Jev-based vulnerability scanning shifts code security toward cheap coverage

At a glance

What this is: This is an analysis of a Jev-based vulnerability scanning approach that uses parallel classification to reduce scan time and token cost while expanding code coverage.

Why it matters: It matters because security teams often under-scan code due to cost and latency, and faster first-pass analysis changes how quickly vulnerabilities can be triaged across large repositories and dependency trees.

By the numbers:

• Input costs $0.042 per million tokens, five times less than Luna.
• Each call takes around a quarter of a second vs around 10 seconds for Luna.

👉 Read depthfirst's analysis of a cheaper, faster vulnerability scanner built with Jev

Context

Vulnerability scanning is an SDLC control problem as much as a detection problem. When codebases grow, teams often trade breadth for cost, leaving repositories, commits, and dependency trees only partially covered. That creates blind spots that attackers can exploit long before a manual review or slower model gets there.

The core governance issue is not whether a scanner can find a flaw in one file, but whether it can sustain continuous coverage at a price and speed that fit real engineering workflows. In practice, faster scanning changes the economics of code security, especially where autonomous attacks and rapid exploit discovery compress defender reaction time.

Key questions

Q: What breaks when code scanning is too expensive to run continuously?

A: Teams stop scanning as often as they should, which creates blind spots across repositories, commits, and dependencies. The failure is not just missed findings. It is a governance pattern where detection becomes selective because the workflow cannot tolerate the cost or latency of broad coverage.

Q: When should organisations prioritise fast vulnerability triage over deep analysis?

A: Prioritise fast triage when the codebase is large, the release cadence is high, and the goal is to identify which areas deserve deeper scrutiny first. Deep analysis still matters for exploitability, but a cheap first pass is the right choice when coverage gaps are the main risk.

Q: What are the signs that a code scanning programme is underperforming?

A: Look for long scan runtimes, high per-scan costs, uneven repository coverage, and backlog growth between code changes and security review. If teams are skipping whole parts of the tree or scanning only after release, the programme is already rationing security.

Q: How should security teams balance automated scanning with human review of attack surface findings?

A: Security teams should use automation to collect and correlate evidence, then apply human analysis to separate noise from meaningful risk. Automated tools are good at breadth, but they often miss context, business impact, and chained exposures. Human review is what turns a long list of issues into an accurate picture of exploitable attack paths and practical mitigation priorities.

Technical breakdown

How parallel classification changes vulnerability discovery

Jev is used here as a classifier rather than a generative model. Instead of producing a free-form answer, it returns probabilities for predefined options, such as whether code is vulnerable or which CWE best fits the issue. That matters because each question can be asked independently and in parallel, and shared context can be cached. In security tooling, this shifts the bottleneck away from long model generation and toward structured interrogation of code. The trade-off is narrower reasoning depth, but the gain is much higher throughput for first-pass analysis.

Practical implication: use structured classification to widen code coverage before invoking slower, higher-reasoning analysis.

Why chunked scanning is needed for large repositories

The scanner works around a 32,000-token context window by splitting repositories into small chunks, ranking which chunks look security-critical, and then reusing the highest-probability chunks as context for later passes. This is a classic retrieval and triage pattern adapted to code security. It does not replace full semantic analysis, but it does make broad scanning economically feasible. The architecture is especially relevant when teams need to inspect every repository and commit, yet cannot afford to feed entire codebases into expensive models for each pass.

Practical implication: build a two-stage pipeline that ranks likely risky code before deeper analysis.

What the scanner learns about exploitability and impact

After identifying likely vulnerable chunks, the harness asks follow-on questions about vulnerability type, attack pattern, untrusted input flow, flawed logic, and security impact. That moves the output from a simple detection flag toward exploit-oriented triage. In other words, the tool is not just answering whether code is risky, but where attacker-controlled input enters, where it breaks intended checks, and what damage follows. That is useful for prioritisation, though it still depends on asking the right questions up front. Stronger reasoning is still needed when an exploit spans multiple code paths or requires broader context.

Practical implication: pair fast classification with downstream enrichment that explains exploit path and likely impact.

NHI Mgmt Group analysis

Cheap first-pass scanning is becoming a governance requirement, not a convenience. When defenders cannot afford to scan every repository and commit frequently, security coverage becomes selective by default. That is the real control gap this article exposes: not weak detection theory, but insufficient economic feasibility. For practitioners, the question shifts from whether a scanner is accurate enough in isolation to whether it can sustain continuous coverage across the SDLC.

