VulnSAGE: Adjudicating SAST Reports by Connecting LLM Reasoning to Program Structure
VulnSAGE pairs LLM-driven reasoning with program-graph context to slash SAST false-positive rates—a practical accelerator for DevSecOps teams drowning in noisy scanner output.
Summary written by editorial AI · Source link below
arXiv:2610.23035v1 Announce Type: cross Abstract: Static Application Security Testing (SAST) reports flag operations whose safety depends on project-specific context, and maintainers must decide which reports describe real defects. Large language models (LLMs) can interpret this context, but adjudicating a report with them requires the decisive code, which often lies far from the reported line, and a decision basis that program analysis can check. We present VulnSAGE, an adjudication system for
Editorial Analysis
High false-positive rates in SAST tooling erode developer trust and slow remediation; LLM-augmented triage could reclaim significant engineering bandwidth.
Evaluate integrating LLM-assisted SAST adjudication into CI/CD pipelines to reduce triage burden and accelerate fix cycles.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at arXiv Crypto & Security in a new tab.
More from the DevSecOps Desk
- A Protected Browser Doesn't Mean Your Enterprise Is Remediated3d
- No Edges, No Verdict: A Large-Scale Empirical Study of Declared Dependency Graphs in 78K SBOMs in the Wild4d
- Railway warns devs to rotate secrets after potential breach4d
- The Limits of Fingerprint Blocklists: A Reproducible Java Certificate Bypass5d
- eMudhra CA Incident: Sonatype's Assessment and Guidance5d