Semgrep Appoints Cathy Polinsky as Co‑CTO to Scale AI‑driven Code Security

Why It Matters

The appointment of Cathy Polinsky highlights the growing need for seasoned engineering leadership in the AI‑driven security space. As generative models accelerate code production, traditional security review processes are being outpaced, creating a market gap that platforms like Semgrep aim to fill. By strengthening its engineering execution, Semgrep positions itself to capture a larger share of enterprise spend on automated code‑security solutions. For CTOs, the move serves as a case study in how to structure leadership for rapid innovation while preserving security integrity. The dual‑Co‑CTO model separates strategic AI vision from day‑to‑day engineering delivery, a framework that could be replicated by other firms facing similar scaling pressures.

Key Takeaways

• Semgrep hires Cathy Polinsky, veteran of Yahoo!, Salesforce, Shopify, as Co‑CTO and VP of Engineering
• Polinsky will lead a planned 40% increase in engineering headcount by end‑2027
• Semgrep scans >100 million code lines annually for customers like Okta, Dropbox, Lyft
• Company selected for OpenAI's Trusted Access for Cyber program, giving early access to foundation models
• CEO Isaac Evans cites AI‑generated code as both urgency and opportunity for the firm

Pulse Analysis

Semgrep’s leadership overhaul arrives at a inflection point for code‑security vendors. The surge of AI‑generated code is not a fleeting trend; it fundamentally changes the software supply chain, turning code creation into a high‑velocity, data‑rich process. Vendors that can embed security directly into that pipeline—rather than treating it as a post‑hoc check—will command premium pricing and deeper integration with development tools. Polinsky’s track record of scaling engineering teams through hyper‑growth phases suggests Semgrep can translate its technical advantage into market share.

Historically, code‑security firms have struggled with the trade‑off between thorough analysis and developer friction. By pairing deterministic static analysis with large‑language‑model insights, Semgrep aims to reduce false positives while expanding coverage to novel code patterns that AI models produce. If the company meets its remediation‑time targets, it could set a new industry standard, forcing competitors to accelerate their own AI integration efforts.

Looking ahead, the dual‑Co‑CTO structure may become a template for other high‑growth tech firms. One leader focuses on long‑term architecture and AI strategy, while the other drives execution and team scaling. This separation could help organizations maintain agility without sacrificing strategic coherence—a balance that CTOs will need to master as AI continues to reshape software development.