Apiiro Launches AI SAST to Enhance Static Application Security Testing
- Securityish
- Tools & Best Practices
Quick Summary
Apiiro has introduced Apiiro AI SAST, a new static application security testing tool that uses Deep Code Analysis to automate code risk detection and reduce false positives. This tool combines call flow, data flow, and AI reasoning to validate exploitable risks and provide actionable fixes. The technology aims to improve developer productivity and security team efficiency by addressing the limitations of traditional SAST tools, which often generate excessive false alerts.
The Securityish Brief
Apiiro’s new offering, Apiiro AI SAST, leverages patented Deep Code Analysis (DCA) to enhance static application security testing. By integrating application security testing (AST) scanning with AI reasoning, it aims to eliminate false positives and prioritize genuine risks. This approach is particularly relevant as traditional SAST tools struggle to keep up with the rapid code delivery and increased application risks associated with modern software development.
Colin Barr, Head of Information Security at Paddle, noted that Apiiro AI SAST significantly reduced false positives in their environment, allowing for better prioritization of risks. The tool’s ability to map findings to API entry points is crucial for organizations looking to focus on the most relevant vulnerabilities.
Moti Gindi, Chief Strategy Officer of Apiiro, emphasized that many existing solutions fail in enterprise environments due to a lack of understanding of software architecture and business context. Apiiro AI SAST addresses this gap by providing highly qualified risks with clear, actionable fixes.
The technology employs five core capabilities, including AST and Large Language Model (LLM) symbiosis, which combines rapid detection with expert-level validation. This dual approach ensures comprehensive coverage while maintaining precision in identifying real business risks.
By creating a comprehensive Software Graph of the entire codebase, Apiiro’s DCA technology allows for tailored risk detection and remediation. This capability is essential for organizations managing complex software environments with multiple dependencies.
As organizations increasingly adopt AI coding assistants, which can boost code delivery but also raise application risks, the need for effective SAST solutions becomes more pressing. Apiiro AI SAST aims to provide the necessary tools to navigate this evolving landscape.
In summary, Apiiro AI SAST represents a significant advancement in static application security testing, offering organizations a way to enhance their security posture while reducing the noise associated with traditional tools.
Key Takeaways
- Evaluate your current static application security testing tools to identify if they generate excessive false positives.
- Consider implementing Apiiro AI SAST to improve risk detection and remediation in your software development lifecycle.
- Ensure your security team is trained to understand and prioritize risks mapped to API entry points.
- Monitor the performance of AI coding assistants in your environment and assess their impact on application security.
- Stay informed about advancements in application security technologies to enhance your organization’s risk management strategies.
Key Terms & Concepts
- Static Application Security Testing (SAST): In this article, SAST refers to a method of testing software code for security vulnerabilities without executing the program.
- Deep Code Analysis (DCA): DCA is a patented technology by Apiiro that builds a comprehensive Software Graph of the entire codebase to enhance risk detection.
- Large Language Model (LLM): LLM refers to advanced AI algorithms that can understand and generate human-like text, used here for validating security findings.
Read the original article here: https://www.helpnetsecurity.com/2025/12/18/apiiro-ai-sast/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
