My experience with LLM Code Review vs Deterministic SAST Security Tools

TLDR: LLMs generally perform better than existing SAST tools when you need to answer a subjective question that requires context (ie lots of ways to define one thing), but only as good (or worse) when looking for an objective, deterministic output. AI is all the hype commercially, but at the same time has a pretty negative sentiment from practitioners (at least in my experience). It’s true there are lots of reason NOT to use AI but I wrote a blog post that tries to summarize what AI is actually good at in regards to reviewing code. submitted by /u/prestonprice [link] [comments]Technical Information Security Content & DiscussionRead More