Market-Leading Accuracy.
High Recall. Near-Zero Noise.
Across 3,970 OWASP benchmark cases, Cyfendo combines 97.3% vulnerability recall with 93.78% precision—delivering high detection coverage with a fraction of the noise of traditional SAST.
A market-leading balance of coverage and precision
Finding every possible issue is easy if a scanner reports everything. The harder problem is finding real vulnerabilities without burying developers in false alarms. On the OWASP Java Benchmark, Cyfendo delivers both.
Nearly the recall. A fraction of the noise.
In this public Java benchmark comparison, Cyfendo comes within 2.7 percentage points of CodeQL's 100% recall while reducing the false-positive rate from 77.66% to 13.36%.
High recall shouldn't require high noise
Full metrics on the standardized 2,740 test-case OWASP Java Benchmark v1.2 suite.
| Tool | Technology Category | Recall (TPR) | False Positive Rate (FPR) | Precision | F1 Score | OWASP Score |
|---|---|---|---|---|---|---|
| Cyfendo High Signal | Agentic AI + PoC Sandbox Verification | 97.30% | 13.36% | 88.61% | 92.76% | 83.96% |
| Semgrep OSS 1.160 | Pattern & AST Rule Engine | 88.30% | 39.25% | 70.60% | 78.50% | 49.02% |
| CodeQL 2.25.2 | Declarative Code Query Engine | 100.0% | 77.66% | 57.90% | 73.30% | 22.34% |
| Semgrep Pro 1.160 | Proprietary Interfile Taint SAST | 89.30% | 70.04% | 57.60% | 70.00% | 19.22% |
| SonarQube Java v3.14* | Code Quality & Security Rules | 50.36% | 17.02% | 74.70% | 60.10% | 33.34% |
| FindSecBugs v1.4.6* | Bytecode Pattern Plugin (SpotBugs) | 42.60% | 3.50% | 92.40% | 58.30% | 39.10% |
| PMD v5.2.3* | Static Code Quality Linter | 0.00% | 0.00% | 0.00% | 0.00% | 0.00% |
GitHub CodeQL & GHAS
While CodeQL achieves 100% recall on Java tests, its 77.66% false-positive rate creates severe alert fatigue. Developers must manually sift through hundreds of unexploitable sink alerts.
Semgrep OSS & Pro
Fast and lightweight for syntactic checks, but struggles with deep reachability and complex sanitization logic, leading to 39%–70% false-positive rates on standard benchmark suites.
Snyk Code, Checkmarx & Fortify
Statistical LLM heuristics and legacy enterprise ASTs often hallucinate or over-report potential issues. Without automated adversarial validation or sandbox execution proof, triage overhead remains high.
SonarQube & Linters
Exceptional for maintainability, but only catch approximately 50% of real security vulnerabilities because they lack full interprocedural taint flow analysis and automated exploit verification.
Commercial Tool Benchmarking Policy: Commercial proprietary SAST solutions (such as Snyk Code, Checkmarx, and Fortify) include restrictive benchmark clauses in their End User License Agreements (EULAs) prohibiting the unauthorized publication of comparative benchmark scorecards. In strict adherence to OWASP's official benchmark disclosure policy (which omits commercial tool scorecards for this reason), Cyfendo characterizes these solutions by their published technical architecture rather than publishing unverified scores. Enterprise security teams are invited to evaluate Cyfendo side-by-side with incumbent commercial scanners on their own private codebases.
Data Sources & Reproducibility: Competitor benchmark figures cited on this page are derived exclusively from publicly available, verifiable, and published sources: (1) CodeQL 2.25.2 (security-extended query suite) and Semgrep 1.160 (security rulesets) data are derived from published April 2026 public evaluations on the open OWASP Benchmark Java v1.2 testbed; (2) SonarQube Java v3.14, FindSecBugs v1.4.6, and PMD v5.2.3 metrics are cited directly from the official published scorecards in the open OWASP Benchmark Project repository.
Comparative Evaluation Disclaimer: Selected public benchmark metrics are presented for factual informational and comparative purposes under Nominative Fair Use. Diagnostic performance can vary based on tool version, ruleset selection, pipeline configuration, and hardware execution environment. Cyfendo results were independently evaluated by Cyfendo against open benchmark suites. Competitor figures reflect the cited public evaluation runs.
