2.6x the findings, 12x fewer tokens: Getting more from your security review agents

Security agents can automate tasks such as PR review, vulnerability triage, and dependency upgrades, but scaling them across large numbers of repositories can make token costs, execution time, and coverage significant concerns. Two Endor Labs studies reported that an agent supplied with precomputed security context—including findings, call graphs, reachability information, upgrade paths, and license data—used 12 times fewer tokens and completed equivalent tasks in roughly one-third of the time compared with the same model independently exploring repositories and the web. The unaided approach required substantially more searches, file reads, and other tool calls, with costs rising sharply for larger codebases and sometimes producing inaccurate reachability conclusions. In a separate benchmark across eight public projects, Endor Labs AI SAST reportedly identified 192 verified vulnerabilities, 2.6 times more than Claude Opus 4.7 and 3.5 times more than Codex, while covering more CWE categories; the comparison attributed frontier models’ lower recall to their limited examination of large codebases. The studies argue that teams should retain ownership of organization-specific agent workflows while relying on precomputed code and security analysis for foundational tasks, although the token study measured cost rather than overall correctness, involved one model, and depended on upstream work to generate the security evidence.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.