3 ms·
Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.
by malfist 3y ago
Why would you expect that? LLMs are explicitly trained on what humans do. Humans miss security vulnerabilities all the time.
- toomuchtodo 3y agoBecause the LLM based appsec products I've tested on a large code base have been very good at finding what devs and appsec code reviews didn't.
- reitzensteinm 3y agoWhich ones, out of curiosity?
- dnedic 3y agoHumans can't be forced to evaluate every piece of code 100000 times in an hour. LLMs can.
- philipwhiuk 3y agoWith infinite hardware, sure. LLMs are pretty expensive to run vs fuzzing.
- ZiiS 3y agoHumans find security vulnerabilities all the time too. The assumption is a lot of the misses are because highly trained security experts don't have time to carefully read and understand all code without fatigue.
- xeckr 3y agoBecause of generalization.