Notifications
Clear all
Topic starter
02/08/2026 11:45 am
TL;DR: OpenAI’s Trusted Access for Cyber program gives vetted security organizations access to frontier cyber models, while Semgrep says its multimodal analysis already finds up to 8x more true positives with 50% fewer false positives than LLMs alone and aligns with user triage decisions 95% of the time. The practical shift is that AppSec now has to treat AI-assisted reasoning as part of the control stack, not just a productivity layer.
NHIMG editorial — based on content published by Semgrep: Security backlogs aren’t a new problem, but AI coding tools have accelerated the triage burden
Questions worth separating out
Q: How should security teams govern AI SOC triage without losing accountability?
A: Security teams should require clear escalation thresholds, logged decision paths, and retained evidence for every automated outcome.
Q: When does AI-assisted remediation create more risk than it reduces?
A: It becomes riskier when the system can progress from diagnosis to merge or deployment without a clear human checkpoint.
Q: What do teams get wrong about AI finding reduction in AppSec?
A: Teams often assume fewer false positives automatically means better security.
Practitioner guidance
- Scope AI model access like a privileged integration Assign least-privilege API credentials to AppSec workflows, separate test and production model access, and log every codebase or finding set sent to the model.
- Measure triage quality before expanding AI use Track precision, false-positive reduction, and agreement rates between analysts and model-assisted decisions over a fixed finding set.
- Require context-rich remediation output Prioritise tools that show where a vulnerable dependency is used, what code paths change, and which fixes may break builds.
What's in the full analysis
Semgrep's full analysis covers the operational detail this post intentionally leaves for the source:
- How Multimodal combines AI reasoning with rule-based detection across code, findings, and remediation workflows
- How Autofix and Upgrade Guidance surface dependency impact analysis directly inside pull requests
- How Semgrep measures triage agreement across more than six million findings
- How the Trusted Access for Cyber program frames defender access to frontier models and evaluation access for AI security institutes
👉 Read Semgrep's analysis of frontier cyber reasoning for AppSec triage and remediation →
Frontier cyber reasoning for AppSec: what changes for security teams?
Explore further
02/08/2026 12:56 pm
AI-assisted triage is becoming a governance problem, not just an efficiency gain. Once model reasoning is embedded in vulnerability review, the security team is no longer only validating findings. It is also validating the quality of the reasoning that produced the recommendation. That shifts accountability toward auditability, task scoping, and evidence retention. The practical conclusion is that AppSec leaders need to govern model-assisted decisions with the same discipline they apply to privileged workflows.
A question worth separating out:
Q: How should organisations control model access in security engineering workflows?
A: Use the same discipline you would apply to any non-human identity that touches sensitive code or findings. Issue task-scoped credentials, review access regularly, monitor usage, and revoke integrations that are no longer needed. Model access is a privileged control point, not a convenience layer.
👉 Read our full editorial: Frontier cyber reasoning is changing AppSec triage and remediation
