10 out of 10.

Internally, whenever a Snyk scan runs, we have created GitHub Actions. Our target state is GitHub Actions everywhere. When we run the GitHub Actions, it will connect to the latest Snyk scanning through API and automatically gets all open issues, then creates a GitHub issue. First, our internal tool pulls out all Snyk security issues through the API and creates GitHub issues. We manually open a GitHub issue and give a command prompt to our AI agent. That prompt internally might work with Snyk autofix capability and gets the fixes correctly and creates a pull request. We review and check in the pull request, which is reviewed by experienced team members. This is the process we follow: create an issue based on a Snyk scan and for every issue, run a prompt so that it creates a pull request automatically with the fixes.

We do use Snyk documentation. We internally do not have many resources because we do not want to duplicate. Snyk guide is purely open and not logged in, so we use it.

Snyk documentation is extremely useful. Vulnerability-wise, I do not go to Snyk documentation frequently because in the current world, with my 25 plus years of experience, I used to fix many things manually before these tools existed. I need to know the intricacies of how to fix code. If you take 10 years back, there were tools and libraries which you could integrate with one or two lines, which solved the problem. With the current AI world, I do not even need that. If I get some issues, I do not even need to go to the Snyk website and read how to fix. I have an AI tool that can fix it if I ask it to. From an engineer's perspective, I still read the documentation. As a person who came from the manual world 25 years back, I still read the fix documentation. The documentation is very good, and being a general one, I understand the SAST world, so I did not find much problem with the documentation.

We are using Snyk, which is a SAST tool. There is a team in our organization who developed some AI agent on top of Snyk capabilities. I do not know exactly how they integrated Snyk, but our organization provides an AI agent which, if we run, automatically fixes issues and raises a pull request. In that case, we are indirectly using Snyk.

My overall rating for Snyk is 10 out of 10.

The best feature of Snyk is the integration with our ticketing system, which is Jira. That integration was one we were specifically looking for. The deep integration with our IDE and repository is another valuable feature. In terms of deploying these features, it's seamless.

Snyk should improve the scanning capabilities for other languages. For example, Veracode is strong with different languages such as Java, C#, and others. However, Snyk performs better at mobile source code scanning compared to Veracode. If both capabilities were combined, that would be exceptional.

As we are moving toward GenAI, we expect Snyk to leverage AI features to improve code scanning findings. One key feature we are currently examining with Veracode is AIVSS (Artificial Intelligence VSS), which is an extension of CVSS to cover use cases or top 10 LLM findings during code scanning. Since this is relatively new, we expect upcoming features to cover AI scoring. We have AI projects currently deploying in our organization, and we want to cover not only normal CVSS but also receive an AI assessment score. Both Veracode and Snyk should implement this new scoring system for CVSS and AIVSS.

We are a customer of Snyk, not a partner.

We have contacted Snyk's technical support regarding several issues, and they have resolved them successfully.

Snyk's technical support deserves a rating of seven or eight out of ten. Their response time aligns with their SLA commitments.

Positive

My previous company continues to use Snyk.

The initial setup of Snyk was straightforward.

We discussed pricing with their account manager and secured a favorable deal. Initially, we planned to subscribe through AWS Marketplace at standard rates. After negotiations, we received a special package with a good price point. We signed a two-year contract, and they provided special links for subscription. The payment structure operates on a monthly prepaid basis.

While Snyk may not be the absolute best option in the market, it offers the most seamless experience currently available. Based on their price point and features, it's both affordable and fair considering the license package offered.

During our implementation, we conducted a pilot test with Snyk for approximately two weeks during our UAT session. We spent an additional two to three weeks obtaining management approvals for production repository access. The testing was performed on development repositories before moving to production. While the actual implementation took about a week, the complete process duration was extended due to internal organizational approval processes.

I rate Snyk 8 out of 10.

I lead a code security practice for our organization. We integrated Snyk into our GitHub, using CLI to automatically scan codebases and identify issues. We are a large organization with three independent entities, consolidating Snyk across all entities. 

We also provide access through numerous CI/CD tools. Our default implementation mechanism is CLI, but we also use the Web UI for a comprehensive view and recommendations.

For large organizations like ours, cost is a major factor. Snyk is the most cost-effective solution compared to others like Checkmarx. 

