We mainly use Cycode in our SCM workflow for merge request scanning, especially around secrets detection and dependency findings. In day-to-day use, it has helped us catch issues earlier and support our shift-left security efforts. That said, our experience has not been perfect. We have seen intermittent issues around external pipeline stages and status updates, and those cases sometimes took time to investigate fully. Overall, the product has been useful for our security process, but there is still room to improve reliability in some integrations.

While support team has been excellent, we've noticed the ASPM data doesn't align with our source tools. Because Cycode applies it's own logic during import, the discrepancy makes it difficult to trust the completeness of the data. We'd be much more confident if Cycode numbers matched what we see in our source tools.