On the public RealVuln benchmark, Glog.AI Software Security now leads the F1 ranking at 82.7, ahead of the next scanner by 4.4 points. It is the only scanner among the 34 in the comparison to clear 80% on precision and recall at the same time, and it raises 47% fewer false alarms than the next-cleanest scanner at the same catch rate.
Every security scanner makes the same trade. Catch more bugs and you drown developers in false alarms. Cut the noise and you start missing real vulnerabilities. The industry has largely accepted that you pick one.
We did not want to pick. The results below are from an independent benchmark, scored by its own tooling.
The headline result
| Metric | Glog.AI | What it means |
|---|---|---|
| F1 score | 82.7 | best balance in the field, by 4.4 points |
| Precision | 85.1% | roughly 6 of every 7 alerts are a real vulnerability |
| Recall | 80.5% | 4 of every 5 known vulnerabilities are found |
| True positives | 1,532 | real vulnerabilities correctly identified |
| False positives | 269 | alerts that were not real |
| False negatives | 370 | vulnerabilities missed |
Measured on the RealVuln v3.1 Python stratum: 66 complete open-source applications, 133,782 lines of code, 1,902 labelled vulnerabilities, scored with the benchmark’s own matcher against the benchmark’s own published ground truth.
Where Glog.AI is best in the field
Five claims, each checkable against the public leaderboard.
1. Best F1 score of any scanner, by a clear margin
82.7 against 78.3 for the next entry. F1 is the harmonic mean of precision and recall, which makes it the honest single number for a scanner: it punishes flooding developers with noise and staying quiet while bugs ship, equally.
2. The only scanner above 80% on both axes
Of 34 scanners, exactly one clears 80% precision and 80% recall at the same time. Two scanners are more precise than us and both find under a third of the vulnerabilities. One scanner finds more than us and it does so at 70.1% precision.
3. The cleanest high-recall scanner in the field, by a wide margin
Among every scanner that finds at least three quarters of the corpus, Glog.AI produces the fewest false alarms, by a margin of roughly two to one.
| Scanner | Recall | False positives |
|---|---|---|
| Glog.AI | 80.5% | 269 |
| Daybreak Blue | 80.5% | 511 |
| GPT-5.6 Sol | 78.7% | 624 |
| Kolega DevSec Max V0.1.0 | 88.7% | 721 |
| Kolega Scan OSS V2 | 77.1% | 3,126 |
| Kolega DevSec Core V0.0.1 | 80.2% | 3,180 |
Daybreak Blue finds exactly the same proportion of vulnerabilities as we do, 80.5%, and pays 511 false positives to our 269. Same catch rate, 90% more noise.
4. The only scanner that beats our recall charges 2.9 false alarms per extra find
Kolega DevSec Max is the one scanner in the field that finds more than we do. Measured against our own run on the same 66 applications, the extra coverage costs the following.
| Glog.AI | Kolega DevSec Max | Difference | |
|---|---|---|---|
| Vulnerabilities found | 1,532 | 1,688 | +156 |
| False alarms raised | 269 | 721 | +452 |
| Precision | 85.1% | 70.1% | -15.0 pts |
That is 2.9 additional false positives for every additional real vulnerability. For a team triaging by hand, that trade is not obviously worth taking, and it is the reason we rank on F1 rather than on recall alone.
5. Highest precision of any security-specialized scanner, by 15 points
| Security-specialized scanner | Precision |
|---|---|
| Glog.AI | 85.1% |
| Kolega DevSec Max V0.1.0 | 70.1% |
| Anthropic Method (Sonnet 4.6) | 66.9% |
| Anthropic Method (DeepSeek V4 Pro) | 46.9% |
| Kolega Scan OSS V1 | 44.0% |
| Kolega DevSec Core V0.0.1 | 32.4% |
| Kolega Scan OSS V2 | 31.9% |
The F1 leaderboard
The full field, with the top ten and the three rule-based incumbents at the bottom for reference.
| Rank | Scanner | F1 | Precision | Recall | Performance profile |
|---|---|---|---|---|---|
| 1 | Glog.AI | 82.7 | 85.1% | 80.5% | Balanced leader. The only entry above 80 on both axes, with the fewest false alarms of any scanner at this catch rate. |
| 2 | Kolega DevSec Max V0.1.0 | 78.3 | 70.1% | 88.7% | High-recall specialist. Finds the most, at nearly 3 in 10 alerts being wrong. |
| 3 | Daybreak Blue | 77.7 | 75.0% | 80.5% | Strong generalist LLM. Matches our catch rate with 90% more noise. |
| 4 | GPT-5.6 Sol | 74.4 | 70.6% | 78.7% | Wide coverage, meaningful false-positive fatigue. |
| 5 | Claude Opus 5 | 65.0 | 62.0% | 68.4% | Deep reasoner, struggles to contain false alerts. |
| 6 | Kimi K3 | 64.8 | 73.0% | 58.2% | Precision-biased agent. Leaves over 41% of vulnerabilities unflagged. |
| 7 | GPT-5.5 | 62.8 | 72.6% | 55.4% | Conservative generalist. |
| 8 | DeepSeek V4.1 Flash | 62.3 | 65.8% | 59.2% | Mid-tier on both axes. |
| 9 | GLM-5.3 | 61.7 | 59.7% | 63.8% | Value tier, moderate accuracy. |
| 10 | DeepSeek V4 Flash | 60.7 | 77.5% | 49.9% | Clean output, misses half the corpus. |
| 32 | Rowan | 22.0 | 20.4% | 23.8% | Rule-based SAST. |
| 33 | SonarQube | 14.6 | 14.7% | 14.4% | Rule-based SAST. |
| 34 | Semgrep | 9.1 | 12.9% | 7.0% | Rule-based SAST. |
The 80/80 test
A high F1 can still hide a lopsided tool, so apply a sharper test. A scanner is only as useful as its weaker axis: brilliant recall is worthless if every second alert is wrong, and perfect precision is worthless if the tool stays quiet. So take each scanner’s two scores and keep the lower one.
