AI and LLM Security

Every Week Someone Asks Me When AI Will Replace Pentesters

July 18, 2026 No comments yet

This piece is my read on research published by Datadog Security Labs. The findings are theirs; the argument about what they mean is mine. Their original write-up is worth reading in full.

Every week somebody asks me when AI is going to replace penetration testers. So here we are – the team at Datadog have just released a tool that tries to do exactly that.

The tool is called SAIST, Static AI Security Testing. Broadly? It is SAST without rules. Instead of an engine looking for patterns in code, the tool sends your code to an LLM – Claude, GPT or Gemini – using your own API key, and the AI looks for weaknesses. Results come back as SARIF, the whole project is indexed so there is context between files, and it currently supports Java, Python and Go.

Sounds like the future? Honestly, yes. But not the way you think.

A few things worth knowing before getting excited

  • The tool is still in preview. Which means Datadog themselves do not yet trust it with their eyes closed.
  • You cannot run it without a Datadog account, because the detection rules live in their cloud. An “open source” tool that does not work without the vendor is a flexible use of the term.
  • Your code is sent to an external LLM. Stop for a second and think about what that means for the most sensitive code in your organisation.

And here is the part that actually interests me

After more than 20 years in this field: the problem with automated scanners was never the engine. The problem is what they are not capable of seeing.

Business logic flaws. Authorization problems. A flow that lets one user pull another user’s data. Nothing about those requests is malformed – there is no pattern to match, because the request is perfectly well-formed and perfectly legitimate. It is only wrong when you understand what the system is supposed to do.

Swapping a rules engine for a language model makes the scanner better at what scanners already do. It does not move the boundary.

Related: an authorization flaw no scanner flags, because the request is perfectly well-formed.

Related: one introspection query and one mutation, straight to admin.

I first shared a version of this as a LinkedIn post on 2026-07-18. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula