Using LLMs to Find and Prioritize Vulnerabilities Is No Easy Task

This article reports on tests and expert commentary showing that many application-scanning tools and LLMs produce a high proportion of false positives or flag unreachable/low-severity code, creating triage overload for AppSec teams; it argues that improving vulnerability prioritization requires reachability analysis, richer organizational and technical context, and a supporting harness around AI models to make scan results deterministic and trustworthy.