Current methods of prioritizing vulnerabilities are falling flat, with too many false positives, poor prioritization, and a failure to take into account reachability.
So far, large language models (LLMs) have not really helped.
In tests of more than a dozen application-scanning tools, more than 60% of flagged vulnerabilities continue to be false positives, are in unreachable code, or are low severity, says Arshan Dabirsiaghi, chief technology officer and co-founder at Pixee, an AI-powered application-security (AppSec) startup. In a presentation at Black Hat USA in August, Dabirsiaghi plans to detail results from those tests and show that the lack of context in stock models means that AI models are not the solution.
The situation poses a problems for security teams trying to triage issues, he says.
“Companies have this insane choice where they can have Dependabot come in and constantly update all your dependencies and you’re going to spend all your build minutes … flooded with [pull requests, or PRs] every day, all day,” Dabirsiaghi says. “Or you can have a human look at every vulnerability and try to discover which of the 8% are actually vulnerable. Companies don’t remotely have the manpower to scale that.”
Foundational AI models are creating significant issues for AppSec teams. The number of valid vulnerabilities is surging, with the Forum of Incident Response and Security Teams (FIRST) estimating that issues assigned a Common Vulnerabilities and Exposures (CVE) identifier will jump 50% this year, with Microsoft setting records for its Patch Tuesday volumes. At the same time, the technology has not proven significantly better at finding vulnerabilities, often running slower and with more cost than established tools. While the latest models, such as Anthropic Mythos, are great at finding vulnerabilities, they still require a great deal of human checking and oversight.
‘LLMs are Dumb’
The problem is that large language models and more advanced AI tools are still being taught the right way to analyze vulnerabilities, and even the models most tailored to developers are still generalists compared to task-specific scanning tools. Finally, to be really useful, companies need to provide a great deal of context to the models about their software and deployment environments as well as create the right set of tools — the harness — around the AI models, says Dabirsiaghi.
“LLMs are dumb — it’ll just say there’s a vulnerability on line X, and it’ll go fix it even if it’s not real,” he says. “If you allow it to do that, you will harm the quality, the performance, and the security [of the application]. You can screw yourself on security by over-fixing, and so that leads to low merge rates and low trust.”
Good triage needs three sorts of context to find true vulnerabilities: organizational context, the technical context, and the wider code context, Dabirsiaghi says. The use of MD5 hashing in an application, for example, is often set by default at a medium severity, but in reality, it should be either low or high, he says.
“It’s either a high, because you’re using it to hash passwords or some secrets and that’s really the worst thing you can do with MD5, or you’re using MD5 for its collision resistance in some non-security context, and it’s actually a low or a false positive,” he says.
Fixing Vulnerability Triage
Beyond verifying vulnerabilities and assigning a severity, the key method to whittle down the number of weaknesses that an application-security team needs to patch is reachability. While there are a variety of ways to measure reachability, the results are almost always a significant reduction in the amount of code that needs to be scanned. One study found that 62% of open source libraries are never used at runtime, while another found that of the 71% of Java code that is open source, only 12% of that code is used.
Finally, AppSec professionals need to have a set of support functions and a harness that makes the results of a scan more deterministic. Otherwise, LLMs will often find a different set of vulnerabilities each time they are run, says Dabirsiaghi.
“It’s very jarring to people when you run something, and it says it’s a false positive, and then you run it again, and it says it’s a true positive,” he says. “LLMs can take the same set of facts and argue them to different conclusions.”
Dabirsiaghi will present the results of his tests and give recommendations for improving code scans and classification during his session, “Beyond Detection: What We Learned Testing Every AI Approach to Vulnerability Classification.”
