AI-assisted AppSec triage — buyer questions and token-metered pricing

What it is

AI is restructuring the application security market in ways that go well beyond capability improvements. For any organisation that buys security tooling — and for every architect who specifies or inherits that tooling — understanding the structural shift underneath the marketing claims is now a career-critical competency.

What is actually changing in AppSec

Application security testing historically ran on two workhorses: Static Application Security Testing (SAST), which analyses source code without executing it, and Dynamic Application Security Testing (DAST), which fires HTTP traffic at a running application and observes the responses. Both disciplines are decades old, and both share the same fundamental bottleneck: alert volume wildly outpaces human triage capacity. A mature SAST scan of a large codebase routinely surfaces thousands of findings, of which a large fraction are false positives, context-mismatches, or already-mitigated patterns. Security engineers spend the majority of their AppSec budget triaging alerts rather than fixing vulnerabilities.

Why it matters

• A mature SAST scan routinely surfaces thousands of findings, a large fraction false positives — security engineers spend most of their AppSec budget triaging, not fixing.
• AI-augmented triage learns from the repository's own history of closed false positives and genuinely exploited findings to rerank the queue into a smaller, better-ordered set.
• The buyer question is not 'does this work in demos?' but 'under what conditions does this work for my codebase, my stack, and my team's triage bandwidth?'

Key points

• OpenAI normalising consumption + outcome pricing; SAP likely to follow on Joule in 18 months
• Rewrite steady-state CU sizing assumptions if SAP adds outcome tier
• Borrow Daybreak's AppSec improvement pattern for Datasphere Consumption APIs
• CISO buyer behaviour is shifting — arrive prepared with the implications mapped
• SAP's own generative AI hub orchestration service (content filtering + data masking, GA) is the first-party equivalent of the data-residency guarantee buyers demand from AI AppSec vendors
• Any AI AppSec tool wired into a BTP CI/CD pipeline with write access (auto-PR, auto-patch) has crossed into agent territory and belongs in SAP AI Agent Hub's inventory, not outside it
• The write capability — not the vendor's marketing label — is what should decide whether an AI AppSec tool needs agent-level governance
• For ABAP Cloud or RFC-exposed on-premise targets, confirm whether the vendor's inference endpoint sits inside or outside SAP's own network boundary before sending code externally

Terms used on this page

SAST (Static Application Security Testing)

Automated analysis of application source code, bytecode, or binary without executing the application, identifying known vulnerability patterns.

DAST (Dynamic Application Security Testing)

Automated testing of a running application by simulating external attacks; discovers vulnerabilities that only manifest at runtime.

Alert triage

The process of reviewing, prioritising, and dispositioning security findings to distinguish genuine risks from false positives.

Consumption-based pricing

A billing model where cost scales with actual usage (scans, API calls, tokens) rather than a fixed subscription, creating variable financial exposure.

Authority-check (SAP ABAP)

The ABAP instruction AUTHORITY-CHECK that verifies whether a user holds the required authorisation object before executing a sensitive operation; a missing or bypassed check is a critical vulnerability.

BAdI (Business Add-In)

SAP's enhancement framework allowing custom code to be injected at predefined extension points in standard SAP applications; a BAdI injection vulnerability allows malicious code to execute in the SAP standard context.

Inference endpoint

The compute infrastructure where an AI model processes input and produces output; relevant for data residency because code sent for AI analysis must reach this endpoint.

Model drift

Degradation in an AI model's performance as the distribution of real-world inputs diverges from its training data; in AppSec, triggered by codebase architecture changes.

Sources

1. Forrester — OpenAI’s Daybreak Promises To Improve AppSec But Introduces A New Pricing Model: Five Buyer-Side Implications For CISOs (Jeff Pollard)
2. SAP Help — BTP Security: application security and vulnerability management
3. SAP Help — ABAP Cloud: development model and security guidelines
4. SAP Help — SAP AI Foundation: overview and capabilities
5. SAP Help — BTP Cloud Connector: security configuration and audit logs
6. Forrester — The Forrester Wave: Application Security Testing, Q3 2024
7. SAP Help — Datasphere: data lineage and impact analysis
8. SAP Community — BTP custom development: security hardening checklist
9. OWASP — OWASP Top 10
10. NIST — SP 800-218 Secure Software Development Framework (SSDF) v1.1
11. CISA — Secure by Design
12. SAP Help Portal — Orchestration service (generative AI hub, content filtering & data masking)
13. SAP News Center — Autonomous Enterprise: SAP AI Agents Work at Scale (AI Governance Assistant, 2026-09-22)
14. EUR-Lex — Directive (EU) 2022/2555 (NIS2)
15. OpenAI — Using Daybreak in the Responses API (Daybreak Blue/Red access programs, model options, approval requirements; vendor documentation)
16. OpenAI — API pricing (token prices incl. gpt-5.6-cyber Daybreak model; vendor price list read 2026-10-05)
17. TechTarget — For CISOs, dawn of OpenAI Daybreak brings good and bad news (trade-press analysis of Daybreak for CISOs)
18. Futurum — OpenAI Daybreak Aims For The Agentic AppSec Workflow (analyst view of the agentic AppSec workflow)
19. OWASP — Top 10 for LLM Applications (risk taxonomy for evaluating AI-based security tooling)