We consolidated Snyk across three entities that used different tools. As a result, our organization became one of the largest in implementing Snyk.

The most important feature of Snyk is its cost-effectiveness compared to other solutions such as Checkmarx. It is easy to consolidate Snyk across multiple entities within a large organization. 

Additionally, our integration of Snyk into GitHub allows us to automatically scan codebases and identify issues, which has improved efficiency.

Snyk has several limitations, including issues with Gradle, NPM, and Xcode, and trouble with AutoPR. It lacks the ability to select branches on its Web UI, forcing users to rely on CLI or CI/CD for that functionality. These limitations were documented in a book that I wrote.

We implemented Snyk starting last year, and it has been in use for around two and a half years.

Snyk allows for scaling across large organizations, accommodating tens of thousands of applications and over 60,000 repositories, making it suitable for wide-scale deployment.

Our organization maintains a good relationship with Snyk's customer support team. Despite potential variations in service quality for smaller organizations, our long-standing association has ensured smooth communication, resulting in favorable support experiences and satisfactory issue resolution.

Positive

Previously, we used Synopsys Coverity and later migrated to Checkmarx and Mend before Snyk. Synopsys Coverity was costly, prompting a switch. Snyk's affordability and consolidating capabilities across the entities led to its adoption.

The initial setup of Snyk is simple and straightforward compared to Synopsys Coverity, which is complex. Checkmarx falls in between, not too complicated or easy, but a reliable option. Snyk's ease of implementation makes it user-friendly.

We have different teams managing aspects like licensing and engagement with the support team. They facilitate setup and maintenance, optimally integrating Snyk into our GitHub and CI/CD processes.

Snyk is recognized as the cheapest option we have evaluated. In comparison to eight or nine other solutions, it ranks among the most affordable, providing cost-effective scalability across organizational units.

In my comparative evaluations, I considered tools like AppScan, Veracode, Checkmarx, Synopsys Coverity, and six to eight other alternatives.

Snyk is optimal for organizations starting or looking for an affordable, effective tool. Despite false positives, it combines SAST, SCA, containers, and IaS in one Web UI. On a scale of one to ten, I rate Snyk at six.

The most recent client had experience with other products that did not have some features Snyk provides, such as Fortify in the old version before OpenText acquisition. They gave feedback about the precision in discovering vulnerabilities. They found that Snyk can provide more insights about vulnerabilities than older applications in SAST and SCA.

We have integration with GitHub Actions to analyze the code and we use a double check in the pipeline. Our strategy is about shift left. The developers connect with Snyk, Git, and use this with the pipeline.

They evolved their maturity because they could find the vulnerabilities before the pipeline runs. They can find and correct these vulnerabilities in a step before the pushes and PRs to GitHub. They think it is a very positive feature.

I appreciate the UI. It is simple, fast, and I value the precision in the tests. The responses are positive.

Regarding the vulnerability database and AI, we have good experience with that. I cannot compare with other providers or vendors such as Veracode, Checkmarx, and others. All the tests are positive in my analysis.

Technically, we have better vulnerabilities detection in Checkmarx and Veracode. Both of them are more precise about vulnerabilities detection. Snyk is slightly less effective, but this is something they can improve on in the future.

We have been using the solution for one and a half years. Not much time.

We did not need support during the proof of concept.

The documentation is good. It is one of the reasons we did not need support. We could understand the implementation of the product and other features without the need for human interaction.

Positive

I made a proof of concept for a client with Checkmarx for about one month. I provided them a review about my experience. Now they are analyzing my results and considerations about other products too. I do not know if they already have a response about which product they will buy.

Snyk is less expensive.

It is simpler than other vendors. We have some difficulties with other license models. They are more complex and involve an acquisition of more products such as Synopsys and Checkmarx used a complex license model. Snyk has a license model simpler than most of the other vendors.

It was one of my three recommendations for my client. I am satisfied with the product. I rate Snyk 8.5 out of 10.

My main use case for Snyk is to identify security vulnerabilities in application code and dependencies during the development lifecycle, before the code is deployed to production.

Once developers develop and push code to the repository, Snyk can scan the code and identify potential vulnerabilities early in the development process. Before implementing Snyk, we did not have a dedicated tool to identify vulnerabilities before deployment. This meant that some security issues could only be identified after the application was already deployed, where tools such as CrowdStrike could help detect security-related issues at the endpoint or runtime level.