Strong performance isn't limited to one language
Cyfendo has now been evaluated across 3,970 OWASP benchmark cases spanning Java and Python.
Why Cyfendo produces a stronger signal
Traditional tools match static syntax patterns. Cyfendo uses multi-agent reasoning and automated exploit verification to prove vulnerabilities before notifying developers.
Deep Code Context
Reasons about whole-repository architecture, custom frameworks, and surrounding middleware controls rather than matching isolated AST snippets.
Agentic Taint Flow
Recursively tracks untrusted inputs through complex application logic, verify whether dangerous sinks are actually reachable at runtime.
Adversarial Review
Specialized verification agents actively challenge candidate findings to disprove false alarms before they ever become developer tickets.
Sandbox Validation
Where applicable, Cyfendo executes automated proof-of-concept exploits in an isolated sandbox to confirm reproducibility and generate review-ready patches.
Public benchmarks. Verifiable results.
OWASP Benchmark provides publicly available source code and expected vulnerability labels designed to evaluate whether security tools can distinguish vulnerable code from safe controls.
Inspect Benchmark Methodology & Raw Confusion Matrices
OWASP Java v1.2 Suite (2,740 Tests)
- Total Test Cases: 2,740
- True Vulnerability Controls: 1,415
- Safe Controls (Non-Vulnerable): 1,325
- True Positives (TP): 1,377
- False Negatives (FN): 38
- True Negatives (TN): 1,148
- False Positives (FP): 177
- Recall: 97.30% (1,377 / 1,415)
- Specificity: 86.60% (1,148 / 1,325)
- False Positive Rate: 13.36% (177 / 1,325)
- Precision: 88.61% (1,377 / 1,554)
- F1 Score: 92.76%
- Youden J / OWASP Score: 0.840 (83.96%)
OWASP Python v0.1 Suite (1,230 Tests)
- Total Test Cases: 1,230
- True Vulnerability Cases: 452
- Safe Controls (Non-Vulnerable): 778
- True Positives (TP): 407
- False Negatives (FN): 45
- True Negatives (TN): 751
- False Positives (FP): 27
- Recall: 90.04% (407 / 452)
- Specificity: 96.53% (751 / 778)
- False Positive Rate: 3.47% (27 / 778)
- Precision: 93.78% (407 / 434)
- F1 Score: 91.87%
- Youden J: 0.866 (86.57%)
Python Scoring Note: Cyfendo's raw Python evaluation output contained 435 total findings. One finding flagged a shell helper script (helpers/resources/insecureCmd.sh) outside the formal BenchmarkTestNNNNN numbered benchmark cases. In strict adherence to OWASP scoring standards, this non-benchmark finding is excluded from benchmark tallying (435 − 1 = 434 official scored benchmark alerts).
Python Version Disclosure: OWASP Python v0.1 is currently designated a preliminary benchmark release by OWASP and contains 1,230 tests across 14 vulnerability categories.
Proprietary Research & Citation Policy: All benchmark figures, diagnostic metrics, and comparative evaluation data published on this page are proprietary research of Cyfendo Inc. No party may cite, quote, republish, reproduce, or redistribute these benchmark numbers in external marketing, commercial collateral, or public claims without explicit prior written agreement from Cyfendo Inc.
Nominative Fair Use & Trademark Notice: All product names, logos, trademarks, and registered trademarks referenced on this page (including CodeQL, GitHub, Semgrep, SonarQube, SpotBugs, FindSecBugs, PMD, Snyk, Checkmarx, Fortify, and OWASP) are the property of their respective owners. Their reference on this website is solely for nominative identification, technological categorization, and truthful comparative analysis under applicable Nominative Fair Use principles. Use of these names does not imply any affiliation with, endorsement by, sponsorship by, or certification from these respective trademark owners.
OWASP is a registered trademark of the OWASP Foundation, Inc. Cyfendo's evaluation is an independent study conducted against open benchmark suites and does not imply endorsement or certification by OWASP.
Security findings developers can trust.
Across 3,970 OWASP benchmark cases, Cyfendo demonstrates that high vulnerability coverage does not have to mean overwhelming alert noise. Its Java evaluation combines 97.3% recall with 88.61% precision and 92.76% F1, while Python achieves a 3.47% false-positive rate and 93.78% precision.
Put Cyfendo to work on your code.
See what market-leading security signal looks like on a real codebase.