思想领袖
AI 安全需要第二意见
在 Google 上的首选来源中添加 Unite.AI
AI写软件的速度比我们能保证的要快。 你跟上了吗？
当你读完这句话时，开发商和他们的AI agents 将推动几千个代码承诺。 去年这个时候，大概是150个。
去年AI生成的软件加速到惊人的水平。 仅2026年9月，GitHub就记录了73.8亿美元承付额，比一年前的总额高出五倍多。 这次爆炸对安全的影响是深远的。 每一个犯案都是暗号应该有人理解维护安全 Cloud Security Alliance发现"财富50"公司的AI协助开发商以3到4倍于同行的速率承诺代码，而他们的每月安全调查结果则上升了大约10倍。
现在想想谁继承了这个增加。 CISO的团队规模与一年前相同，脆弱性问题呈上升趋势，每月纠正措施下降，尚未解决的批评意见正在扩大。 难怪Gartner 称 CISO的燃烧正在成为一种关键的操作风险。
最新模式的诱惑
当数字这么大的时候，本能就是追逐一个更大的数字：更多的发现，更多的覆盖，更多的扫描。 但是这就像保释一艘沉船，一个安全程序不是用发现多少来衡量的。 以发现究竟有多少真实存在
Frontier AI模型在发现有概率推理的小说利用和未编目的缺陷方面非常出色。 但结果各不相同。 根据Checkmarx的研究，在同一代码上进行5次同样的扫描，结果只匹配大约三分之一的时间。
这种不一致是基于规则的分析仍然重要的原因。 与前沿AI相比，AI捕捉到规则错过的，比如在不熟悉的形式中熟悉的弱点，或者缺陷，这些缺陷只有在代码的不同部分相互作用时才会被利用。 AI和基于规则的分析加在一起，揭示了更多重要的事物，并减少了虚假的警报。
这些都不是反对大赦国际的论据。 安全需要另一种看法。 无论你选择的引擎，坚持它三个问题。
问题一：忠诚
当扫描仪称出问题时，你值得吗？
忠诚就是信任。 一个真实的发现不会花费一个开发商一个下午，在规模上，假阳性是使得团队停止倾听的原因。 警报只是“哭狼”和逐渐消失为背景静态。
一致性就在这里。 定型分析每次在同一代码上返回相同的答案，这建立了信任并使结果可以审计。
问题二：准确性
你找到最重要的问题了吗？
菲德尔告诉你一个发现是否值得你花费时间，我们使用一个工作测量数据科学的起源叫做F1分。 F1基于两个因素，按1-0的比额计算业绩：
- 精确度：报告的调查结果中真实的比例。 高精度意味着假警报更少。
——回顾：扫描仪实际为发现的实际弱点份额。 高召回意味着小滑倒通过。
扫描仪可以通过标注几乎一无所获，或者通过标注所有东西进行彻底扫描，两者的F1分数都很低，可以看清准确。 工业平均水平约为0.20. 我们一直在努力应对这一挑战，并且看到的结果是标准扫描仪的准确度的3至4倍。
更好的准确性使下游的一切对开发者更容易。 你的团队花的时间更少验证和更多的时间固定。
问题三：ROI
我们如何最大限度地增加投资和资源？
这个问题在飞行员中是最常被忽略的，在生产中最痛苦地得到回答。
代号下的边疆模型帐单，无论是否扫描发现任何东西，代号都会花费。 扫描一个100万行的存储器，按目前公布的价格计算，耗资超过1000美元。 而模型的符号使用差距很大；价格因你选择的模型以及完成你的工作需要多少理由而不同。
乘以每个承诺，拉请求和存放在一个企业。 Uber每年在研发上花费34亿美元，据报道在推出AI编码工具后数月内耗尽了2026年AI的全部预算。
我们把这叫做象征性税这就像搭乘法拉利来买东西一样：你支付旅行不需要的电费。 硬码证书和SQL注射是可预见模式，可以可靠地涵盖确定性分析。
AppSec 需要进化
这就是Checkmarx Fusion架构背后的推理。 基于规则的引擎建立地面真实性，可以复制，并且以较少的代价进行象征性的分析。 边疆模式的导向是规则无法预料的：新模式、复杂逻辑、环境可开发性。 然后一个结果分析层将结果导入一个信任的集合。
决定性提供了确定性。 AI提供范围。 覆盖率和信任度一起上升。 LLM独自工作，我们看到最多4倍的忠诚，2至4倍的准确性，以及大约1/3的成本。
找到问题只是开始。 同样的逻辑也适用于预防。 让我们举个例子。 通过在创建点赋予开发者权力，在他们写代码的IDE中，我们可以在问题开始前阻止问题。 类似地，当涉及到确实能够克服的弱点时，为什么不为开发者提供那些最重要的合并准备的解决方案呢？这些都是我们正在解决的挑战，目标是消除现有的积压，以便以最小的努力产生最迅速的影响。
代码是运行。 你能继续吗？
AI给予攻击者速度的天赋。 缩小这一差距的方法并不是再用一个工具。 这是关于你整个组织如何建造和保障软件的决定。 今天正在写的代码将运行您的业务多年。 安全领导的问题不再是AI帮助你建设的速度有多快。 您的节目能否跟上它所创造的东西。
因此，问任何节目的三个问题：我能相信什么是发现吗？它觉得什么重要吗？我整个组织执行是否现实？精确的判断力与边界推理让你有最好的机会回答所有三个是。
软件并没有减速。 我们现在的工作是缩小风险差距：建立软件的速度与发现和固定风险的速度之间的距离。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Thought Leaders
AI Security Needs a Second Opinion
Add Unite.AI to your preferred sources on Google
AI is writing software faster than we can secure it. Are you keeping up?