With Snyk, we can shift security testing earlier in the Software Development Lifecycle (SDLC). Developers can identify and address vulnerabilities while they are developing and testing the application, rather than discovering them after deployment.

This is particularly important because we want to minimize the risk of security issues reaching production. Fixing vulnerabilities after deployment can potentially impact production environments and, ultimately, our customers. By integrating Snyk into our development and CI/CD process, we can identify vulnerabilities earlier, give developers an opportunity to remediate them before release, and improve the overall security and stability of our applications.

In summary, our primary goal is to shift security left by identifying and remediating vulnerabilities before code reaches production, reducing production risk and protecting our customers.

Snyk has had a significant positive impact on our organization by allowing us to identify and address security vulnerabilities earlier in the software development lifecycle. Before implementing Snyk, we did not have a dedicated tool to identify vulnerabilities in our code and dependencies before deployment.

After implementing Snyk, we were able to shift security testing to the development stage, allowing developers to identify and remediate vulnerabilities before the code reaches production. This has helped us reduce security risks, improve the overall quality of our code base, and avoid the additional time and effort involved in resolving vulnerabilities after deployment.

One of the most significant benefits has been the reduction in vulnerabilities across our services and dependencies. Previously, we were dealing with approximately 800–900 vulnerabilities across the dependencies used by our services. After implementing Snyk and following its recommendations, we have reduced these vulnerabilities by approximately 80–90%.

The remaining vulnerabilities are primarily associated with applications and code running on older infrastructure. We are actively working on migrating and modernizing these components, using Snyk's recommendations to identify the required remediation actions and prioritize improvements.

Overall, Snyk has helped us establish a more proactive security approach, reduce security-related incidents, improve code quality, and save development and operational time by addressing vulnerabilities before they reach production

These integrations are particularly valuable for our day-to-day development and security processes because they allow us to integrate vulnerability scanning directly into our existing development and CI/CD workflows. We can scan our code base and dependencies without requiring developers to use a completely separate process or tool. This makes security testing more seamless and helps us identify vulnerabilities before they reach production.

The ability to identify vulnerable dependencies is another feature I find very useful. Snyk not only identifies potential vulnerabilities but also provides recommendations that help developers understand the issue and determine the appropriate remediation approach. This makes it easier for our team to prioritize and resolve security issues.

From a usability perspective, I find Snyk straightforward and easy to work with. The dashboard provides clear visibility into vulnerabilities and helps us understand the overall security posture of our applications.

I also value Snyk's approach to security and data protection, particularly its focus on protecting customer data and maintaining appropriate security and privacy controls. This gives us additional confidence when using the platform as part of our development security process.

Regarding Snyk's AI capabilities, I find the results consistent and useful for supporting developers with security-related tasks. AI can help developers analyze issues and identify potential remediation approaches more efficiently, reducing the manual effort required. For us, this makes the overall vulnerability-management process faster and more effective while still allowing developers to review and validate the recommended actions.

Overall, the combination of CLI capabilities, CI/CD integrations, dependency analysis, ease of use, clear visibility, and AI-assisted security workflows makes Snyk a valuable tool for our development and security teams.

I think Snyk is already a strong and straightforward solution, particularly for organizations that want to identify vulnerabilities and dependency issues as early as possible in the development lifecycle. For small and mid-sized organizations, Snyk provides an effective way to introduce security scanning without making the development process overly complex.

The main area where I see an opportunity for improvement is pricing and licensing flexibility. While Snyk provides a strong set of features and I believe the functionality justifies the cost, more flexible pricing options could make the platform more accessible to smaller organizations and teams with limited security budgets.

For example, offering more flexible plans based on team size, usage, repositories, or scan volume could help smaller organizations adopt Snyk more easily and expand their usage as their environment grows.

Overall, I am satisfied with the product and its capabilities. My primary recommendation would be to make the pricing model more flexible while continuing to maintain the current level of security features and functionality.

I have been using Snyk for around one year.

Yes, based on our experience, Snyk has been stable and reliable in our environment.

