Arnica

With Arnica, we're streamlining the review process through data-driven analytics and automation to prevent the accumulation of excessive permissions. Arnica has already paid for itself through process optimization and developer tool cost savings by right-sizing commercial licenses. We're satisfied with the product's capabilities and eager to see how the feature set grows. We're securing the DevOps supply chain and managing entitlements and permissions for our 3000 developers. The tool also helps reduce waste from licensing unused tools.

Arnica's detections are based on data, so when something is flagged, it's likely a true positive. Acting on Arnica's detections simplifies the mitigation process. The Arnica team is always working to expand detections with new types and improve existing ones. We look forward to broadening our use of Arnica in our environment. Arnica addresses Git access management issues that are often neglected because they're time-consuming and hard to manage. The fact that it's automated with intelligence helps us implement the solution and take action confidently.

Incredibly easy to use. Connect to GitHub quickly and get a comprehensive view of all potential vulnerabilities in your repository. I'm excited for more features and to use this tool more regularly as our team grows. There are a few areas with confusing UI, and I'd love more integrations across my stack to detect vulnerabilities and excessive permissions. It provides peace of mind knowing our repo is safe and tightly controlled, especially with a constant flow of contractors moving in and out.

Development and security teams often clash over granting elevated privileges to source code repositories. When security asks developers to justify needing such privileges, it leads to the 'Trust Me' conversation, where developers insist they should be trusted with full control. Adopting Zero Trust principles helps reduce over-provisioning in many systems, but source code repositories remain a friction point. Arnica enables security teams to spot elevated privileges that have been granted but rarely used. With Arnica, Need-to-Know and Least-Privilege metrics are always available without needing developer input. Removing unused elevated privileges effectively lowers the attack surface and risk to intellectual property. Remediation of discovered over-provisioning is straightforward and can be easily documented for change control. The full feature set of Arnica is only available to GitHub Enterprise organizations. Smaller teams not ready to move to GitHub Enterprise miss out on some protections. However, identifying and mitigating risk in source code repositories at any level improves overall risk in any software firm. Securing source code in Agile software firms requires visibility into the privileges granted to the organization. Repositories are often misclassified as public or 'open source' when the proprietary nature of the project isn't fully understood. Individuals with unnecessary elevated privileges can expose intellectual property by enabling inappropriate collaboration. Arnica gives firms visibility, analysis, reporting, and remediation capabilities on GitHub, securing the organization without removing privileges that are necessary for appropriate individuals.

The setup and administration were my favorite aspects. It had everything we needed, yet took only a fraction of the time to configure. Logging in multiple times a day can be tedious, but shorter login sessions are generally more secure. Arnica helps us with vulnerability detection (SAST and SCA) and prioritization, enabling meaningful progress in remediation.

You quickly grasp your codebase's security posture and can maintain ongoing oversight while delegating day-to-day security tasks to contributing developers. The UI can be confusing at times; for instance, I struggled to find the option to remove a monitored repository. In today's environment where hybrid code from both humans and AI agents is rapidly developed and deployed, security risks are escalating exponentially. I needed a budget-friendly tool that could help mitigate those risks.

Integrates seamlessly into existing pipelines. The dashboards are user-friendly. Developers find it straightforward to locate and address their code issues. The per-branch SLAs are handy when you have multiple development teams. The newer AI features do well at identifying genuine problems rather than noise. While the dashboard is easy to use, management-level reporting would be a nice addition. The lack of DAST compared to rivals is a minor drawback. We can catch and fix coding issues earlier in the SDLC, reducing the cost of fixes, which demonstrates the product's ROI.

I first adopted Arnica as a replacement for Checkmarx at a previous company, and since then I've introduced it at several startups I've supported. I still use it today, though in a slightly different role than the full-scale enterprise setup I originally managed. The main reason we picked it after evaluating multiple options was its policy engine—no other vendor we tried matched that level of granularity back then. Deployment was quick via GitHub and Azure DevOps SCM integration, with no need to overhaul our CI to start seeing value, and our first blocking policy went live within 90 days. We crafted detailed PR policies based on severity, EPSS, finding type, whether dependencies were direct or transitive, production versus development, and package reputation. This allowed us to phase enforcement from just annotations to fully blocking, turning the rollout into measurable milestones. It also boosted our Security Champions initiative, as we gave champions the ability to review dismissals for their own teams. Developer experience improved because they fixed issues in the code they were already touching, rather than tackling years of technical debt. Customer success has been a genuine plus—responsive and helpful during rollout, and several feature requests we made shipped faster than expected. I personally value the SBOM explorer; I use it regularly to check exposure across the organizations I support whenever a major supply chain attack hits the news. My use of the AI review features is still in early stages, more proof-of-concept than full rollout. I'm optimistic about its direction, since reviewing AI-generated code is a real challenge, and having policy enforcement meet it at the source is the right solution. On pricing, it was competitive against other vendors we considered, and the per-identity model scaled reasonably as our team grew. Dashboard and reporting could be smoother, especially for executive or audit reporting, though I didn't find that better in Checkmarx, Snyk, or GitHub Advanced Security. The API was accessible and well-documented enough that our vulnerability management aggregation platform built an integration, and we also pulled findings into our own reports. We faced early difficulties with SAST rule quality for older, non-web languages, particularly C++, where SAST quality tends to be inconsistent industry-wide. We worked with Arnica on custom rules, and coverage has improved since. There's no DAST, which was lower priority given our pre-production focus, but runtime-heavy teams should consider that. The per-identity pricing also made direct comparison with other vendors trickier, since most price differently, and it took some effort to explain to finance before a deal, though we concluded the pricing was fair once we normalized comparisons. The goal was to get more traction from existing application security coverage across SCA, SAST, secrets detection, and SBOM, without slowing engineering on GitHub and Azure DevOps. In a previous deployment, we chose it because we weren't seeing consistent, org-wide reduction in findings, largely due to how findings were delivered, and we wanted a tool for focused, prioritized reduction. Delivering findings at the SCM layer meant developers mostly dealt with issues in code they were actively changing rather than a backlog of historical debt they had no context for, which finally moved the needle on reduction. The policy engine's flexibility gave us a concrete way to prioritize across our other product security programs, as we could emphasize issues with demonstrated impact from bug bounty and red team work, and tie that back to how Security Champions reviewed and drove remediation. That brought four programs together into a shared effort with common incentives. Another ongoing benefit is supply-chain visibility—when a major dependency compromise hits the news, I can quickly check exposure across the organizations I support.