AI can generate a convincing security finding without showing that the vulnerable code is reachable or that an attacker could exploit it. Treating the report as confirmed creates noise; dismissing it can miss something important.

We’ll discuss how to use AI in code review and vulnerability triage while keeping evidence attached to each finding. We’ll look at tracing claims back to code, checking the attacker access required, and writing controlled tests to reproduce the reported behavior. The session focuses on handling incomplete reports and false positives, and deciding what evidence is needed before accepting a finding or approving a fix.