AI safety needs a second opinion – Unite.AI

AI is writing software faster than we can secure it. Are you keeping up?

By the time you finish reading this sentence, developers and their AI agents will have made a couple thousand code commits. Last year at this time there would have been around 150.

The past year has seen AI-generated software accelerate to astonishing levels. GitHub recorded 7.38 billion commits in September 2026 alone, more than five times the previous year’s total. The security implications of this explosion are profound. Each of these commits is code that someone should understand, maintain, and protect. The Cloud Security Alliance found that AI-assisted developers at Fortune 50 companies committed three to four times more code than their peers, while their monthly security results increased about tenfold.

Now let’s consider who will inherit that increase. The CISO team is the same size as a year ago, but the backlog is not. Vulnerability reports are increasing, monthly fixes are decreasing, and unresolved issues are expanding. It’s no wonder Gartner says CISO burnout is becoming a critical operational risk.

The temptation of the latest model

When the number is that big, the instinct is to chase a bigger one: more hits, more coverage, more scans. But that’s like saving a sinking boat and asking for a bigger bucket when what you need is to find the leak. A security program is not measured by what it finds. It is measured by how much of what it finds is real and how many of the most critical findings are actually resolved.

Frontier AI models are amazing at finding new exploits and flaws not cataloged with probabilistic reasoning. But the results vary. According to Checkmarx research, run the same scan on the same code five times and the results only match about a third of the time.

This inconsistency is why rules-based analysis is still important. It’s less flexible than frontier AI, but applies proven logic the same way every time, so teams can trust and verify the results. AI detects what the rules miss, such as familiar weaknesses in unfamiliar forms or flaws that only become exploitable when separate parts of the code interact. Together, AI and rules-based analytics surface what matters, with fewer false alarms.

None of this is an argument against AI. It’s an argument that security needs a second opinion. Whichever engine you choose, keep it to three questions.

Question one: loyalty

When the scanner says something is wrong, is it worth your time?

Loyalty is trust. A discovery that isn’t real costs the developer an afternoon and costs security a little more credibility. At scale, false positives are what prevent teams from listening. The alerts are simply “crying wolf” and fade into a static background.

This is where consistency matters. Deterministic analysis returns the same answer on the same code every time, which builds trust and makes the results verifiable.

Question two: accuracy

Are you finding the full set of issues that matter most?

Fidelity tells you whether a discovery is worth your time, but it doesn’t tell you what the scanner missed. We use an operational measurement with origins in data science called F1 score. F1 rates performance on a scale of 1 to 0, based on two factors:

• Precision: the percentage of reported results that are real. High accuracy means fewer false alarms.
• Reminder: the share of real vulnerabilities actually detected by the scanner. High recall means few errors.

A scanner may seem precise by reporting almost nothing, or thorough by reporting everything, with low F1 scores for both. The industry average is around 0.20. We worked hard on this challenge and found results that are three to four times more accurate than a standard scanner.

Better precision makes everything easier for developers. Your team spends less time validating and more time fixing.

Question three: ROI

How do we maximize investments and resources?

This question is the one most often skipped over in the pilot and most painfully answered in production.

Frontier models bill on a per-token basis, and tokens are spent regardless of whether a scan finds anything or not. Scanning a million-row archive costs more than a thousand dollars at current published prices. And the gap between the use of model tokens is wide; the price varies depending on the model chosen and how much you have to think to finish your job.

Multiply that by every commit, pull request, and repository in a company. Uber, which spends $3.4 billion a year on research and development, reportedly blew out its entire 2026 AI budget within months of rolling out AI coding tools.

We call it a symbolic tax. It’s like taking a Ferrari to go shopping: you pay for energy that the trip doesn’t need. Hard-coded credentials and SQL injection are predictable patterns that deterministic analysis reliably covers.

AppSec must evolve

This is the reasoning behind the Checkmarx Fusion architecture. Rule-based engines establish the reality of the facts, reproducibly and at lower cost than token-based analysis. Frontier models are aimed at what the rules cannot anticipate: novel models, complex logic, exploitability in context. Then a level of results analysis merges the results into a single reliable set.

Determinism provides certainty. AI provides the reach. Coverage and trust grow together. Compared to an LLM working alone, we see up to four times greater fidelity, two to four times greater accuracy, and about a third of the cost.

Finding problems is just the beginning. The same logic applies to prevention. Let’s take an example. By giving developers more power at the point of creation, in the IDE where they write code, we can stop problems before they arise. Likewise, when it comes to vulnerabilities that do manage to surface, why not provide developers with ready-to-merge fixes for the ones that matter most? These are the challenges we are solving, with the goal of eliminating the existing backlog, to achieve the fastest impact with the least effort.

The code is running. Can you keep up?

Artificial intelligence has given attackers the gift of speed. The way to bridge this gap is not one more tool. It’s a decision about how the entire organization creates and secures software. Code written today will run your business for years. The question for security leaders is no longer how much AI can help you build faster. The question is whether your programs can keep up with what they create.

So don’t get lost in the numbers. Ask any program three questions: Can I trust what it finds? Find enough of what matters? Is it realistic to implement it in my organization? Pairing deterministic precision with frontier reasoning gives you the best chance of answering yes to all three.

The software does not slow down. Our job now is to close the risk gap: the distance between how quickly software is created and how quickly risk is identified and resolved.