Frontier models can detect real vulnerabilities at scale. They reason across application logic, analyze authorization flows, identify multistep vulnerabilities, and propose context-aware remediation. That capability is real. But it can lead to a risky conclusion: that frontier model scanning alone can carry the weight a layered defense was built to distribute.
Detection and assurance are separate problems, and that is where risk enters the picture. AI excels at deep reasoning on complex logic, but an application security program ensures repeatable coverage across every repository, every commit, and every release, producing findings you can measure, track, and defend. Finding a vulnerability once is one thing; assuring an enterprise against it continuously is another.
Managing application risk across an enterprise demands coverage, consistency, governance, and evidence. Adaptive reasoning satisfies only part of that on its own. AI is strong, but assurance is a different discipline with its own requirements.
AI can analyze code, but CISOs must assure the program
A custom AI workflow can inspect a repository, find a defect, explain its impact, and generate a fix. For an individual developer, that is valuable. But a CISO owns something broader than any single scan can produce.
Security leaders must know which applications are being assessed, whether the right methods were applied, and whether material findings were remediated, mitigated, or formally accepted. They must enforce policy, measure risk across the portfolio, and produce evidence for customers, auditors, regulators, and the board. Two requirements make that possible, and both are where AI needs augmentation today.
- Determinism. Governance depends on repeatable findings—the same code assessed twice yields the same result. AI analysis is probabilistic by design; findings vary across consecutive runs because the model works through the code independently each time. That variability is an asset for novel-defect discovery, but it’s a liability for a system of record. Audit trails, remediation tracking, and regulatory attestation all rest on a stable baseline, and a baseline that shifts between scans undercuts each of them.
- Cost atfrequency. Assurance means testing at commit, pull request, merge, and in CI, continuously, across the whole portfolio. AI scans are materially more expensive than deterministic static analysis, often cited at an order of magnitude, and that gap compounds with every gate you add. As the primary detection layer, AI strains the economics that frequent testing depends on.
A custom workflow can address some of this. But that means developing and maintaining the prompts, agents, integrations, security intelligence, policy logic, evidence repositories, exception processes, and reporting to run it reliably. And at that point the organization has moved past building a workflow. It is building and maintaining its own application security platform, at the cost and complexity a platform was meant to spare it.
When the same AI writes and checks the code
As AI generates a fast-growing share of production code, using the same class of AI model to test that code creates a self-referential oversight. The reasoning that introduced a flaw may be the reasoning that ignores it. Independent, deterministic verification becomes essential here; it is the control that breaks the loop.
Defense in depth comes from different methods, not more models
Organizations may reach for multiple AI models to widen coverage. Model diversity has some value, since different models identify different issues. But models querying the same source, under similar architectural assumptions, with limited runtime visibility, tend to share failure conditions. A second AI reader over the same context repeats the analysis rather than deepening it.
Defense in depth comes from combining methods with genuinely different failure modes. What one misses, another catches.
- Static analysis for fast, deterministic, repeatable detection
- AI reasoning for business logic and complex vulnerability chains
- Software composition analysis for open source, license, and supply chain risk
- Dynamic analysis for vulnerabilities visible only at execution
- Interactive analysis and fuzzing for runtime and protocol coverage
- Centralized policy and reporting for enterprise governance
The aim is resilience through independent methods, so that no single method, model, or source of evidence carries the program alone. Using AI to reason and Black Duck to assure creates a program a CISO can defend to a board, an auditor, and a customer.