| Scanner | Precision | Recall | Weaker axis | Clears 80/80? |
|---|---|---|---|---|
| Glog.AI | 85.1% | 80.5% | 80.5% | Yes |
| Daybreak Blue | 75.0% | 80.5% | 75.0% | No |
| GPT-5.6 Sol | 70.6% | 78.7% | 70.6% | No |
| Kolega DevSec Max | 70.1% | 88.7% | 70.1% | No |
| Gemini 3.5 Flash | 89.8% | 33.3% | 33.3% | No |
| Gemma 4 31B | 90.1% | 23.5% | 23.5% | No |
Charted, that weaker-axis score is the whole field in one picture. The 80 line is the bar to beat, and one bar reaches it.
Reading the table alongside it:
- Gemma 4 31B and Gemini 3.5 Flash are more precise than we are, at 90.1% and 89.8%. They buy it with silence: 23.5% and 33.3% recall, missing roughly three quarters of the corpus. Their weaker axis collapses.
- Kolega DevSec Max catches more than anyone, at 70.1% precision, so nearly 3 in 10 of its alerts are wrong.
- Daybreak Blue matches our recall exactly and gives up 10 points of precision to do it.
- Glog.AI is the only entry where both numbers start with an 8.
We do not claim the highest precision in the field, and we do not claim the highest recall. We claim the only result in the field that holds up on both axes at once.
Near-perfect on the injection classes
Aggregate scores hide where a tool is strong. Across the 74 CWE families where Glog.AI reports findings, 39 are at 100% precision and 24 are perfect on both precision and recall. 53 of the 74 run at 90% precision or better.
The classes most likely to end up in an incident report:
| Weakness | Precision | Recall |
|---|---|---|
| Code injection (CWE-94) | 100% | 100% |
| NoSQL injection (CWE-943) | 100% | 96.9% |
| OS command injection (CWE-78) | 97.8% | 91.8% |
| Deserialization of untrusted data (CWE-502) | 97.4% | 95.0% |
| Mass assignment (CWE-915) | 97.3% | 90.0% |
| Hard-coded cryptographic key (CWE-321) | 97.2% | 97.2% |
| Unrestricted file upload (CWE-434) | 96.8% | 80.0% |
| SQL injection (CWE-89) | 95.5% | 91.3% |
| Open redirect (CWE-601) | 95.1% | 97.5% |
| XML external entity (CWE-611) | 94.9% | 97.4% |
| Server-side request forgery (CWE-918) | 90.5% | 92.7% |
| Hard-coded credentials (CWE-798) | 88.7% | 94.0% |
| Cross-site scripting (CWE-79) | 84.7% | 85.5% |
It holds up on real code
Benchmarks can flatter tools that are good at synthetic bugs. The RealVuln Python stratum splits into 26 real open-source applications written by humans and 40 applications with generated vulnerabilities. Real code is messy and full of framework idiosyncrasy; generated flaws tend to be cleanly written and legible.
| Code type | Repositories | Precision | Recall | F1 |
|---|---|---|---|---|
| Human-authored, real applications | 26 | 84.97% | 78.81% | 81.77 |
| Generated vulnerabilities | 40 | 85.12% | 81.57% | 83.30 |
Precision is effectively identical on both: 84.97% against 85.12%, a gap of 0.15 points. Recall differs by 2.8 points, the honest cost of real code being harder.
That stability matters more than any single headline figure. Many frontier LLM agents look strong on cleanly injected test cases and come apart under real-world logic. A tool whose precision collapses on real repositories gets switched off in week two, whatever it scored on a benchmark.
How it works: a graph, then a judge
Most scanners read code as text and match patterns against it. Glog.AI builds a semantic graph of the whole application, tracing how data moves through it and which conditions control that movement, and then lets AI rule on what the graph cannot settle by itself. Those two mechanisms produce the scores above.
