What do users say about Snyk?

For our .NET work, Snyk became much more useful once we stopped treating security as something that happens after development. Snyk Open Source integrates well with NuGet and Paket, understands project.assets.json, solutions, and project files, and can generate Fix PRs for supported NuGet dependencies. That alone saves us from discovering vulnerable packages during a later audit, when the person who introduced the dependency may not even be on the same project anymore. We also use Snyk Code for SAST across C# and VB.NET. In one review, it traced a request value through several methods until it reached a database query that didn’t have enough sanitization. Being able to see the full source-to-sink path was far more useful than a generic “possible SQL injection” warning that gives no clue how the value got there. Inter-file analysis is especially important in .NET because the risky part rarely lives in the same method where the input first enters the application. In CI, we run snyk test and snyk code test, and the IDE plugin catches many issues before a pull request even exists. That combination has done more for adoption than any security dashboard. Developers respond much better when a finding shows up right next to the code they’re already changing, instead of arriving three weeks later in a spreadsheet from another team. Review collected by and hosted on G2.com.

Some dependency setups require pinning explicit versions to get Fix PRs to work. Also, packages-lock.json isn’t supported by Snyk Open Source, and legacy projects may fall back to static resolution, where private dependencies or build-specific behavior are harder to capture accurately. None of this has stopped us from using the tool, but older solutions still need more manual verification than modern SDK-style projects. I’d like the gap between a current ASP.NET Core service and a mixed legacy repository to be smaller, especially when both live in the same organization and are expected to follow the same security policy. Review collected by and hosted on G2.com.

What I like best about Snyk is how it integrates security into the developer workflow without disrupting it. The VS Code and JetBrains plugins give real-time vulnerability feedback as I write code, cutting remediation time significantly. Instead of just flagging a CVE, Snyk tells you exactly which version to upgrade to and often opens a fix PR automatically, saving hours of manual cross-referencing. The dependency graph makes transitive vulnerabilities easy to understand, and the reachability analysis means we focus on what's genuinely exploitable rather than drowning in false positives.

Performance-wise, scans run fast even on large monorepos, and the dashboard stays responsive without lag, it never feels like a bottleneck in the CI pipeline.

On pricing and ROI, the value becomes clear quickly. Catching vulnerabilities pre-deployment rather than post-production saves significant incident response costs, and the free tier is generous enough for smaller teams to see real value before committing. Onboarding was smooth too, connecting GitHub repos took minutes and gave us an immediate risk picture. It feels like a security tool built for developers, which makes adoption across engineering teams much easier. Review collected by and hosted on G2.com.

A few friction points stand out. The noise from low-severity vulnerabilities can be overwhelming, especially on larger projects, while prioritization helps, tuning the filters to fit your specific risk tolerance takes time and trial and error. The licensing issue detection, though useful, sometimes flags things that aren't actually a concern in your use case, adding to that noise.

Pricing can become a pain point as teams scale. The jump between tiers feels steep, and some features that feel essential, like deeper reporting or SSO, are locked behind higher plans, which can be frustrating for mid-sized teams trying to justify the upgrade.

Occasionally the fix suggestions aren't actionable because the recommended version introduces breaking changes, so you still end up doing manual research. It would be more helpful if Snyk flagged compatibility risks alongside the fix recommendation. The Snyk Code (SAST) results can also feel less mature compared to the SCA side, more false positives and less context around why something is flagged.

Overall these are manageable drawbacks, but they do add friction for teams trying to run lean. Review collected by and hosted on G2.com.

Snyk stands out because it keeps application security simple and developer-friendly by integrating directly into the development workflow. It not only identifies vulnerabilities across code, dependencies, and containers, but also offers clear, automated fixes that help teams resolve issues faster and build secure software from the start. Review collected by and hosted on G2.com.

