Arnica AppSec Core Enterprise Platform

What do you like best about the product?

I use Arnica as a security check across our repositories before code changes can move to the main branch. It helps us find and address vulnerabilities earlier, before they get into a build or production, which has reduced remediation costs. I find Arnica easy to set up and integrate with our CI/CD process, GitHub, Jira, and Teams. Its portal gives me a central place to view vulnerabilities and prioritize critical and high-severity issues. I can also use Teams to interact with Arnica, create and assign Jira tickets, and track issues through resolution. These integrations reduce manual effort and make it easier to move from detection to remediation.

What do you dislike about the product?

I’d like Arnica to reduce false positives and overly high-severity alerts by considering the application’s context, intended audience, and deployment environment. The risk can vary depending on whether an application is internal or externally facing and how it’s deployed. Getting context about the application being scanned would help me prioritize genuine high-risk vulnerabilities and avoid unnecessary investigation.

What problems is the product solving and how is that benefiting you?

I use Arnica as a mandatory security check across our repositories before code changes reach the main branch. It helps us identify and address vulnerabilities earlier, before they reach builds or production, reducing security risk and remediation costs, and gives us a centralized view to prioritize critical and high-severity issues.

What do you like best about the product?

Arnica gives us strong coverage across our full pipeline — IaC scanning, SAST, secrets detection, and AI-generated code scanning all in one platform. Having a single tool cover these areas instead of stitching together multiple point solutions has simplified our security workflow considerably. The secrets detection is particularly reliable and has caught real exposures before they reached production, and the AI-SAST capability is a nice forward-looking addition as more of our code is now AI-assisted.

What do you dislike about the product?

Honestly, there isn't much to complain about from our experience so far — the platform has covered our IaC, SAST, secrets, and AI-SAST scanning needs well. If I had to name something, it would be that with so much scan coverage running across the pipeline, it occasionally takes a little time to triage the full set of findings, so better prioritization or grouping of lower-severity results would be a nice enhancement.

What problems is the product solving and how is that benefiting you?

Before Arnica, we relied on separate tools for infrastructure-as-code scanning, static application security testing, and secrets detection, which made it harder to get a consolidated view of risk across our codebase and pipeline. Arnica consolidates these into one platform, including coverage for AI-generated code, which has become increasingly important as more of our development uses AI coding assistants. This has reduced tool sprawl for our security team, made it easier to catch secrets and vulnerabilities before they reach production, and given us more consistent visibility across our repos.

What do you like best about the product?

I like that Arnica isn’t very noisy and doesn’t flood me with a ton of irrelevant issues like Dependabot does, even though false alarms aren’t rare. The Slack integration is also nice and helpful.

What do you dislike about the product?

Arnica isn’t very noisy, but false alarms aren’t rare. Once it finds an issue, opening it in the UI and commenting, resolving, or handling it is cumbersome. I also find it hard to share findings with an agent like Claude, and I’d like a button to copy a URL that lets my bots access the finding.

What problems is the product solving and how is that benefiting you?

I use Arnica to detect security issues in my PRs.

What do you like best about the product?

It has a very intuitive UI and is easy to navigate. The integration with GitHub in the CI process also helps catch mistakes before release.

What do you dislike about the product?

Sometimes it generates false alarms. The security settings are too strict about resolving the issues it flags, even when they aren’t actually issues.

What problems is the product solving and how is that benefiting you?

It primarily caught rookie mistakes in the codebase. We work with a lot of contractors, and it’s hard to review every piece of code they touch.

What do you like best about the product?

Easy to use and straightforward to set up. It doesn’t interfere with my local development workflow, which is a big plus. It integrates smoothly with Slack and Linear, and the support has been great. Overall, it feels flexible and easy to get started with.

What do you dislike about the product?

I’ve run into false positives with the SAST results, and the UI could be improved for a smoother overall experience.

What problems is the product solving and how is that benefiting you?

Ownership and accountability stand out because it automatically identifies the right owner for each risk and routes it via Slack, instead of relying on a dashboard nobody checks. Our Security Champions get notified, and findings go to a person rather than disappearing into a queue. Supply chain risk visibility is another strength. It monitors code repos and dependencies, flagging third-party dependencies that have known vulnerabilities.

What do you like best about the product?

Works well within existing pipelines. The dashboards are intuitive to use. It's is simple for developers to find their findings to address their code issues.
The SLAs per branch is useful when you have many different
development teams. The newer AI capabilities work well to find real issues instead of FUD.

What do you dislike about the product?

While the dashboard is intuitive, management reporting would be useful. The lack of DAST compared to competitors is a small issue.

What problems is the product solving and how is that benefiting you?

We can find and resolve coding issues earlier in the SDLC, reducing the cost to fix problems which speaks to the ROI of the product.

What do you like best about the product?

I deployed Arnica to replace Checkmarx at a previous company, and I have brought it with me to several startups I support since then. I still use it in my current role, in a somewhat different capacity than the full enterprise program I originally ran.

The policy engine was the primary reason we selected it after evaluating multiple products, since none of the other vendors we tested could offer comparable granularity at the time. It deployed fast across GitHub and Azure DevOps through SCM integration, with no CI rework to start getting value, and our first blocking policy was live within 90 days.