The graph sees what patterns cannot. Text matching works one file at a time. It cannot follow untrusted input through three function calls into another module, because that is a data flow question spanning files. It cannot tell that a permission check returns early on the only path that reaches a sensitive operation, because that is a control flow question. And it cannot notice that one endpoint is missing the check every neighbouring endpoint has, because that requires seeing the application as a whole rather than a line at a time. Modelling the program as a graph of its data and control dependencies turns all three into questions you can simply ask. That capability accounts for roughly a fifth of everything we catch, and it is the part no pattern-based tool reaches at any precision.
AI judges, it does not guess. No model decides whether a vulnerability exists, so the same code produces the same findings on every run and our results do not shift because a vendor released a new model. The model is used where judgement genuinely beats code: deciding whether a flagged line is really exploitable in its context, and whether two reports describe the same underlying defect. That is how the noise comes down without the catch rate following it.
What is Glog.AI
Glog.AI is a hybrid DevSecOps security platform built to close the gap between two disappointing options: rule-based AppSec tools that pattern-match one file at a time, and general-purpose language models that infer vulnerabilities from textual context and cannot be held to a reproducible answer.
It takes the reliability of the first and the judgement of the second. Detection is deterministic and built on whole-program data and control flow analysis, so results are reproducible and auditable. AI is applied only where judgement genuinely outperforms a rule, and nowhere else.
The design goal was balance rather than a single headline metric, and the leaderboard above is the result of pursuing it.
Who it is for
Engineering teams who have stopped reading their scanner’s output. The reason precision matters is organisational, not technical. A scanner at 70% precision hands a developer three false alarms for every seven real bugs, and that team tunes it out inside a month. At 85.1% precision, roughly 6 of every 7 alerts are real, so reading them repays the time and they arrive in pull requests as definite bugs rather than vague warnings.
AppSec and DevSecOps leads who are outnumbered. Security teams cannot manually audit every change across hundreds of daily deployments. An automated gate is only useful if it can be trusted without a human re-check, which takes both a high catch rate and low noise, not one of the two.
Enterprise platform and product teams. Organisations that want deeper validation than open-source scripts provide, without standing up a team to triage a high-volume engine. Glog.AI measurably outperforms out-of-the-box frontier models on this benchmark while producing a fraction of their false alarms.
Methodology you can verify
Marketing numbers are worth exactly as much as the method behind them.
Third-party benchmark, third-party scoring. RealVuln v3.1 is published by Kolega Labs under Apache 2.0 (arXiv:2604.13764), with a public dashboard and a public results file. We score with the benchmark’s own parser and matcher, not with anything of our own. A finding counts only when it lands within ten lines of a labelled vulnerability and its CWE is one the label accepts.
Complete runs, not cherry-picked ones. Every figure here comes from one complete pass over all 66 applications, with all 66 reports produced and zero failures. We do not quote partial runs.
We use the published ground truth for every ranking claim. We also maintain a corrected copy of the ground truth where we believe a label is wrong, and against that copy our precision reads 91.1%. We deliberately do not rank ourselves on it, because grading yourself against labels you rewrote produces a to-do list to file upstream rather than a benchmark result.
About Glog.AI
Glog.AI is an autonomous, AI-driven cybersecurity and software security company. It works across every layer of an organisation’s digital infrastructure, with one goal: move security off the critical path, so that it stops being the thing that slows delivery down.
The Glogosphere
The platform runs a predict, protect, remediate loop across three products.
| Product | What it does |
|---|---|
| Glog.AI Software Security | The engine benchmarked above. It sits in the CI/CD pipeline and uses semantic code graphs and AI to find, triage and automatically fix vulnerabilities. |
| NetEcho | Network and endpoint anomaly detection, built to surface unusual behaviour before it is exploited rather than after. |
| Security Predictions | Threat intelligence that reads global attack data to anticipate which patterns and which of your assets are likely to be targeted next. |
Services
Three service lines sit alongside the products, for the places where regulation and engineering speed pull against each other.
- vSOC, a virtual security operations centre. One command centre that combines NetEcho, Security Predictions and human threat intelligence into a single monitoring picture.
- AI-enhanced penetration testing. Finds complex attack paths at a scale and frequency manual testing cannot sustain.
- Training and DevSecOps integration. Helps engineering teams write code that resists attack by design, and automates the security steps in their existing workflows.
Compliance and recognition
Glog.AI is built so that compliance falls out of the engineering work rather than being assembled by hand at audit time. It natively supports ISO 27001, ISO 42001, NIS2, DORA, the EU Cyber Resilience Act, GDPR, HIPAA, and Serbia’s Law on Information Security.
The Geneva Manual recommends Glog.AI as a standard for responsible behaviour in cyberspace. It is used by enterprises, financial institutions and critical infrastructure operators internationally.
Benchmark: RealVuln v3.1 (Apache 2.0, arXiv:2604.13764), Kolega Labs. Vendor figures from the public RealVuln dashboard. Glog.AI figures measured on the 66-application Python stratum, 2026-09-24, scored with the benchmark’s own matcher against its published ground truth.
GLOG.AI® is a registered trademark in the United States (USPTO), the European Union, the United Kingdom, Switzerland, and Serbia.