Haxset Research
Technical publications from our research and advisory practice.
Checkov, Trivy, KICS and Terrascan compared from their own docs: IaC formats, policy languages, exit codes, network calls and who still maintains them.
SAMA approvals, NCA hosting guidance, SDAIA's limits on generative AI and the PDPL's transfer rules decide whether code can go to a hosted AI service.
In most published samples, most rule-based SAST findings are false. How to measure noise, what AI triage removes and misses, and how Haxset limits both.
What AI SAST is, what it finds that rules miss (IDOR, business logic, misconfiguration), where the LLM sits, and how to test a vendor's accuracy claim.
Haxset scans each pull request with AI and posts labeled findings developers can fix and triage, and scheduled scans recheck your code between releases.
How Haxset's AI SAST gives each web and mobile vulnerability class its own agent, how two models raise confidence in thorough mode, and how AI DAST works.