Topic starter
25/10/2026 11:02 am
TL;DR: Open-weight models can now hunt IDOR and authorization flaws for about $0.17 per vulnerability, according to Nullify, with one model scoring 39% F1 on the task and making candidate discovery cheap at scale. The durable security edge is no longer finding more bugs, but validating which apparent hits actually violate the application’s authorization model.
Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “The Cheapest Way to Hunt Authorization Bugs Now Costs $0.17. That's the Problem.”.
By the numbers:
- GLM-5.2 scored 39% F1 on IDOR and authorization-vulnerability detection.
- The model found vulnerabilities at roughly $0.17 per vulnerability found.
Key questions
A: Start by defining the access model the application is supposed to enforce.
Q: Why do cheap authorization scanners produce so many false positives?
A: Because many authorization failures are only visible when you reason about intent, ownership, and tenancy.
Q: How can teams tell a real IDOR from intended shared access?
A: Compare the observed response against the application’s role and object model, not just the status code.
Practitioner guidance
- Define the application’s intended access states Document which roles, tenants, and user states can see which objects before automated testing begins.
- Separate exploit generation from exploit validation Keep the high-volume probe stage and the decision stage independent so a fast model cannot self-certify weak evidence.
- Treat 200 OK responses as evidence, not proof Inspect response bodies, resource ownership, and state transitions before classifying a hit as a real authorization failure.
Bottom line: Authorization testing is getting cheaper, which means the quality of validation now matters more than the volume of candidate findings.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →