Why an AppSec agent should try to disprove its own findings

Originally published on sechelix.com. This is a syndicated copy; the canonical version lives there. The failure mode nobody optimises for Point a capable model at a codebase and ask it to find securit