Topic starter
02/08/2026 12:26 pm
TL;DR: Context-aware AI can absorb meaningful AppSec workload when it is tightly scoped and grounded in local code context, according to Semgrep. Its Assistant triages about 60% of new SAST findings and customers agree with its triage decisions more than 96% of the time, suggesting that accuracy alone is not enough; security teams need controls that decide when AI can act, what context it can see, and where human review still matters.
Editorial analysis by NHI Mgmt Group, based on content published by Semgrep: “Our AI Assistant is handling 60% of incoming triage work for customers”.
By the numbers:
- Semgrep says Assistant triaged about 60% of new SAST findings for customers year to date.
- Users agreed with Assistant's triage decisions over 96% of the time.
Key questions
Q: How should security teams let AI triage SAST findings without losing control?
A: Use AI to filter and annotate findings only within tightly scoped boundaries.
Q: Why does high accuracy not automatically make AI triage trustworthy?
A: Because security triage is asymmetric.
Q: What are the warning signs that AI-assisted triage is overreaching?
A: Warning signs include unexplained dismissal of findings, broad context ingestion with no clear scope, and reviewers no longer checking the cases that matter most.
Practitioner guidance
- Define auto-triage boundaries by confidence level Separate findings that the system may dismiss automatically from findings it may only summarise.
- Scope AI context to local code and project facts Limit the model to the specific repositories, rules, and internal assumptions needed to judge a finding.
- Audit false-negative risk before expanding automation Measure the cost of a missed true positive, not just the overall accuracy number.
Bottom line: AI-assisted SAST triage can materially reduce noise, but only when the system is constrained by local code context and explicit confidence thresholds.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:25 pm
Context-aware AI triage is a governance problem before it is a model problem: the core question is not whether an LLM can label findings, but whether the security organisation can bound the context it sees and the actions it is allowed to take. Security teams already understand this pattern from PAM and JIT access, where capability is less important than constrained authority. For AI triage, the same logic applies: trust is earned through scope control, not model charisma.
A question worth separating out:
Q: How should security teams govern memory in AI agents?
A: Treat memory as a privileged state store, not a convenience feature. Define what can be retained, who owns the decision, how long it persists, and which identity scope it belongs to. Then test whether stored context can influence later actions outside the original session. If it can, the memory layer needs the same governance discipline applied to other high-trust systems.
👉 Read our full editorial: AI-assisted SAST triage is changing what security teams must trust