Notifications
Clear all
Topic starter
02/08/2026 11:34 am
TL;DR: A multimodal approach that uses static analysis, context memories, and targeted LLM reasoning can reduce noise, keep scans deterministic, and cut costs while improving coverage across real codebases, according to Semgrep. The broader lesson is that AI detection only becomes operational when it is constrained by program structure and governance context, not run directly over raw code.
NHIMG editorial — based on content published by Semgrep: AI-assisted vulnerability detection with hybrid analysis
By the numbers:
- Semgrep Multimodal produces true positives results at 37% lower costs compared to finding through LLMs alone.
- Compared to a model-only baseline (Claude Opus 4.6), the hybrid system achieved a 54% reduction in false positive rate.
- This reduced false positives from the initial approach by 90%, resulting in a false positive rate lower than the model-only baseline.
Questions worth separating out
Q: How should security teams reduce false positives in AI vulnerability scanning?
A: Require scanners to prove reachability, exposure, and privilege context before findings are allowed to block delivery.
Q: Why does code context matter so much in AI-powered vulnerability detection?
A: Because code often looks unsafe until you know the intended architecture.
Q: How do organisations know whether AI-assisted scanning is actually working?
A: Look for stable findings across repeated scans, lower false positive rates, and a shrinking gap between alerts and confirmed issues.
Practitioner guidance
- Define a context intake standard for code scanning Require threat models, architecture notes, and approved access assumptions to be attached to security scans so AI findings reflect intended behaviour, not guesswork.
- Scope AI evaluation to high-signal code regions Use static analysis, control flow, and data flow to narrow model review to candidate paths instead of scanning entire repositories with the LLM.
- Treat approved exceptions as auditable memory Maintain persistent, scoped context for intentional access patterns so repeated scans do not recreate the same false positives across releases.
What's in the full article
Semgrep's full post covers the implementation detail this analysis intentionally leaves at the architectural level:
- How Semgrep structures candidate generation with control flow and data flow analysis for large codebases
- How its memories and uploaded context are scoped and applied during detection and triage
- How incremental analysis limits rescans to changed regions and downstream impact paths
- How the hybrid approach compares operationally on repeated scans and false positive reduction
👉 Read Semgrep's analysis of AI-assisted vulnerability detection with hybrid analysis →
AI-powered code scanning: can hybrid analysis cut false positives?
Explore further
02/08/2026 12:48 pm
Context-aware AI detection is really governance-aware detection. Security tooling that cannot absorb design assumptions will keep misclassifying intended access paths as flaws. In codebases where role logic, service permissions, and secrets handling are intertwined, the quality of the context is as important as the quality of the model. Practitioners should treat context ingestion as a control surface, not a convenience feature.
A question worth separating out:
Q: What should teams do when AI findings conflict with documented design intent?
A: Use the discrepancy as a governance signal, not just a tuning issue. Either the documentation is stale, the intended exception is too broad, or the model lacks enough context to reason correctly. Teams should reconcile the architecture record, update the exception boundary, and re-run the scan on the changed slice.
👉 Read our full editorial: AI-assisted vulnerability detection needs context, not just model scale