By the time you finish reading this sentence, developers and their AI agents will have pushed a couple thousand code commits. Last year at this time, it would have been about 150.
The past year has seen AI-generated software accelerate to astonishing levels. GitHub recorded 7.38 billion commits in September 2026 alone, more than five times the total from a year earlier. The security implications of this explosion are profound. Every one of those commits is code someone is supposed to understand, maintain, and secure. Cloud Security Alliance found that AI-assisted developers at Fortune 50 companies commit code at three to four times the rate of their peers, while their monthly security findings rose roughly tenfold.
Now consider who inherits that increase. The CISO’s team is the same size it was a year ago, but the backlog is not. Vulnerability submissions are rising, monthly fixes are falling, and unresolved criticals are expanding. It’s no wonder that Gartner says CISO burnout is becoming a critical operational risk.
The Temptation of the Latest Model
When the number is that big, the instinct is to chase a bigger number: more findings, more coverage, more scans. But that’s like bailing a sinking boat and asking for a bigger bucket when what you need is to find the leak. A security program isn’t measured by how much it finds. It’s measured by how much of what it finds is real, and how many of the most critical findings actually get fixed.
Frontier AI models are remarkable at finding novel exploits and uncatalogued flaws with probabilistic reasoning. But results vary. Run the same scan on the same code five times and the findings match only about a third of the time, according to Checkmarx research.
That inconsistency is why rules-based analysis still matters. It’s less flexible than frontier AI, but it applies proven logic the same way every time, so teams can trust and verify the results. AI catches what rules miss, like familiar weaknesses in unfamiliar forms, or flaws that only become exploitable when separate parts of the code interact. Together, AI and rules-based analysis surface more of what matters, with fewer false alarms.
None of this is an argument against AI. It’s an argument that security needs a second opinion. Whatever engine you choose, hold it to three questions.
Question One: Fidelity
When the scanner says something is wrong, is it worth your time?
Fidelity is trust. A finding that isn’t real costs a developer an afternoon and costs security a little more credibility. At scale, false positives are what make teams stop listening. The alerts are just “crying wolf” and fade into background static.
This is where consistency matters. Deterministic analysis returns the same answer every time on the same code, which builds trust and makes results auditable.
Question Two: Accuracy
Are you finding the complete set of issues that matter most?
Fidelity tells you whether a finding is worth your time, but it doesn’t tell you what the scanner missed. We use a working measurement with origins in data science called an F1 score. F1 rates performance on a scale of 1-0, based on two factors:
- Precision: the share of reported findings that are real. High precision means fewer false alarms.
- Recall: the share of real vulnerabilities the scanner actually finds. High recall means little slips through.
A scanner can look precise by flagging almost nothing, or thorough by flagging everything, with low F1 scores for both. The industry average is about 0.20. We have been working hard on this challenge and have seen results that are three to four times the accuracy of a standard scanner.
Better accuracy makes everything downstream get easier for developers. Your team spends less time validating and more time fixing.
Question Three: ROI
How do we maximize investment and resources?
This question is the one most often skipped in the pilot and most painfully answered in production.
Frontier models bill by the token, and tokens are spent whether or not a scan finds anything. Scanning a one-million-line repository costs more than a thousand dollars at current published prices. And the gap between models’ token use is wide; price varies depending on the model you choose and how much it has to reason to finish your job.
Multiply that across every commit, pull request and repository in an enterprise. Uber, which spends $3.4 billion a year on R&D, reportedly exhausted its entire 2026 AI budget within months of rolling out AI coding tools.
We call this the token tax. It’s like taking a Ferrari to pick up groceries: you’re paying for power the trip doesn’t need. Hardcoded credentials and SQL injection are predictable patterns that deterministic analysis covers reliably.
AppSec Has to Evolve
This is the reasoning behind the architecture of Checkmarx Fusion. Rules-based engines establish ground truth, reproducibly and at less cost of token-based analysis. Frontier models are directed at what rules can’t anticipate: novel patterns, complex logic, exploitability in context. Then a findings analysis layer fuses the results into one trusted set.
Deterministic provides certainty. AI provides reach. Coverage and trust rise together. Against an LLM working alone, we see up to four times the fidelity, two to four times the accuracy, and roughly a third of the cost.
Finding problems is only the start. The same logic applies to prevention. Let’s take an example. By empowering developers at the point of creation, in the IDE where they write the code, we can stop problems before they start. Similarly, when it comes to the vulnerabilities that do get through, why not provide developers with merge-ready fixes for the ones that matter most? These are the challenges we are solving for, with the goal to chip away at the existing backlog, for the quickest impact with the least effort.
The Code Is Running. Can You Keep Up?
AI gave attackers the gift of speed. The way to close that gap isn’t one more tool. It’s a decision about how your whole organization builds and secures software. The code being written today will run your business for years. The question for security leaders is no longer how much faster AI helps you build. It’s whether your programs can keep pace with what it creates.
So don’t get lost in the numbers. Ask three questions of any program: Can I trust what it finds? Does it find enough of what matters? Is it realistic to implement across my organization? Pairing deterministic precision with frontier reasoning gives you the best chance of answering yes to all three.
Software isn’t slowing down. Our job now is closing the risk gap: the distance between how fast software is created and how fast risk gets found and fixed.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.