Post #4281672
2026-07-31 14:42 UTC
@Sempf@infosec.exchange (Serious take) Again? Static analysis in a box has been a thing for such a long time. I've been playing around with some AI tools for static analysis on binaries a bit this summer and there's some definite benefit for streamlining the reversing process, but source code analysis? That strikes me as something non-AI solutions were pretty good at.
Replies (1)
-
@Sempf@infosec.exchange 2026-07-31 15:03
@nerdpr0f@infosec.exchange Yeah, but AI is really, really good at it. The ML layer can follow business logic, and then use the model to compare to "known good examples" (for certain values of good). I have had it find things that Snyk and my own manual review have missed a number of times now. BUT, still. It's product creep, you ain't joking. "Don't we have one of those?" has been my answer so far. I mean, all the existing, vetted static scanners have AI features now, just use them!