Topic starter
06/11/2026 6:37 pm
TL;DR: Running the same AI vulnerability scanner multiple times can raise recall materially, with five runs of DeepSeek v4.1 Flash finding about 71% of known vulnerabilities versus about 52% for one run, according to depthfirst research, while careful aggregation helps manage false positives. For defenders, coverage and calibration now matter as much as model strength.
Editorial analysis by NHI Mgmt Group, based on content published by depthfirst: “How repeated sampling improves vulnerability detection”.
Key questions
Q: How should teams improve vulnerability scan coverage with AI assistants?
A: Use repeated sampling on the same repository and compare the deduplicated findings, because a single AI-assisted scan can miss issues that appear only under different prompts or traversal paths.
Q: Why do repeated AI scans sometimes find more vulnerabilities than one expensive pass?
A: Repeated AI scans can find more vulnerabilities because each pass explores code, dependencies, or prompts in a slightly different way, so one pass may miss paths that another pass surfaces.
Q: How do confidence thresholds affect vulnerability detection results?
A: Confidence thresholds control which candidate findings are reported, suppressed, or sent for further review.
Practitioner guidance
- Define a repeated-scan policy for high-risk repositories Run the same scanner multiple times on critical code paths and specify how many passes are required before a result is considered complete.
- Tune confidence cutoffs to match triage capacity Set a numeric threshold for deduped findings, then validate that it preserves the balance between missed vulnerabilities and review noise.
- Measure cost-adjusted recall before choosing a model Compare scanners using coverage per dollar, not just a single-pass result, because repeated runs can change the economics of detection.
Bottom line: Probabilistic scanners do not reveal the same issues every time, so repeated runs can materially improve vulnerability discovery.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Repeated sampling creates a new control plane for detection quality: the core security decision moves from single-pass accuracy to how well a programme can combine stochastic outputs into a dependable result. That matters because the same code base can produce different findings on different runs, which makes coverage an operational property rather than a model property. Teams that do not govern this layer will overtrust one pass and undercount exposure. The practical conclusion is that scan orchestration now belongs in security governance, not just tool configuration.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the best way to compare AI vulnerability scanners?
A: Compare scanners by the attack paths they cover, the prompts or model interfaces they test, and how they report exploitable findings. Use cost-adjusted recall to balance detection coverage against runtime and false positives, and verify whether they can test prompt injection, data leakage, tool abuse, and model misconfiguration in your own environment.
👉 Read our full editorial: Repeated sampling changes the cost curve for vulnerability detection