AI and Security Audits: Strengths, Limits, Human Role

What can AI do in a security audit?

It speeds up repetitive tasks whose results can be checked. Static analysis tools, dependency analysis and writing assistants now use language models, with a real time gain when a human reviews the output.

• Known-pattern detection: injections, dangerous calls, hard-coded secrets, deprecated functions.
• Dependency analysis: cross-checking versions against vulnerability databases and prioritizing.
• Alert triage: merging duplicates and ordering hundreds of results.
• Mapping: quick inventory of visible endpoints, routes and configurations.
• Writing: structuring the report and rewording recommendations.

Why must an AI-produced result always be verified?

Because models produce plausible results that are sometimes wrong. Fix assistants say so themselves: GitHub's documentation on Copilot Autofix mentions non-deterministic suggestions, sometimes partial, that may change the meaning of the code or not fully fix the flaw.

On the code generation side, Veracode measures that about 45% of the tasks tested produce code failing security checks. A tool that writes insecure code can also be wrong when reviewing it. In audits we therefore expect a substantial false positive rate and replay every finding by hand before reporting it.

What does AI miss most often?

It misses what depends on what the application is supposed to allow.

Business logic

A tool does not know that an employee must not see a colleague's record, or that a customer must not change their own order status. OWASP devotes a section of its web testing guide to business logic testing precisely because no generic scanner covers it.

Customer isolation (multi-tenant)

Reaching company B's data from a company A account is a serious flaw. It is found with two test accounts and an understanding of what must be separated, not with pattern analysis.

Attack chains

The most serious flaws are often sequences: a minor leak reveals an identifier, which opens a poorly protected endpoint, which allows a role change. Each link looks harmless alone.

Judgment on impact

Two technically similar leaks do not have the same severity if one exposes a name and the other sensitive data. Qualifying impact, notably under the GDPR, takes human judgment.

What does a business logic flaw that AI cannot see look like?

It looks like normal code behavior. Take an export API: it correctly checks that the user is logged in, returns the right format and shows no injection pattern. An automated analyzer judges it clean. But it does not check that the requested report belongs to the caller's organization, and changing one identifier is enough to read another customer's report.

Second example: a subscription flow where the "paid" state is sent by the browser. The code is syntactically correct, inputs are validated, and yet anyone can grant themselves the subscription. In both cases the flaw exists only relative to a business rule that no file contains. Only a test that starts from the rule ("a customer only reads their own reports") reveals it.

This is also why AI tools gain from receiving that rule as input. A human auditor translates business rules into tests, then lets the tools handle volume: trying every identifier, every role, every route.

The same applies to the reverse situation. An automated tool will happily report hundreds of low-value findings, such as missing headers or verbose version banners, which drown the two or three issues that matter. Prioritization is a judgment about the business: which data would hurt most if it leaked, which action would cost money if abused, which customer would leave after an incident. A good report ranks findings by that reasoning and says explicitly what was not tested.

Finally, ask what the audit leaves behind. Replayable proof lets your developers reproduce a finding in minutes, confirm the fix and add a regression test. A list of tool alerts without reproduction steps leaves the team guessing, and the same flaw tends to come back at the next release.

And for AI agents, can AI audit them alone?

Not reliably. Testing an AI agent means building attack scenarios fitted to its content sources and tools, then measuring real impact. Automated probing tools (injection prompt sets, leak detection) provide a useful baseline, but they understand neither your access rights nor what a tool call triggers in your system. See the AI agent red teaming page and the article on prompt injection.

How should work be split between AI and humans?

A split that works gives AI preparation and volume, and humans decision and proof.

1. Preparation (AI + human): surface mapping, dependency inventory, first patterns spotted.
2. Hypotheses (human): understand roles, sensitive data and critical journeys, then state what must never happen.
3. Tests (human, tools in support): two test accounts, object access attempts, escalation tests, attack chains.
4. Verification (human): every finding is replayed and backed by minimal proof, without downloading personal data.
5. Qualification (human): severity, exploitability, business and regulatory impact.
6. Writing (AI + human): formatting and review.

How do you check whether a "5-minute audit" is worth anything?

Ask the provider or the tool five questions.

• Are findings backed by replayable proof?
• How many test accounts were used, and with which roles?
• Were business logic and customer isolation tested?
• Who verified each finding, and how are false positives handled?
• Are the scope and the method's limits written down in black and white?

A report with no answers to these questions most likely describes a scan, not an audit.

What role should AI play in your own security hygiene?

Use AI for daily hygiene: regular scans, dependency updates, code review. Keep an external human test before critical moments (going to production, fundraising, opening to large customers) and whenever you connect an AI agent to your data or tools.

CleanIssue's Agent Red Team Express (EUR 1,900, 5 days) tests exactly these agents with hand-built scenarios, backed by tools: see the offer. The first contact is a free 30-minute discovery call to place what an AI-assisted audit covers and what stays with a human. For a wider read, see AI agent security and the article on AI and cybersecurity for SMBs.