Notifications
Clear all
Topic starter
14/09/2026 10:09 am
TL;DR: Deterministic SAST still delivers strong precision, with a 93.75% true positive rate and just 2.12% false positives on OWASP Benchmark for Java, according to Cycode. Agentic code scanning closes gaps on authorization flaws and outperforms a higher-cost model when guided by a harness; the practical lesson is that AI reasoning does not replace baseline code analysis, but works best when precision, coverage, and orchestration are deliberately separated.
NHIMG editorial — based on content published by Cycode: What Benchmark Data Says About Deterministic SAST and Agentic Code Scanning
By the numbers:
- Cycode SAST reached 93.75% true positive rate with a 2.12% false positive rate on the OWASP Benchmark for Java.
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, sharing sensitive data, and revealing access credentials.
Questions worth separating out
A: Use deterministic SAST as the control for known vulnerability classes, especially OWASP Top 10 issues, because it is exhaustive, repeatable, and auditable.
Q: Why do broken access control issues survive normal application security testing?
A: They survive because many tools look for patterns inside a single file or repository, while the failure often lives in how multiple functions or services enforce the same rule differently.
Q: What are the signs that an agentic code scanner is not well governed?
A: Look for inconsistent coverage, scans that spend time in irrelevant files, findings that cannot be reproduced, and output that overstates confidence without clear provenance.
Practitioner guidance
- Keep deterministic SAST as the baseline gate Run high-precision rules on every commit so routine authorization and data-flow issues are caught with consistent output before deeper analysis is needed.
- Route only rule-resistant findings to agentic review Use reasoning-based scanning for access control, business logic, and privilege enforcement defects that fixed patterns cannot express reliably.
- Instrument the harness, not just the model Log repository scope, file selection, scan order, and model choice so every run can be audited and reproduced later.
What's in the full article
Cycode's full analysis covers the operational detail this post intentionally leaves for the source:
- The benchmark setup for the OWASP Benchmark for Java and the six-CVE repository set used to compare rule-based and agentic scanning.
- The exact harnessing approach Cycode used to steer cheaper open-weight models toward relevant files and away from noisy scan paths.
- The full four-dimensional code-analysis workflow, including AI exploitability review, agentic scanning, rule distillation, and remediation routing.
- The specific repository-level examples that show where deterministic SAST, agent reasoning, and audit logging each fit in the workflow.
👉 Read Cycode’s benchmark analysis of deterministic SAST and agentic code scanning →
Agentic code scanning vs deterministic SAST: what changes for teams?
Explore further
14/09/2026 10:10 am
Deterministic precision is still the security control that makes AI-assisted scanning usable. The article’s benchmark numbers show that noisy scanning is not just inefficient, it is governance failure by volume. In IAM-adjacent code, especially permission checks and token handling, teams need a baseline they can trust before they layer on agent reasoning. Precision is therefore a prerequisite for scaling review capacity, not a legacy preference.
A question worth separating out:
Q: How do teams decide when to trust rules versus reasoning in code analysis?
A: Trust rules for stable, expressible weakness patterns where precision matters and output must be identical across runs. Use reasoning when the defect depends on intent, missing policy enforcement, or multi-step context. If the vulnerability can be described as a simple source-to-sink pattern, rules usually belong first.
👉 Read our full editorial: Deterministic SAST still matters as agentic code scanning expands
