Korthex vs Semgrep

Semgrep is a fast, customizable pattern-based SAST. Korthex is crypto-specialized: it follows values across import hops, builds cross-engine attack-paths, exports a CBOM with post-quantum readiness, generates a migration plan, and proves weak crypto by emulation against NIST KAT. Honest comparison on cryptography.

Semgrep is a fast, hackable rule engine whose Pro engine adds genuine cross-file taint analysis, plus a secrets product that validates live credentials across hundreds of credential types. Korthex is not a rule engine you maintain - it specializes in cryptography out of the box: following values across import hops, correlating across engines, exporting a CBOM, planning the migration, and proving weakness by emulation.

Axis by axis on cryptography: cross-engine attack-paths vs rule-based per-scan findings; cryptographic value tracking vs injection-focused cross-file taint analysis; key-provenance classification vs validated secrets detection; CBOM-PQC export vs no cryptographic inventory; a dependency-ordered migration plan vs finding-level guidance and autofix rules; and offensive verification against NIST Known-Answer Tests. Comparison based on public vendor documentation as of 2026-07-10.