The named concept here is code coverage economics: the cost structure that determines how much source code a security team can realistically inspect before release. If scan cost and latency are too high, teams unconsciously ration detection and accept blind spots. That creates a structural advantage for attackers, who only need one high-payoff defect. Practitioners should treat throughput, cost per scan, and repository breadth as governance metrics, not engineering details.

Autonomous attack pressure raises the value of fast triage. The article’s own framing is that hacking is becoming an efficiency game, which is the right lens for code security as well. Fast classification is not a replacement for deeper reasoning, but it can reduce the time between code change and actionable security signal. For programmes that already struggle with review backlogs, this is an argument for layered detection rather than a single monolithic scanner.

Agentic workflows will matter most where vulnerability discovery needs escalation, not just identification. The article hints that coupling the classifier with an LLM agent could improve performance by noticing patterns the harness did not ask about. That is the identity-adjacent lesson for AI security teams: model-driven automation becomes more useful when the system can pass structured findings into a second-stage reasoning workflow. Practitioners should design for staged analysis, not one-shot verdicts.

Security teams should not confuse speed with completeness. A fast classifier can uncover a larger surface area, but the article also shows the limit of questions you think to ask. That means governance must include explicit coverage review, not just model selection. For teams running code security at scale, the practical goal is to use speed to widen search, then use deeper analysis to validate exploitability and business impact.

What this signals

Code security programmes will increasingly be judged by throughput, not only by detection quality. If a scanner cannot cover the codebase often enough, finding precision becomes less important than the fact that whole repositories never get reviewed. Teams should expect security leadership to ask how much code is actually inspected before release, and how fast suspicious areas can be escalated for deeper analysis.

Fast first-pass analysis creates room for broader governance of software risk. That includes large dependency trees, high-change repositories, and pre-merge workflows where slow tooling usually gets bypassed. The practical signal for practitioners is clear: if your security tooling cannot fit developer cadence, developers will route around it.

Code coverage economics will shape the next phase of AI-assisted security tooling. The tools that win operational adoption will be the ones that combine cheap screening with enough structure to support triage, escalation, and validation. For identity and security teams, that means treating model orchestration as part of the control design, not an afterthought.

For practitioners

• Implement a two-stage code scanning pipeline Use a fast classifier to rank repositories and chunks for likely vulnerability density, then send the highest-risk areas to a deeper reasoning pass for validation and exploit detail.
• Measure scan coverage as a governance metric Track what percentage of repositories, commits, and dependency paths receive a security pass within your normal SDLC window, not just how many findings the tool produces.
• Separate detection from exploit explanation Require each finding to include attack pattern, untrusted input path, flawed logic, and likely impact so triage can prioritise risk instead of raw alerts.
• Use fast scanning to triage third-party dependencies Apply the same workflow to large dependency trees where a full deep scan is too expensive, then escalate only packages with suspicious signal density.

Key takeaways

• The main risk is not that code scanning is impossible, but that cost and latency force teams to leave important parts of the codebase unchecked.
• The article shows that a classifier-based approach can reduce scan time to around 2 seconds and lower token cost dramatically, which changes the economics of continuous scanning.
• Practitioners should use fast analysis for broad coverage and reserve deeper reasoning for exploitability, impact, and remediation decisions.

Key terms

• External Vulnerability Scan: A test that checks systems reachable from the internet for known weaknesses, missing patches, and risky configurations. It is used to see what an attacker can exploit without first getting inside the network, making it a direct measure of public exposure.
• Context Window: The context window is the text a model receives at one time, including prompts, retrieved documents, and conversation history. Security teams care about it because it becomes the practical boundary between trusted instructions and untrusted content, especially when the application assembles that text automatically.
• Exploitability-Led Triage: Exploitability-led triage is a remediation method that prioritises weaknesses based on whether they are reachable and can be chained into real attack paths. It is more effective than raw backlog ranking because it ties effort to actual exposure, not just issue count.
• Code Coverage Economics: Code coverage economics is the relationship between the cost of analysis and the amount of code a team can realistically inspect. When scan time or token cost is too high, coverage shrinks and blind spots become an operational decision rather than an accident.

What's in the full article

depthfirst's full blog post covers the operational detail this post intentionally leaves for the source:

• The exact dfbench harness design used to break large codebases into security-critical chunks
• The question set used to classify vulnerability type, attack pattern, untrusted input flow, and impact
• The practical limitations of a 32,000-token context window in real scanning workflows
• Where an LLM agent could add reasoning depth beyond the Jev-based first pass

👉 depthfirst's full post covers the scanning harness, classification workflow, and performance trade-offs in more detail.

Deepen your knowledge

Our NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, and secrets management. It is designed for practitioners building programmes that need structured identity controls across modern security workflows.