Grounding Generative AI in the Realities of Application Security

Recent and numerous reports have detailed the security scanning capabilities of frontier AI models, starting with Claude Mythos and followed by others; these reports have ignited widespread discussion in cybersecurity circles. Demonstrations showing AI agents autonomously identifying complex zero-day vulnerabilities, building exploit chains, and recommending fixes have led some to declare traditional application security testing is deprecated or somehow obsolete.

However, enterprise application security requires a grounded, practical evaluation. While frontier AI models represent a major step forward in security analysis, any suggestion that probabilistic models will replace deterministic Static Application Security Testing (SAST) engines ignores mathematical limits, fault-tolerance engineering principles, and operational economics.

Frontier AI Models & Vulnerability Scanning: Hype vs Reality

The narrative surrounding Mythos and other frontier AI models has focused on the headline-grabbing achievements, like finding deep logic flaws in open-source projects or crafting zero-day proof-of-concept exploits. While impressive by themselves, they can also overshadow a crucial distinction between novel threat research and scalable enterprise software assurance.

The narrative is often described this way, “AI models find bugs that scanners missed for years, rendering traditional static analysis obsolete.” Statements like these hide an important truth however, that vulnerability research in an isolated benchmark is fundamentally different. The engineering reality is running fast, repeatable, cost-effective security gates across thousands of continuous code commits, daily. A more practical understanding requires proper context; that deterministic tools provide predictable baseline compliance, while probabilistic AI models enable extended semantic reasoning.

Theoretical Foundations: The Mathematical Limit of Verification

A central principle of software verification is that no algorithm or computing system can be both complete and consistent when analyzing non-trivial program behavior. This is not a limitation of current technology; it is an unbreakable mathematical principle established by four foundational theorems:

1. Gödel’s Incompleteness Theorems (1931): Proved that any formal axiomatic system capable of arithmetic cannot be both complete (able to prove all true statements) and consistent (free from contradictions).
2. Turing’s Halting Problem & Church’s Thesis (1936): Established that it is mathematically impossible for a general algorithm to determine whether an arbitrary program will halt or enter a specific state.
3. Rice’s Theorem (1953): Extends Turing’s work to software analysis, proving that any non-trivial semantic property of a computing system is undecidable.
4. See ‘Church’s Thesis’ above (ii.).

These mathematicians mapped the outer limits of what systematic, algorithmic reason can and can’t achieve. They proved a boundary existed and showed exactly where it is. Specific details and blog available here.

Implication for Security Scanners

Because "exploitability" and "vulnerability" are semantic properties of a program, no engine or algorithm, whether a rule-based SAST analyzer or an 8-trillion-parameter neural network, can ever be both 100% complete AND 100% consistent.

Every scanner makes trade-offs. Deterministic tools trade semantic intuition for mathematically sound boundaries and consistency. Probabilistic AI tools trade repeatability and speed for broad semantic pattern matching.

Force Multiplier: Deterministic SAST and Probabilistic AI Models

Here’s the key. Understanding how these paradigms differ helps illustrate how modern enterprise application security testing will benefit from each in different ways:

Resilience Demands Fault-Tolerance Engineering

An application security testing program overly reliant on probabilistic AI tools violates a basic systems engineering principle. If a security scanner's output is inconsistent and varies from run to run, it cannot serve as a trustworthy automated quality gate (i.e. “free from contradictions”) for production code releases. AI models alone leave programs vulnerable to deterministic blind spots, such as where a minor code reformatting change causes the model's attention mechanism to miss a flaw it detected the day before.

Meeting resilience objectives are going to require a two-tier architecture with fault-tolerance engineering and multi-stage workflows:

1. Stage 1 | Grounded Foundation: Deterministic SAST serves as the primary build gate, enforcing organizational security policies and compliance baseline rules without hallucinations.
2. Stage 2 | Context Enrichment: Wrapping probabilistic AI models inside verification boundaries where, for example, AI recommendations are checked against static analysis call graphs before triggering developer alerts.

Another core tenet of resilience is Agile development practices at enterprise scale. Agile development requires security tooling that moves at the speed of CI/CD. Deterministic static security testing remains indispensable to CI/CD pipelines for several key reasons:

1. Continuous Guardrails: Runs automatically on every local commit or pull request, giving developers instant feedback.
2. Standardized Categorization: Classifies issues rigorously by data-flow sources, sinks, and sanitizers generating immediate risk information.
3. Agile Security Gates: Allows security teams to set pass/fail build criteria based on deterministic policy rules (i.e. “Fail build if High-Severity SQL Injection is found”).

Leveraging the strengths of each with additional automation and governance is a roadmap to desired outcomes, but not of course without first evaluating the cost considerations.

Financial Breakdown, Unit Economics, and Risk Impact

Considering financial and operational perspectives, AI security scanning can face economic challenges when scaled across enterprise codebases, as this example 3-Year Total Cost of Ownership (TCO) model illustrates:

* Example estimates based on # of code commits and 10,000 LoC average.

1. Verification Tax: Unfiltered AI findings require manual engineering verification. If an AI tool flags 50 complex warnings that take security engineers 45 minutes each to investigate, triage labor costs quickly exceed software licensing expenses.
2. Compute Run-Rate: Running extended reasoning loops on millions of lines of code for every pull request is cost-prohibitive compared to deterministic AST scanning.
3. Compliance Assurance: Deterministic scanning provides explicit CWE categorization and OWASP compliance mapping required by auditors and regulatory frameworks (such as FedRAMP, PCI-DSS, and ISO 27001). Probabilistic AI models excel at explaining how an exploit works but fail at standardized compliance assurances.

While these TCO estimates are a simple example, they clearly demonstrate utilizing the right approach at the right time for the right reasons not only makes logical sense but also represents the most cost-effective option.

Achieving Desired Outcomes

Media headlines will continue to trumpet AI as an all-powerful silver bullet. But as theoretical computer science proves, no single model can validate software security alone. The future of enterprise application security is the strategic fusion of both deterministic and probabilistic processes. By grounding your AppSec strategy in deterministic rigor while leveraging AI for agentic reasoning, security leaders can build resilient, scalable, and mathematically sound defense programs in compliance with NIST SP800-218 Secure Software Development Framework guidelines.

As the recognized leader in AppSec, Fortify SAST by OpenText lays the grounded foundation for secure software by pinpointing deep code vulnerabilities early in the development pipeline. Paired with its AI-powered analyzer, development teams can cut through the noise, dramatically reducing false positives and automating time-consuming remediation tasks. Fortify’s new agentic analysis capabilities deploy autonomous, reasoning-driven AI agents that actively trace complex, multi-step attack vectors and adapt to dynamic application behaviors, giving organizations the speed, accuracy, and confidence to ship resilient code at modern DevSecOps velocity the mission requires.

To improve and optimize your department’s AppSec program, ground your GenAI adoption in reality with Fortify.