Notifications
Clear all
Topic starter
02/08/2026 11:28 am
TL;DR: Claude Mythos can autonomously find novel vulnerabilities in code, but Veracode argues it is too slow, too costly, and too inconsistent to replace deterministic scanning in enterprise pipelines. The practical shift is toward layered assurance, where AI-assisted deep review supplements, rather than substitutes for, repeatable AppSec controls.
NHIMG editorial — based on content published by Veracode: Why Claude Mythos Changes AppSec Research, Not Your Scanning Stack
Questions worth separating out
Q: How should security teams manage AppSec when AI is writing code faster than humans can review it?
A: Teams should shift from discovery-centric reporting to remediation-centric governance.
Q: When does semantic AI review become too expensive for continuous pipeline use?
A: It becomes too expensive when review time and compute cost push it outside normal build windows.
Q: What do security teams get wrong about AI auto-fix in application security?
A: They often assume a convincing patch means the finding is real and the fix is safe.
Practitioner guidance
- Keep deterministic scanning on every change Run fast static analysis and dependency checks on every commit and merge request so security coverage does not depend on expensive AI review cycles.
- Constrain semantic AI review to selective use cases Apply long-running AI review to a narrow subset of applications, such as internet-facing services or code with complex business logic.
- Preserve audit-grade findings and closure evidence Require unique finding IDs, stable severity, owner assignment, and rescans before closure.
What's in the full article
Veracode's full article covers the operational detail this post intentionally leaves for the source:
- The comparison of scan latency between deterministic tools and AI review across real delivery workflows.
- The cost breakdown behind AI-assisted code analysis at portfolio scale, including compute and triage overhead.
- The detailed explanation of how findings, severities, and audit records behave when AI outputs are inconsistent.
- The remediation workflow behind Veracode Fix, including how confirmed findings are turned into code changes.
👉 Read Veracode's analysis of why Claude Mythos does not replace SAST →
Claude Mythos and AppSec: why scanning still needs a baseline?
Explore further
02/08/2026 12:44 pm
Semantic AppSec creates a coverage gap when teams confuse insight with control. Frontier AI can uncover defects that static pattern matching misses, but that does not make it a control framework. The governance mistake is assuming broader reasoning automatically translates into operational suitability. AppSec teams still need a deterministic baseline for every change, because repeatability is what makes findings actionable, auditable, and comparable across the portfolio.
A question worth separating out:
Q: How can organisations prove their AppSec programme is still trustworthy when AI tools are added?
A: They need stable findings, traceable ownership, repeatable rescans, and closure evidence that supports compliance reporting. AI can enhance depth, but trust comes from controls that generate consistent records over time. If severity shifts unpredictably across scans, programme metrics and audit evidence both become unreliable.
👉 Read our full editorial: Claude Mythos changes AppSec research, not scanning stack
