Semmle

Semmle, founded in 2004 by Oege de Moor, Pavel Avgustinov, and Julian Tibble, emerged from academic research at the University of Oxford.

Reviewed by 7wData
Share Email

On this page

Profile

Semmle provides semantic code analysis tools to identify vulnerabilities and coding patterns in large software projects.

Semmle, founded in 2004 by Oege de Moor, Pavel Avgustinov, and Julian Tibble, emerged from academic research at the University of Oxford. The company specializes in semantic code analysis, enabling developers to identify vulnerabilities and patterns in large codebases. Semmle's flagship product, QL, is a query engine that allows developers to write declarative queries to search for coding errors and security vulnerabilities.

The company gained significant traction in the enterprise market, with notable clients including Google, Microsoft, NASA, and Uber. Semmle's technology has been instrumental in discovering critical vulnerabilities, including the Apache Struts vulnerability that led to the Equifax breach. In 2019, Semmle was acquired by GitHub, marking a strategic move to integrate its semantic code analysis capabilities into GitHub's security offerings.

Post-acquisition, Semmle's LGTM platform, which stands for 'Looks Good to Me,' became a key component of GitHub's security suite, helping developers and security teams identify and mitigate risks in their codebases. Semmle's approach combines object-oriented programming and database logic, enabling deep semantic code search that has been widely adopted by security researchers and developers alike. The company's technology is backed by over 100 patents and a decade of research, making it a trusted tool in the software development lifecycle. Despite its success, Semmle faces challenges in scaling its technology across diverse codebases and maintaining its competitive edge in a rapidly evolving security landscape.

Track Semmle and 240+ vendors.

48k+ subscribers read the daily AI & data note. One email, both newsletters. Unsubscribe anytime.

Who buys this

  • Large technology companies
  • Financial services firms
  • Government agencies
  • Open source communities
  • Enterprise software developers

Publicly disclosed clients

  • Google
  • Microsoft
  • NASA
  • Uber

Strengths and what to watch

Strengths

  • Backed by over 100 patents and a decade of research
  • Trusted by major enterprises for critical vulnerability detection
  • Community-driven approach to improving code safety

Watch for

  • Integration challenges post-GitHub acquisition
  • Competition from emerging code analysis tools
  • Maintaining innovation in a rapidly evolving security landscape

Key Information

Founded
2004

Frequently Asked Questions

What is Semmle and what does it do?

Semmle provides semantic code analysis tools to identify vulnerabilities and coding patterns in large software projects. Founded in 2004, its QL query engine lets developers write declarative queries to find errors. Acquired by GitHub in 2019, its LGTM platform now integrates with GitHub's security suite.

How does Semmle's QL query engine work?

Semmle's QL is a declarative query language that analyzes code semantics rather than just syntax. Developers write queries to search for vulnerabilities across entire codebases. It combines object-oriented programming with database logic, backed by 100+ patents from Oxford research. Used by Google and NASA.

Which companies use Semmle for code analysis?

Semmle's notable clients include Google, Microsoft, NASA, and Uber. Its technology detects critical vulnerabilities in enterprise codebases, like the Apache Struts flaw behind the Equifax breach. Financial services and government agencies also rely on its semantic analysis for secure development.

What happened to Semmle after GitHub acquired it?

GitHub acquired Semmle in 2019, integrating its LGTM (Looks Good To Me) platform into GitHub's security offerings. The technology now helps developers identify risks during code review while maintaining Semmle's patented query capabilities and research-backed approach.

What makes Semmle different from other code analysis tools?

Semmle's semantic approach analyzes code meaning rather than just patterns. Its QL engine allows custom vulnerability queries across languages, backed by Oxford research. Unlike static analyzers, it finds complex, context-dependent flaws that others miss, as demonstrated in high-profile breach discoveries.

What challenges does Semmle face in code security?

Post-acquisition, Semmle must scale its technology across GitHub's diverse codebases while maintaining innovation. Competition grows as new analysis tools emerge. Its challenge: preserve deep semantic capabilities while integrating seamlessly into developer workflows at GitHub's massive scale.

Sources

  1. techcrunch.com — Semmle's Series A funding round led by Accel Partners
  2. www.prnewswire.com — Semmle's Series B funding and global launch
  3. github.blog — GitHub's acquisition of Semmle
  4. blog.semmle.com — Semmle's technology and community-driven approach