Notifications
Clear all
Topic starter
02/08/2026 9:48 am
TL;DR: AppSec tools that combine AI with deterministic SAST can reduce noise, improve developer trust, and speed triage, but the real value comes from preserving security expertise while adding context-aware assistance, according to Semgrep. The strongest programmes will treat AI as a force multiplier for SAST rather than a replacement for it, especially as MCP-style workflows make security review more accessible.
NHIMG editorial — based on content published by Semgrep: AI changes AppSec tool selection and workflow design
Questions worth separating out
Q: How should security teams combine AI with traditional AppSec scanning?
A: Use AI to improve triage, summarisation, and rule tuning while keeping deterministic SAST responsible for known vulnerability detection.
Q: When does AI-assisted security tooling create more risk than it reduces?
A: Risk rises when the system can influence decisions without clear entitlement boundaries, traceability, or human review.
Q: What do security teams get wrong about false positives in code scanning?
A: They treat false positives as a nuisance metric instead of a control-quality signal.
Practitioner guidance
- Keep SAST as the control baseline Use deterministic static analysis for known vulnerability classes and add AI only where it improves triage, explanation, or rule tuning.
- Measure false-positive cost, not just alert volume Track how many findings are dismissed, how long triage takes, and how often developers disengage from the tool.
- Require transparent reachability evidence Choose tooling that shows why a finding is reachable in the actual application path.
What's in the full article
Semgrep's full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor weighs SAST against AI-assisted triage across real developer workflows
- Criteria used to compare false-positive handling, transparency, and reachability analysis
- The rationale behind the nine selection factors and how each one maps to tool evaluation
- Why MCP is positioned as a usability layer for security review across 30+ programming languages
👉 Read Semgrep's analysis of AI-assisted AppSec tool selection →
AI-assisted AppSec and SAST: are your controls keeping up?
Explore further
02/08/2026 12:39 pm
AI-assisted AppSec succeeds only when the organisation preserves deterministic control. The most important mistake is assuming that AI can substitute for a mature static analysis foundation. Security teams need repeatable checks for known vulnerabilities, especially where code changes fast and developers will not tolerate opaque results. A usable AppSec programme is one where AI improves comprehension and prioritisation while SAST still owns detection certainty. That is the standard practitioners should hold themselves to.
A question worth separating out:
Q: How can teams use MCP without weakening AppSec governance?
A: Keep MCP as the access layer for human interaction, but leave policy decisions, evidence capture, and remediation tracking in the underlying security workflow. That way developers can ask questions naturally while the organisation still preserves control integrity, reviewability, and accountability. A conversational interface should reduce friction, not blur responsibility.
👉 Read our full editorial: AI-assisted AppSec still depends on trusted SAST foundations
