Post #4282123
2026-07-31 15:03 UTC
@nerdpr0f@infosec.exchange Yeah, but AI is really, really good at it. The ML layer can follow business logic, and then use the model to compare to "known good examples" (for certain values of good). I have had it find things that Snyk and my own manual review have missed a number of times now.
BUT, still. It's product creep, you ain't joking. "Don't we have one of those?" has been my answer so far. I mean, all the existing, vetted static scanners have AI features now, just use them!
Replies (1)
-
@nerdpr0f@infosec.exchange 2026-07-31 15:14
@Sempf@infosec.exchange I'm increasingly thinking that two of the biggest problems at the moment are the general lack of understanding of tech and an inability to detect social engineering. My discussions have been: 1) Do a feature comparison. Does the AI-enabled system win out? 2) How much does it win by and in what areas? 3) How much does it cost, looking at maybe a 5 year timeline, assuming rising costs when the subsidies companies are providing go away? 4) How does the cost compare to non-AI platforms? 5) How does the differential compare to risk reduction and/or operational costs elsewhere? Most folks get hung up on 3.