Since deploying Snyk, we have been able to use it consistently across our development and CI/CD workflows, including our code repositories, Snyk CLI, Jenkins pipelines, and Docker/container environments. We have not experienced significant stability issues that have affected our development or deployment processes.

The scanning process is straightforward, and the integration with our existing development tools has worked reliably. This is important for us because security scanning needs to be part of the development lifecycle without becoming a bottleneck for developers or delaying deployments.

Another positive aspect is the consistent visibility Snyk provides into vulnerabilities and dependencies. We can continue monitoring the code base, identify newly introduced vulnerabilities, and track remediation without having to change our workflow significantly.

Overall, based on our experience, Snyk has been a stable and dependable part of our application security process, and we have been able to use it consistently as our security requirements have grown.

I would rate Snyk's scalability very highly. In our environment, Snyk has been easy to integrate into our existing development and CI/CD workflows, and it can scale as the number of repositories, developers, applications, and dependencies increases.

One of the biggest advantages is that Snyk can be integrated at multiple levels, including the developer's local environment, Snyk CLI, source-code repositories, Jenkins CI/CD pipelines, and Docker/container workflows. This allows us to maintain the same security approach as our development environment grows without requiring a completely different process for each application or team.

Snyk also provides centralized visibility into vulnerabilities and dependencies, which makes it easier for us to identify trends, prioritize risks, and track remediation across multiple projects. As we add more applications or repositories, we can continue applying the same vulnerability scanning and security practices.

For us, scalability is not only about handling more code. It is also about being able to scale security practices across the organization without significantly increasing operational complexity. Snyk has performed well in this area and fits our development environment as we continue to expand.

Overall, I would consider Snyk highly scalable for organizations that want to grow their application security program while keeping vulnerability management integrated with the existing development and CI/CD processes.

I would evaluate Snyk's customer service and technical support positively. In our experience, the support has been responsive and helpful when we have needed assistance with the platform, integrations, or technical questions.

The documentation and available technical resources are also useful for troubleshooting and understanding how to configure Snyk within our development and CI/CD environment. This makes it easier for our team to resolve common issues independently.

Since we are using Snyk under an Enterprise licensing model, having access to appropriate technical support is important to us. Overall, we have had a good experience with Snyk's support, and it provides the level of assistance we expect from an enterprise security platform.

No. We were not using any other dedicated solution for vulnerability scanning before implementing Snyk. We adopted Snyk as our first dedicated solution to identify vulnerabilities in code and dependencies during the development lifecycle.

The initial setup was straightforward and relatively easy. Snyk integrates well with our existing development and CI/CD environment, so we did not need to make significant changes to our infrastructure or development processes.

We were able to integrate Snyk with our code repositories, Jenkins, Snyk CLI, and Docker/container environment and start scanning our code and dependencies for vulnerabilities.

The setup process was easy to understand, and the dashboard provided good visibility into the identified vulnerabilities and dependencies. Once the integrations were configured, our developers could incorporate Snyk into their existing development workflow without significant disruption.

Overall, I would describe the initial implementation as simple, well documented, and easy to manage, particularly for an organization that already has an established CI/CD environment.

We are using Snyk under an Enterprise licensing model, which makes deployment and licensing management relatively straightforward for our organization. Since we have enterprise licensing, we do not have to manage separate licensing or deployment arrangements for individual users or environments.

We purchased Snyk directly from Snyk through an enterprise agreement, rather than through the AWS Marketplace or another third-party channel.

Overall, the setup and licensing experience has been straightforward, and the enterprise model provides the flexibility we need to integrate Snyk across our development and security workflows.

We evaluated different approaches and security solutions for identifying vulnerabilities in application code and dependencies, but Snyk stood out as the best fit for our requirements.

The main reason we selected Snyk was its ease of integration with our existing development and CI/CD environment, particularly with Jenkins, GitHub, Bitbucket, Docker, and the Snyk CLI. We wanted a solution that could be integrated into the development process without adding significant complexity for our developers.

Another key advantage was Snyk's ability to identify vulnerabilities in both the code and its dependencies at an early stage. The vulnerability information and remediation recommendations also made it easier for developers to understand and address the identified issues.

Some alternative approaches and tools can provide vulnerability scanning, but we found that they either required more effort to integrate into our existing workflow or did not provide the same combination of developer-focused security, dependency analysis, ease of use, and CI/CD integration that we were looking for.

