TL;DR: Agentic Code Scanning is the fourth dimension of Cycode’s code scanning spectrum, not a separate product bolted on. Deterministic SAST, AI SAST, SAST + AI Exploitability, and Agentic Code Scanning run as one single system that decides what runs where, so you stop trading precision vs. cost vs. model. It caught both authorization CVEs in our benchmark that no rule engine can express, and all on an affordable open-weights model.
When you look at what security teams are dealing with, one thing stands out: attackers and defenders don’t pay the same price to find, fix, or exploit vulnerabilities with AI.
An attacker just needs one path, just once, in just one repo. All while you need every path, continuously, across most of your repos. These are the same models used, just different bills.
This is also likely why you’ve experienced the debate around Frontier or cheap models? Do we run it on every commit, nightly or weekly? Do we scan every repo or just what we think are the crown jewels? What do we tell the auditor about which model produced which finding? And what happens in six weeks when a better model ships and the whole calculation resets?
Every one of those questions is a symptom of the same thing: having exactly one instrument and trying to make it do every job. Point a frontier model at everything and the bill compounds with every commit. Point rules at everything and you’re structurally blind to an entire class of vulnerability. Neither is a good strategy.
It’s about a holistic system that determines when models run, when they don’t, which ones to use, and distills expensive AI analysis into low-cost self-improving rules that optimize the system over time.
The Cycode Holistic Code Defense Dimensions
Cycode runs four dimensions of scanning against the same code, reconciled into one overview of risk. Let’s run through each of the dimensions below:
| The System’s Scanning Dimensions | How it Works | Where it Runs | Use it When |
|---|---|---|---|
| Dimension 1: Deterministic SAST (Rule-Based Scanning) | Pattern matching and taint rules | IDE, MCP, pre-commit, blocking PR gate. Sub-second on a diff, identical every run | Always. It’s the only tier fast and reproducible enough to block a merge on |
| Dimension 2: AI SAST (Self-Improving Scanning) | An LLM generates, updates, and customizes new deterministic SAST rules | Same as Dimension 1 — the output is still rules | You want rule-based scanning that self-improves over time |
| Dimension 3: SAST + AI Exploitability (Rules, Then AI as Triage) | A rule engine finds and an Agent triages, ranks, and argues exploitability | After the scan, before the queue reaches a developer | You have a backlog nobody works. It fixes noise, but it isn’t an AI strategy on its own |
| Dimension 4: Agentic Code Scanning (System Around the Model) | Plans from a threat model, ranks what the model reads per class, then disproves every finding | Above all three, deciding what runs, in what order, on what budget | Multi-language estates at scale, where you must show which classes were actually covered |
The important part is the fourth column of Dimension 4: it sits above the other three. Agentic Code Scanning isn’t just the most expensive scanner in the stack. It’s also the system that allows the cheap tiers to go first, that model spend goes only where rules structurally cannot reach, and that a class doesn’t get quietly skipped because a budget ran out.
Balancing Cost vs. Precision: Catching the Risks That Rules Can’t See
An injection bug has a visible bad shape to it like a dangerous function, a tainted parameter, or a line a rule can match. SAST is genuinely really good at this, and you should keep it.
An authorization bug is the absence of a check. An admin action with no permission guard. A token reaching data it shouldn’t. A request trusted because it carries a header an attacker can forge.
There’s no bad-looking line. To find it you have to understand what the code is supposed to enforce, and notice that it doesn’t. You cannot pattern-match a missing thing, which is why broken access control stays the OWASP #1 risk no matter how many rules ship.
We tested this directly. Ten repositories across six languages, pinned to exact vulnerable commits: six real applications each sitting at a published CVE, plus four deliberately-vulnerable apps with answer keys we never tuned against.
| CVE type | Semgrep OSS | CodeQL | Dimension 1: Cycode Deterministic SAST | Dimension 4: Cycode Agentic Code Scanning |
|---|---|---|---|---|
| Injection / traversal (4 CVEs) | 0 | 0 | 3 | 4 |
| Authorization (2 CVEs) | 0 | 0 | 0 | 2 |
Across the top row, three of the four columns are rule engines including our own. Cycode catches three of four injection and traversal bugs at near-zero marginal cost, identically every run. That’s Dimension 1 from Cycode doing exactly the job Dimension 1 is for, and it’s why you shouldn’t reach for a model first.
