Proof, Not Promises: How We Drive Security Testing Accuracy With Better Data 

**Executive summary:** Checkmarx Security Research outlines a repeatable methodology for measuring SAST accuracy using realistic open-source applications, manual validation, and combining multiple scanners to establish ground truth; it compares deterministic SAST tools, LLM-based assessments, and hybrid approaches, reporting Checkmarx SAST at ~0.30 F1, general-purpose LLM tools at ~0.15 (high precision, low recall), and hybrid/LLM-supervisory methods able to raise F1 into the ~0.499–0.7+ range while discussing trade-offs between precision, recall, cost, and practicality.