Notifications
Clear all
Topic starter
19/08/2026 4:05 pm
TL;DR: On a deliberately vulnerable repository, 42 of 47 source-confirmed issues were found, reaching 89.36% recall and 85.71% F1, according to Corgea. Aikido found 13 issues at 27.66% recall and 41.94% F1, while the benchmark shows that cleaner output is not enough when missed vulnerabilities never enter the remediation queue.
NHIMG editorial — based on content published by Corgea: Corgea vs Aikido benchmark results on a deliberately vulnerable repository
By the numbers:
- Corgea found 42 of 47 source-confirmed issues, reaching 89.36% recall in the benchmark.
- Aikido found 13 of 47 source-confirmed issues, reaching 27.66% recall in the benchmark.
- Corgea’s F1 score was 85.71%, compared with Aikido’s 41.94% in the same scoring set.
Questions worth separating out
Q: What breaks when a SAST tool has low recall?
A: Low recall means confirmed vulnerabilities never make it into triage, so they cannot be assigned, fixed, or verified.
Q: Why do context-dependent code flaws matter more than simple injection findings?
A: Context-dependent flaws often determine whether an attacker can cross a trust boundary, bypass authorization, or abuse a framework convention.
Q: How can teams tell whether their SAST programme is actually working?
A: Look for reduced false-positive churn, faster remediation on high-confidence issues, and consistent developer adoption across repos and teams.
Practitioner guidance
- Run scanners against source-confirmed issues Benchmark each candidate on the same repository and classify every result as true positive, false positive, or false negative before comparing vendors.
- Include secrets exposure in every PoC Seed or identify hardcoded credentials, API tokens, and deployment secrets in test repos so the evaluation covers secret discovery as well as code flaws.
- Score framework-aware weaknesses separately Measure detection on missing authorization, SSRF, open redirect, and other context-dependent flaws as a distinct category from injection findings.
What's in the full article
Corgea's full article covers the benchmark detail this post intentionally leaves at the analyst level:
- Side-by-side finding tables showing true positives, false positives, and false negatives for each tool
- Exact examples of the vulnerabilities Corgea found that Aikido missed, including authorization and SSRF cases
- Benchmark scoring method details for precision, recall, and F1 on the 47-issue repository
- Screenshots of the scan outputs and AI Code Audit pricing evidence from the benchmark run
👉 Read Corgea's benchmark analysis of Corgea vs Aikido on SAST recall →
Corgea vs Aikido: what this SAST benchmark means for AppSec teams?
Explore further
19/08/2026 4:39 pm
Clean output is not the same as complete risk coverage. SAST buyers often overweight precision because noisy findings are painful, but this benchmark shows the real cost sits in false negatives. A scanner that misses 34 confirmed issues may save triage time while leaving the backlog incomplete. For AppSec leaders, completeness is the control objective, not tidiness.
A question worth separating out:
Q: Should organisations prioritise recall or precision when choosing a SAST platform?
A: They need both, but the balance depends on programme maturity. Early on, enough recall is essential to expose the real defect population, while precision determines whether developers will keep using the tool. The right choice is the scanner that best fits your review capacity and the kinds of issues your repositories actually contain.
👉 Read our full editorial: Corgea vs Aikido benchmark shows recall matters more than cleaner output
