Notifications
Clear all
Topic starter
02/08/2026 12:26 pm
TL;DR: Context-aware AI can absorb meaningful AppSec workload when it is tightly scoped and grounded in local code context, according to Semgrep. Its Assistant triages about 60% of new SAST findings and customers agree with its triage decisions more than 96% of the time, suggesting that accuracy alone is not enough; security teams need controls that decide when AI can act, what context it can see, and where human review still matters.
NHIMG editorial — based on content published by Semgrep: AI-assisted SAST triage and contextual accuracy
By the numbers:
- Semgrep Assistant has triaged about 60% of new SAST findings for customers this year.
- Customers agree with Semgrep Assistant’s triage history over 96% of the time.
Questions worth separating out
Q: How should security teams let AI triage SAST findings without losing control?
A: Use AI to filter and annotate findings only within tightly scoped boundaries.
Q: Why do AI security assistants need local code context to work well?
A: Security findings depend on application-specific intent, not just syntax.
Q: What do teams get wrong about AI-assisted triage?
A: They often measure it by whether it replaces analysts, rather than whether it improves investigation quality under real workload pressure.
Practitioner guidance
- Define action boundaries for AI triage Specify which finding classes an AI system may close, which it may only annotate, and which always require human review.
- Approve and review stored context Treat memories, notes, and local context as governed security knowledge.
- Measure false negative risk separately from noise reduction Track how often the system suppresses real vulnerabilities as a separate metric from how many findings it filters out.
What's in the full article
Semgrep’s full article covers the operational detail this post intentionally leaves for the source:
- How Semgrep structures the triage workflow into separate decision paths for false positives and true positives
- How customer-approved Memories are created, scoped, and applied to specific rules and projects
- Why the assistant stays usable only when confidence thresholds limit when it can act
- How the model’s context packaging differs across autotriage and other AI capabilities
👉 Read Semgrep’s analysis of AI-assisted SAST triage and contextual accuracy →
AI-assisted SAST triage: can security teams trust the output?
Explore further
02/08/2026 1:25 pm
Context-aware automation is becoming a governance problem, not just a detection problem. Once an AI system starts triaging security findings, the real question is whether it has enough trustworthy context to make a bounded decision. That shifts attention from model quality alone to provenance, scope, and auditability. For IAM and security architects, the lesson is that AI decisioning needs controls around what data it can see and what actions it can take.
A question worth separating out:
Q: How can organisations govern memories or stored context in security AI?
A: Treat stored context like controlled policy knowledge. Approve it, scope it to a specific project or rule set, review it when code or threat assumptions change, and remove stale entries quickly. If the memory layer is unmanaged, it can spread outdated logic across future decisions and create hard-to-see governance drift.
👉 Read our full editorial: AI-assisted SAST triage is changing what security teams must trust
