Cost composition
Where the money goes
Direct spend
CI delay
Human review
Decision model · annualised
Put a price on your
AppSec architecture.
Compare traditional SAST, LLM scanning on every build, and a hybrid model that turns weekly AI triage into reusable suppression rules.
Potential annual saving
£0
vs. next-best option
Recovered engineering time
0 hrs
vs. traditional SAST
Hybrid payback
—
AI-triage investment
Annual CI builds
0
modelled runs
Interactive model
Change any assumption.
See the decision move.
All calculations run locally in your browser. Values are planning estimates, not vendor quotes.
Calculating…
Calculating…
Sensitivity
Current: 85%
Cost as suppression improves
Implementation
The hybrid model,
turned into a control plane.
The simulator above models a hybrid approach: SAST running in CI, plus a weekly AI triage cycle that converts reviewer decisions into reusable suppression rules. AutoTriage is the open-source project that implements that control plane.
Separation from CI
Expensive LLM security testing runs on a schedule, not on every build. CI pipelines keep running fast SAST tooling, gated by signed suppression bundles rather than raw scanner output.
Suppression as output
Each triage cycle pays the review cost once, then writes reusable suppression rules back to the repo. That is the mechanism behind the hybrid strategy's recovered engineering time in the model.
Governed decisions
Findings are classified by repo-managed CEL policy into true positive, potential false positive, and false positive. Only the ambiguous band reaches a human reviewer, with a full audit trail.
From review to PR
When a reviewer approves a finding as a false positive, triage automation opens a suppression update as a pull request. The rule becomes part of the repo's governed history, not a one-off judgment.
View AutoTriage on GitHub →
Open source · MIT license · hoggmania/AutoTriage
Model notes
Transparent enough
to challenge.
Total cost
Direct tool and compute spend + the loaded cost of CI waiting + human false-positive review.
Reusable rules
Each triage cycle pays the review cost once, then suppresses the chosen share of repeats until the next cycle.
Break-even
The model solves for the LLM price or suppression efficacy at which two strategies have equal annual TCO.
Scope note
This is a comparative planning model. It excludes migration, governance, model-validation and incident-risk costs; add those to a formal business case.