Topic starter
25/10/2026 11:02 am
TL;DR: 39% F1 shows how cheaply authorization bugs can be surfaced, in Nullify's case work and data set. Authorization validation now decides which candidate hits are real access-control breaks and which are expected outcomes.
Editorial analysis by NHI Mgmt Group, based on content published by Nullify: “The Cheapest Way to Hunt Authorization Bugs Now Costs $0.17. That's the Problem.”.
By the numbers:
- GLM-5.2 scored 39% F1 on IDOR and authorization-vulnerability detection.
- The model found vulnerabilities at roughly $0.17 per vulnerability found.
Key questions
Q: Why do cheap authorization scanners produce so many false positives?
A: Because many authorization failures are only visible when you reason about intent, ownership, and tenancy.
Q: How can teams tell a real IDOR from intended shared access?
A: Compare the observed response against the application’s role and object model, not just the status code.
A: Start by defining the access model the application is supposed to enforce.
Practitioner guidance
- Define the application’s intended access states Document which roles, tenants, and user states can see which objects before automated testing begins.
- Separate exploit generation from exploit validation Keep the high-volume probe stage and the decision stage independent so a fast model cannot self-certify weak evidence.
- Treat 200 OK responses as evidence, not proof Inspect response bodies, resource ownership, and state transitions before classifying a hit as a real authorization failure.
Bottom line: Authorization testing is getting cheaper, which means the quality of validation now matters more than the volume of candidate findings.
Glossary terms: Authorization Model, IDOR, False Positive Validation, Tenant Isolation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
27/10/2026 7:14 pm
Authorization testing has crossed the cost threshold where discovery is no longer the scarce capability. When a cheap model can hunt IDOR and broken access control at scale, the limiting factor shifts from finding candidates to deciding which ones are real. That changes the identity governance conversation from scarcity to assurance. Practitioners should assume more automated probing, not less, and treat validation quality as the control that now carries the burden.
A question worth separating out:
Q: How do you reduce false positives in automated authorization testing?
A: Use a second review step that re-reads the evidence against the inferred authorization model before findings reach a human. The reviewer should be able to overturn a fast exploit result when the access was public, self-directed, or otherwise allowed. That is how scale stays trustworthy.
👉 Read our full editorial: Authorization bug hunting gets cheaper, but validation becomes decisive
This post was modified 7 days ago by NHI Mgmt Group