Snyk Runtime Sensor

What do you like best about the product?

It provides clear visibility into the code that’s deployed, which helps us understand what’s running and ensures it meets our desired security standards.

What do you dislike about the product?

The auto-imports and overall cost, including open-source scanning, don’t feel optimised. Also, the results contains false positives which can create ambiguity

What problems is the product solving and how is that benefiting you?

It can be beneficial because it alerts me when new CVEs are published, and it also suggests solutions for the vulnerabilities it identifies.

What do you like best about the product?

What I like best about Snyk is how it integrates security into the developer workflow without disrupting it. The VS Code and JetBrains plugins give real-time vulnerability feedback as I write code, cutting remediation time significantly. Instead of just flagging a CVE, Snyk tells you exactly which version to upgrade to and often opens a fix PR automatically, saving hours of manual cross-referencing. The dependency graph makes transitive vulnerabilities easy to understand, and the reachability analysis means we focus on what's genuinely exploitable rather than drowning in false positives.
Performance-wise, scans run fast even on large monorepos, and the dashboard stays responsive without lag, it never feels like a bottleneck in the CI pipeline.
On pricing and ROI, the value becomes clear quickly. Catching vulnerabilities pre-deployment rather than post-production saves significant incident response costs, and the free tier is generous enough for smaller teams to see real value before committing. Onboarding was smooth too, connecting GitHub repos took minutes and gave us an immediate risk picture. It feels like a security tool built for developers, which makes adoption across engineering teams much easier.

What do you dislike about the product?

A few friction points stand out. The noise from low-severity vulnerabilities can be overwhelming, especially on larger projects, while prioritization helps, tuning the filters to fit your specific risk tolerance takes time and trial and error. The licensing issue detection, though useful, sometimes flags things that aren't actually a concern in your use case, adding to that noise.
Pricing can become a pain point as teams scale. The jump between tiers feels steep, and some features that feel essential, like deeper reporting or SSO, are locked behind higher plans, which can be frustrating for mid-sized teams trying to justify the upgrade.
Occasionally the fix suggestions aren't actionable because the recommended version introduces breaking changes, so you still end up doing manual research. It would be more helpful if Snyk flagged compatibility risks alongside the fix recommendation. The Snyk Code (SAST) results can also feel less mature compared to the SCA side, more false positives and less context around why something is flagged.
Overall these are manageable drawbacks, but they do add friction for teams trying to run lean.

What problems is the product solving and how is that benefiting you?

Snyk solves the core problem of security being an afterthought in the development lifecycle. Before using it, vulnerabilities were typically caught late, during dedicated security audits or worse, post-deployment, making fixes costly and disruptive. Snyk shifts that detection to where the code is actually written, which changes the economics of security entirely.
The biggest benefit has been reducing the gap between vulnerability discovery and remediation. Developers get context-rich alerts in their IDE and PRs rather than a spreadsheet from a security team weeks later, which means fixes happen faster and with less back-and-forth.
It also solves the visibility problem across open source dependencies. With complex dependency trees, it was previously difficult to know what you were actually running in production and whether it was safe. Snyk gives a clear, continuously updated picture of that risk without requiring manual audits.
From a team dynamic standpoint, it bridges the gap between developers and security teams by speaking the developer's language, showing fixes, not just findings. This has made security a shared responsibility rather than a blocker, which speeds up release cycles without compromising on risk management.
The ROI shows up in avoided incidents, faster PR cycles, and less time spent in reactive fire-fighting mode, all of which compound over time.

What do you like best about the product?

Snyk integrates seamlessly with GitHub, AWS, ECR, and Artifactory to provide a seamless devsecops experience for developers and release engineers. One of the best things that I like about Snyk is its ability to push vulnerability patches via PR on its own (if enabled). Other features include reachability and exploitability intelligence that provides us with surgical data to act upon, reducing vulnerability overload and cutting noise. The newer analytics and reports section allows us to determine SLA and breach timelines for each vulnerability

What do you dislike about the product?

We have seen that Snyk UI and Snyk CLI have misleading results in some cases. While this is not true for most of the cases, we have seen ~2-3% of cases where such anomalies have caused confusion amongst developers.

What problems is the product solving and how is that benefiting you?

Provides accurate visibility on security vulnerabilities by reachability and exploitability attributes, enables us manage SLAs by releases and allows us to measure security across all development touchpoints

What do you like best about the product?

User interface, categorisation, depth in review

What do you dislike about the product?

too many false postives, sometimes too much details make it complex to analyze

What problems is the product solving and how is that benefiting you?

SAST, SCA, Dependabot, Secrets Management

What do you like best about the product?

Snyk is easy to set up and start using. Setting it up to run as a GitHub Action allows it to integrate seamlessly alongside other existing CI processes. Along with this, I like that its vulnerability scanning is pretty much universally trusted amongst engineers, this trust allows for peace of mind.

What do you dislike about the product?

This might have changed since the last time I worked with this product, but at the time Snyk was a bit expensive compared to similar products.

What problems is the product solving and how is that benefiting you?

Snyk makes it easy to stay informed about possible vaulneabilities in software and it's dependencies. Snyk's dependency vulnerability scanning is particularly valuable since in most cases downstream dependencies are numerous and more difficult to audit than an applications main code. Warnings and alerts produced Snyk are prompt and trustworthy.