Now read the bottom row. Not one rule engine caught either authorization CVE, gitea’s broken access control (CVE-2025-68941) or next.js’s middleware auth bypass (CVE-2025-29927). Not Semgrep, not CodeQL, and not ours. There was nothing there to match from a rule-based perspective, but Cycode’s Agentic Code Scanning caught both. The unique advantage here is also the flywheel behind the Cycode system: Layer 4 finds it, Layer 1 and 2 inherits it through self-improvement, and tomorrow’s catch costs nothing.
And there’s a second result hiding in Dimension 1’s three catches, which is the difference between a scanner finding something and a team fixing it. The taint rule that caught mlflow’s arbitrary file read fires 573 times across that repo, two of which land in the CVE file inside 173 to 701 total findings, unranked and unvalidated. The true positive is in there. So is everything else. Agentic Code Scanning returns one validated, root-caused finding per CVE.
Control: Spend Reasoning Where It Earns It
Point a raw LLM at a real repository and the economics turn against you immediately. Its attention is finite, so it burns budget on config and boilerplate before it ever opens the vulnerable file, and the bill compounds fastest on the code least likely to be hiding anything.
The benchmark above is the argument against doing that. All six CVEs were caught on an affordable open-weights reasoning model rather than a frontier one, which means the orchestration is doing the work rather than brute model strength. If a guided cheap model finds what an unguided expensive one misses, paying more per token isn’t the lever you think it is.
Underneath all of this, 2,189 rule-based patterns sweep every repo at almost no cost, because they’re just code with no model involved. They catch the obvious bugs for free, so model budget goes only to the bugs rules can’t describe, and they run alongside the AI rather than in front of it, so a rule finding nothing can never hide something the model would have caught. next.js shows what that buys you: reasoning identified the bypass mechanism in the first place, a specific header an attacker can forge, and once that mechanism is understood it becomes expressible as a rule, which is why that CVE re-runs with the model completely offline, identical every time. Rules could never have found it first, but they’ll catch it forever after.
That relationship runs both ways, and it’s how the system is designed to compound. When reasoning confirms a mechanism that generalizes beyond a single repo, that mechanism becomes a new rule, so the expensive layer teaches the cheap one. Every class that moves down costs less to catch the next time and catches identically every run, which means the economics improve as the system sees more code rather than degrading as your repo count grows.
Model, mode, and scope are set per scan, and every scan records what ran, when, on which code and with which model.
Attack Chaining: Where it All Comes Together
Everything above produces findings. Findings get scored one at a time, and nobody exploits them one at a time.
Here’s a chain from our findings view:
- Unauthenticated directory endpoint discloses internal member identities and roles — Low, broken-access-control
update_contact_emailchanges any account identified by an unauthenticated path parameter — High, bola
→ Resulting violation: Privilege Escalation, High
On their own, the first is an informational finding most teams defer indefinitely. Together they are a working path to account takeover.
This is where the spectrum pays off. Deterministic scanning found the shapes. Agentic reasoning found the missing check. A synthesis pass then links related findings across files into a single multi-step path, carrying the data flow from untrusted source to dangerous sink, tagged to the risk it actually enables, and Cycode’s Context Intelligence Graph grounds it in real call relationships, ownership, and reachability. Ask a model to speculate about how findings might combine and it’ll produce something plausible every time.
The key point here is that a chain holds only while every link holds. Break the cheapest one and the path is gone. The rest drop back to being a medium and a low, in the backlog.
Detection is the Easy Half. Agentic Workflows Remediate at Scale.
Everyone in this category will tell you their agent finds more. On its own, finding more makes the backlog problem worse, because it was still unmanageable before the volume went up.
What Cycode’s Holistic Code Scanning produces isn’t a list. It’s a stream of exploitability-qualified triggers: this finding, this code, this owner, reachable from here, completing this chain to this violation. That’s a far more decidable thing than a severity label.
Cycode’s Agentic Workflows consumes that stream. You define a workflow once with the triggering events, the sequence of agent actions, the confidence thresholds and controls on each step. From then on it runs the moment the event occurs: a chain closing on a crown-jewel app, a missed SLA on an exploitable finding, a backlog burndown. Findings route to the engineer who actually wrote the code. Fixes come back as reviewable pull requests, validated against the original finding. Every run leaves an audit trail of what triggered it, what each agent did, and which boundary applied.
Neither half works alone:
- Scanning without workflows is a bigger backlog. More findings, same capacity. The queue grows and closed risk doesn’t move.
- Workflows without exploitability grounding are faster busywork. Automation pointed at a noisy per-finding queue will confidently open PRs for things that were never reachable, and burn developer trust faster than any manual process.
How to Get Started
Take it for a spin. We’ll run Agentic Code Scanning against your code base and you can see the magic happen today.