We were able to create granular PR policies on severity, EPSS, finding type, direct versus transitive and prod versus dev dependencies, and package reputation, which let us stage enforcement from annotations into blocking and turn rollout into measurable maturity milestones.

It also strengthened our Security Champions program, since we could empower champions to review dismissals for their own teams. Developer experience improved because people handled findings in code they were already changing instead of years of historical debt.

Customer success has been a genuine strength, responsive and willing to help with rollout, and several requests we raised shipped faster than I expected.

The SBOM explorer experience is also something I personally appreciate, I use it regularly to check exposure across the organizations I support whenever another large supply chain attack hits the news.

My use of the AI review features is still early, more proof of concept than a rollout. I feel positive about the direction, since reviewing AI-generated code is a real challenge and having policy enforcement meet it at the source is the right place to solve it.

On cost, it was priced competitively against the other vendors we evaluated and the per-identity model scaled sensibly as the team grew.

What do you dislike about the product?

Dashboard and reporting could be smoother, especially for executive or audit reporting, though I did not find it better in Checkmarx, Snyk, or GitHub Advanced Security. The API was accessible and well-documented enough that our vulnerability management aggregation platform built an integration to it, and we separately pulled findings into our own reporting.

We had some early challenges with SAST rule quality for older, non-web languages, C++ in particular, where SAST quality tends to be inconsistent industry-wide. We worked with Arnica on custom rules and coverage has improved since.

No DAST, which was a lower priority given our focus on pre-production risk, but runtime-heavy teams should weigh that.

The per-identity pricing model also made direct comparison against other vendors trickier, since most of them price differently, and it took some work to walk our finance stakeholders through it before a deal could move forward, though we concluded the pricing was fair once we normalized the comparison.

What problems is the product solving and how is that benefiting you?

The goal was to get more traction from existing application security coverage across SCA, SAST, secrets detection, and SBOM, without slowing engineering down on GitHub and Azure DevOps. In a previous deployment we selected it because we were not seeing consistent, organization-wide reduction in findings, largely because of how findings were delivered, and we wanted a tool that would let us run a focused, prioritized reduction process.

Delivering findings at the SCM layer meant developers mostly dealt with issues in the code they were actively changing rather than a backlog of historical debt they had no context for, which is what finally moved the needle on reduction.

The policy engine flexibility gave us a concrete way to prioritize in a common way across our other product security programs, since we could place emphasis on issues with demonstrated impact that came through bug bounty and red team work, and further tie that back to how Security Champions reviewed and drove remediation on their teams. That pulled four programs into a shared product security effort with a common incentive.

The other ongoing benefit is supply-chain visibility, when a major dependency compromise hits the news, I can check exposure across the organizations I support quickly.

What do you like best about the product?

ou quickly understand the security posture of your codebase and can maintain continuous oversight while delegating day-to-day security responsibilities to contributing developers.

What do you dislike about the product?

The user interface can be confusing. For example, I couldn't easily find the option to remove a monitored repository.

What problems is the product solving and how is that benefiting you?

Nowadays, as hybrid code developed by both humans and AI agents is rapidly created and deployed, security risks are increasing exponentially. I needed a budget-sensitive tool that could help me mitigate those risks.

What do you like best about the product?

Easy setup and administration was my favorite part. It had what we needed, but took a fraction of the time to set up.

What do you dislike about the product?

It can be tedious logging in multiple times throughout the day, but Short login sessions are generally more secure.

What problems is the product solving and how is that benefiting you?

Arnica assists us with vulnerability detection (SAST and SCA), and it's prioritization to make meaningful strides in remediation.

What do you like best about the product?

Development and Security are often at odds when granting elevated privileges to source code repositories. A security team asking developers to prove they need elevated privileges causes the "Trust Me" conversation, where developers argue that they should be trusted to have complete control of the source code.

Adopting Zero Trust strategies is helping to remediate over-provisioning in many systems, but source code repositories remain a source of contention. Arnica allows Security teams to discover elevated privileges that have been granted but rarely if ever, used.

With Arnica, Need to Know & Least-Privileged Access metrics are always available without input from developers.

Removing unused, elevated privileges effectively reduces the attack surface and associated risk to intellectual property.

Remediation of discovered overprovisioning is simple and easily documented for change control.

What do you dislike about the product?

The complete feature set in Arnica is only available to GitHub Enterprise organizations. Smaller teams not ready to move to GitHub enterprise will not have the full set of protections.

However, discovering and mitigating risk in source code repositories at any level improves overall risk in any software firm.

What problems is the product solving and how is that benefiting you?

Securing source code in Agile software firms requires visibility into the privileges granted to the Organization. Repositories are often misclassified as public or "open source" when the proprietary nature of the project is not fully understood. Individuals with unnecessary elevated privileges can expose intellectual property by facilitating collaboration inappropriately.

Arnica gives firms visibility, analysis, reporting and remediation capabilities on GitHub. Securing the organization without removing privileges that are necessary for the appropriate individuals.