ai has made vulnerability discovery much cheaper.
it has not made security judgment cheap.
agents can explore thousands of paths, read enormous amounts of code, and generate more leads than a human team could review.
they can also misunderstand test data, inflate impact, confuse public behavior with a security boundary, and confidently report nonsense.
the winning system is not the one that generates the most findings.
it is the one that can prove which findings are real.
codex subscriptions have saved us an unreasonable amount of money.
we built a router that sends each security run to whichever subscription currently has quota available.
one full luna max run uses roughly 0.33% of a subscription’s usage.
at that rate, a full quota reset is enough for around 300 security runs per subscription.
and with the number of resets tibo keeps handing out, this has turned into a ridiculous amount of inference.