Topic starter
02/08/2026 11:34 am
TL;DR: A multimodal approach that uses static analysis, context memories, and targeted LLM reasoning can reduce noise, keep scans deterministic, and cut costs while improving coverage across real codebases, according to Semgrep. The broader lesson is that AI detection only becomes operational when it is constrained by program structure and governance context, not run directly over raw code.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “Operationalizing AI-Powered Detection”.
By the numbers:
- Semgrep Multimodal produced true positives at 37% lower costs compared with finding through LLMs alone.
- The hybrid system reduced the false positive rate by 54% versus the model-only baseline.
- In one phase, the approach reduced false positives by 90% from the initial hybrid system.
Key questions
Q: Why do AI vulnerability scanners produce so many false positives without code context?
A: Because the model cannot reliably tell whether a pattern is intentional or exploitable when it sees code without the surrounding execution path, design assumption, or trust boundary.
Q: How should teams implement AI-assisted vulnerability detection in large codebases?
A: Start with static analysis to generate security-relevant candidates, then pass only focused program slices to the model.
Q: What signs show that an AI code scanner is not trustworthy enough for production use?
A: Repeated scans produce different results on unchanged code, findings disappear and reappear without code changes, and analysts spend most of their time dismissing noise.
Practitioner guidance
- Define approved codebase context for AI detection Capture threat models, design assumptions, and known trusted access patterns as persistent context so the scanner can distinguish intended behaviour from suspicious behaviour.
- Gate model reasoning behind static candidate generation Require control flow and data flow analysis to narrow the regions the model reviews, especially in large repositories and monorepos where raw inference is too broad.
- Measure stability across repeated scans Track whether the same code produces the same findings over time, then investigate variance as a tooling problem rather than assuming the code changed.
Bottom line: AI-assisted vulnerability detection fails when models are asked to judge raw code without the structural and governance context that determines whether a pattern is real.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:48 pm
AI-assisted code scanning fails when context is treated as optional: model scale alone does not create trustworthy vulnerability detection. A scanner needs the system’s design assumptions, execution paths, and explicit trust boundaries or it will over-report intentional behaviour as defects. The practical conclusion is that context management is a security control, not just a tuning input.
A question worth separating out:
Q: Should security teams prioritise context management or model scale for AI detection?
A: Context management should come first, because larger models do not solve missing design assumptions, unstable output, or poor precision. A smaller model guided by deterministic analysis and trusted context is usually more useful than a larger model scanning raw code.
👉 Read our full editorial: AI-assisted vulnerability detection needs context, not just model scale