Snyk can sometimes produce false positives and generate too many alerts, which can overwhelm teams and force a lot of manual validation. It can also become expensive at scale, and some areas especially documentation and integrations could use improvement. Review collected by and hosted on G2.com.

Snyk integrates seamlessly with GitHub, AWS, ECR, and Artifactory to provide a seamless devsecops experience for developers and release engineers. One of the best things that I like about Snyk is its ability to push vulnerability patches via PR on its own (if enabled). Other features include reachability and exploitability intelligence that provides us with surgical data to act upon, reducing vulnerability overload and cutting noise. The newer analytics and reports section allows us to determine SLA and breach timelines for each vulnerability Review collected by and hosted on G2.com.

We have seen that Snyk UI and Snyk CLI have misleading results in some cases. While this is not true for most of the cases, we have seen ~2-3% of cases where such anomalies have caused confusion amongst developers. Review collected by and hosted on G2.com.

I like that Snyk easily runs scans and even provides the versions in which vulnerabilities are fixed. This feature is valuable because it helps me identify security risks or bad implementations in my code changes without having to test and update my code and dependencies manually. I also appreciate the easy setup process; the extension for Snyk is available in Visual Studio Code, and after downloading it, I just needed to sign up and authenticate my project. Review collected by and hosted on G2.com.

I've seen that Snyk does not do that well with the vulnerabilities that are related to licensing. Review collected by and hosted on G2.com.

Snyk is easy to set up and start using. Setting it up to run as a GitHub Action allows it to integrate seamlessly alongside other existing CI processes. Along with this, I like that its vulnerability scanning is pretty much universally trusted amongst engineers, this trust allows for peace of mind. Review collected by and hosted on G2.com.

This might have changed since the last time I worked with this product, but at the time Snyk was a bit expensive compared to similar products. Review collected by and hosted on G2.com.

What I appreciate most about Snyk is its "Reachability" feature. This means that if a vulnerable or exploitable library or package is imported in the code but not actually called or used, it is identified as a false positive and does not require remediation. However, this feature is only available in the paid subscription, not in the free version. It significantly reduces the time the VAPT team spends validating issues, and also helps the DevOps team address problems more efficiently.

Another aspect I value is how quickly Snyk adapts to new CVEs. If a zero-day exploit appears, Snyk updates its CVE database within a maximum of 24 hours, helping to keep the code secure. Review collected by and hosted on G2.com.

After some months of project being imported, scanned, and tested, snyk starts providing false-positives issues as well. Review collected by and hosted on G2.com.

Easy to set up and very beginner-friendly. That said, it can still feel complicated when you start working with different modules. Review collected by and hosted on G2.com.

The documentation isn’t up to date, which leads to some issues during setup. Review collected by and hosted on G2.com.

Helps in developing custom codes with increased level of security and safeguard from external factors. Review collected by and hosted on G2.com.

Can be little complicated in terms of manoeuvring through different modules Review collected by and hosted on G2.com.

Snyk's product features a highly intuitive GUI, making it straightforward to identify and address vulnerabilities. The platform allows you to organize developers into Orgs, which is helpful for ensuring that only specific development teams can view the vulnerabilities related to their own products. This structure also enhances the reporting capabilities. Integration with GitHub Cloud is relatively simple; you can use a GitHub app to onboard individual repositories to team orgs. Implementation is also quite manageable, provided you know which teams are responsible for which repositories and the products or services they support. Customer support is accessible online through the portal, making it easy to submit a ticket or arrange a call when needed. Snyk is fairly customisable per org too, allowing you to decide which settings you want to enable on a per team / product basis, so you can get quite granular in terms of what PR's get raised for which activities. Feedback is also provided in GitHub itself, which is useful for the developers. Review collected by and hosted on G2.com.

It's DAST product is in a seperate interface and not integrated into the Snyk product itself, I beleive this was due to it being an acquisition. Equally, their secret detection capability is not very good and they don't focus on code quality so you will need a different product for that. Review collected by and hosted on G2.com.