The Takeaways:

• AI security tools have made vulnerability discovery cheaper and faster, shifting the bottleneck from finding issues to validating them.
• The real cost of false positives shows up in senior auditor time, delayed remediation, noisy reports, confused clients, and declining trust in the tool.
• The right workflow pairs AI discovery with qualified expert validation, creating a clear record of who reviewed the finding, what standard they used, and why the final decision was made.
• As AI systems generate more findings at greater speed, trusted and provable expert review becomes critical infrastructure. Proof of Quality enables verification at the scale AI demands.

AI made findings cheaper. Review stayed expensive.

AI security tools are getting better at finding possible vulnerabilities. That sounds like progress, and in many ways it is. A scanner that covers more code, checks more patterns, and flags more edge cases gives a security team more surface area to work with. The issue starts after the scan runs. Every finding needs review, which means every review needs context. Every possible exploit needs a human expert decision before it becomes something a team of builders can act on.

False positives look cheap because software generated them almost as a byproduct. The real cost shows up in senior reviewer time, delayed remediation, noisy reports, client confusion, and the slow loss of trust inside the team using the tool. When engineers see too many weak findings, they start treating the whole output as noise. When auditors spend hours clearing bad reports, they lose time on issues that matter. When clients receive long reports full of low-confidence items, they struggle to tell where the real risk sits.

We can always generate more findings, but what we really need is proof that the right findings were reviewed by the right experts against the right standard, with a clear record of what is and what isn’t a finding that matters. 

Polished reports can still be weak findings.

The problem gets worse when the AI output looks polished. A weak report with clean language can move further than it should. It can include a convincing title, a familiar severity label, a partial proof of concept, and remediation steps that sound reasonable. That format, however, can hide the central question: can this actually be exploited in the system we’re currently auditing? If the answer is not 100% clear, the finding still needs expert time.

This is the main problem with AI-assisted security workflows today. The bottleneck has shifted.

• Finding possible bugs is easier. 
• Validating them is still hard.

This is already showing up in production security channels. Bug bounty programs are seeing more reports, more duplication, and more low-quality submissions. The Financial Times reported that Bugcrowd saw submissions rise more than fourfold in March, while Curl and Nextcloud both paused bounty programs after low-quality AI-generated reports overwhelmed their review processes. HackerOne reported a 76% rise in submissions in the year to March, while the share of legitimate reports stayed around 25%.

The bottleneck moved from discovery to validation.

The research layer supports the same angle. A March 2026 arXiv paper (Abdelaziz et. al) found smart contract analyzers vary widely in F1 score, with false-positive rates up to 32.6%, and surveyed 150 developers and auditors who named false positives, vague explanations, and long runtimes as barriers to adoption.

The right metric for AI security tooling is therefore wider than finding count. A tool that produces 500 possible vulnerabilities can still create less value than a tool that produces 20 strong ones. Precision matters. Reproducibility matters. Severity calibration matters. Reviewer agreement matters. The final question is simple: which findings deserve action, and can the team prove why?

That requires a better workflow. 

Verified findings need a better workflow.

AI should help discover candidate issues. Experts should validate the ones that matter. The review process should produce a record that can be inspected, shared, and trusted. A strong validation layer should show who reviewed the finding, what rubric they used, whether reviewers agreed, how severity was assigned, and what evidence supports the final decision.

This is where Sapien fits. Proof of Quality gives security teams a way to turn AI-generated findings into verified findings. A team can submit candidate vulnerabilities, define the review standard, route findings to qualified validators, and receive a consensus-backed result that is immutably recorded onchain. The output is a cleaner signal: confirmed, rejected, escalated, or disputed, with a record of the review behind it.

Proof of Quality turns AI findings into reviewable signal.

The audit market is moving toward AI assistance because the economics are too strong to ignore. That shift will put pressure on quality and ways of proving that quality. Firms that ship raw AI output will create noise. Firms that pair AI discovery with expert validation will create leverage. Proof of Quality is the lever that enables us to separate those for good.

False positives are the hidden cost because they sit between the tool and the client. They consume time, lower confidence, and weaken the report. Meanwhile, AI security tools will keep improving. They will generate more findings, faster, across larger codebases. That makes validation more important, rather than less. The teams that make the most out of this scenario will be the ones that treat expert review as part of the system, measure it, and make it provable. 

How does Proof of Quality work, in detail? - Proof of Quality: Who Verified the Data That Trained Your Model?

How our token guarantees Proof of Quality - Sapien Tokenomics

Highlighting the regulatory needs for Reasoning - Interpretable Reasoning as a Regulatory Requirement

FAQ:

Why do cheaper findings create new issues?
A scanner can produce findings at near-zero marginal cost. Senior auditor time still has a high marginal cost. Every possible vulnerability needs context, exploitability review, severity assessment, and communication.

What is a false positive security finding?
A false positive is a reported issue that looks like a vulnerability but does not represent a real, exploitable, or relevant risk in the audited system. It may match a known pattern, appear in a static analyzer, or contain a plausible explanation, while still failing under expert review.

Why are false positives expensive when AI generated them cheaply?
The generation cost is low. The review cost is high. A false positive consumes time from senior auditors, slows remediation, adds confusion for clients, and weakens confidence in the report. The hidden cost appears after generation, during validation and delivery.

Why does proof of review matter for security audit firms?
Audit firms need to scale AI-assisted workflows without weakening quality. If AI creates more reports but senior reviewers remain the bottleneck, margins and trust both suffer. A validation layer helps firms use AI for discovery while preserving expert-backed final output.

Can AI replace security auditors?
No. AI helps auditors cover more surface area and generate candidate findings faster. Auditors remain essential for exploitability review, severity judgment, edge-case analysis, and final client communication. The strongest workflow pairs AI discovery with expert validation.

How does Proof of Quality help a security audit team?
Proof of Quality can produce a structured outcome for each candidate finding:

• confirmed
• rejected
• escalated
• disputed

Each outcome carries review context, validator input, consensus status, and a record of how the decision was reached.

Sources:
[1] "‘Never-ending’ AI slop strains corporate hacking reward schemes", https://www.ft.com/content/dbec4441-02dc-4053-8500-85677973d324

[2] Tamer Abdelaziz, Salma Alsaghir, Karim Ali (2026). Where Do Smart Contract Security Analyzers Fall Short? https://arxiv.org/abs/2603.00890