Overall, Snyk provided the best balance of security coverage, ease of implementation, developer usability, and integration with our existing environment, which is why we selected it.

I would rate Snyk 10 out of 10 overall.

Snyk is a strong fit for our use case because of its integration with our development environment, code repositories, local development editors, Snyk CLI, and Docker workflows. The ability to identify vulnerabilities early in the development lifecycle, including vulnerabilities in dependencies and container images, has helped us improve our code base and reduce security risks before applications reach production.

Snyk is already deployed and actively used within our organization, and it has become an important part of our development and security process.

My advice to other organizations, particularly small and mid-sized organizations, is to consider Snyk if they want to improve their application security without making the development process overly complicated. Snyk can help teams identify vulnerabilities in their code and dependencies at an early stage, understand remediation requirements, and track vulnerability trends over time.

For organizations looking to improve code quality, reduce dependency-related risks, and build security into the development lifecycle, I would strongly recommend Snyk.

The main tool today is used to check for security issues in our products. We use it to analyze all the projects, and our security efforts are based partly on this tool.

There are major impacts related to increasing security awareness and managing risks. Snyk has been an essential tool in that aspect.

The valuable aspect is its security capabilities. The tool finds any major issue, and the code is blocked from being promoted to production until the issue is corrected.

I'm not responsible for the tool. As far as I know, there are no major concerns or features that we lack. We had some issues integrating into our pipeline, however, they were resolved.

We have used Snyk for approximately one year.

There are no complaints from the security team. There seem to be no major issues of concern.

The security team is responsible for this tool. I don't have more details, however, there are no complaints, so I believe that's okay.

I don't know about the support or customer service details. It's another team's responsibility.

Positive

I don't have experience with other products similar to Snyk.

I wouldn't be able to say what the company's ROI is.

The pricing and setup are not my responsibilities, so I don't know any details.

I have not evaluated any other solutions.

Based on our experience and what I have heard internally, I would recommend Snyk.

I'd rate the solution nine out fo ten.

We are using an enterprise version of Snyk for image scanning. We use Snyk to identify and address vulnerabilities in our open-source dependencies and to scan the Docker images.

The solution's Open Source feature gives us notifications and suggestions regarding how to address vulnerabilities.

The solution's integration with JFrog Artifactory could be improved.

We have been using Snyk for two years.

I rate the solution an eight out of ten for stability.

We use Snyk for microservices, and more than 100 users use it in our organization twice a week.

I rate the solution a seven out of ten for scalability.

The solution’s technical support team was involved during the architecture integration. We got their support, but I think we could probably get a faster response from them.

Neutral

Snyk's initial setup is not very difficult.

On a scale from one to ten, where one is difficult and ten is easy, I rate the solution's initial setup a seven out of ten.

The solution's initial setup took a few weeks. The solution's deployment was done by our app system, and four people were highly engaged in this activity.

Before choosing Snyk, we were exploring different solutions like JFrog Xray and Aqua scan for image scanning. We chose Snyk because we could do both image scanning and SCA with it.

We are comparing Snyk with GitHub Advanced Security, which has a better vulnerability database. They have more vulnerabilities enlisted in their database.

The solution has improved or streamlined our process a lot for securing container images. We wanted to make sure we are deploying the secure Docker images. Snyk allowed us to check whether it is following our standard of docker images or not.

We use Azure DevOps as our platform, and Snyk's integration with Azure DevOps was okay. However, Snyk's integration with JFrog Artifactory didn't go well. We use JFrog Artifactory to store the artifacts we download. We wanted to integrate Snyk with JFrog Artifactory to scan the binary artifacts we downloaded, but that broke our JFrog Artifactory for some reason. Instead of using it there, we are calling it directly from the pipeline.

Snyk's automation features significantly reduced remediation times a couple of times. Sometimes, our developers scan the code from the environment and find some Java vulnerabilities. We fixed those vulnerabilities in the lower environment itself. The solution does not require any maintenance.

The accuracy of Snyk's vulnerability detection is pretty good compared to other tools. I rate the solution's vulnerability detection feature an eight out of ten. I would recommend Snyk to other users because it is easy to implement and integrate with Azure DevOps and GitHub.

Overall, I rate the solution a seven out of ten.