{"canonical_url":"https://cyfendo.com/benchmarks","disclaimer":"This document contains a verified summary of published benchmark evaluation counts and computed metrics. It is derived from standardized OWASP Benchmark test suite evaluations under fixed scoring rules, not a raw scanner telemetry stream.","document_type":"EvaluationSummary","download_url":"https://cyfendo.com/data/owasp_benchmark_evaluation_summary.json","evaluation_date":"September 2026","evaluation_framework":"OWASP Benchmark Project","evaluator":"Cyfendo Inc.","last_updated":"2026-10-04","limitations":["Evaluated against standardized synthetic test suites (OWASP Benchmark Java v1.2 and OWASP Benchmark Python v0.1).","Measures static detection sensitivity (recall) and false-positive discrimination (precision/FPR); does not evaluate sandbox exploitability validation or patch synthesis quality.","Benchmark comparisons reflect published scores under identical standardized test suites, not real-world custom application codebases.","Performance on proprietary codebases may vary based on framework idioms, third-party libraries, and code structure."],"metric_definitions":{"f1_score":"Balanced F1 Score = 2 * (Precision * Recall) / (Precision + Recall). The harmonic mean of precision and recall.","false_positive_rate":"False Positive Rate (FPR) = FP / (FP + TN). Measures the rate at which safe control code is incorrectly flagged as vulnerable.","precision":"Precision = TP / (TP + FP). Measures the proportion of reported security findings that are genuine vulnerabilities.","recall":"Recall / Sensitivity = TP / (TP + FN). Measures the proportion of actual security vulnerabilities correctly identified by the scanner.","specificity":"Specificity (True Negative Rate) = TN / (FP + TN). Measures the proportion of safe control test cases correctly identified as non-vulnerable.","youden_index":"Youden's Index (J) = Recall - FPR (or Sensitivity + Specificity - 1). Standardized overall performance metric ranging from -1 to +1."},"schema_version":"1.0","suites":[{"computed_metrics":{"f1_score_percentage":95.21,"false_positive_rate_percentage":3.77,"precision_percentage":96.38,"recall_percentage":94.06,"specificity_percentage":96.23,"youden_index":0.9029},"confusion_matrix":{"false_negatives":84,"false_positives":50,"true_negatives":1275,"true_positives":1331},"evaluation_date":"September 2026","language":"Java","methodology":"Vendor-evaluated on OWASP Benchmark Java v1.2 test corpus. Evaluated using automated static AST taint tracking and reachability analysis.","safe_control_test_cases":1325,"scoring_scope":"Standardized OWASP Java v1.2 test suite (2,740 test cases across 11 vulnerability categories)","suite_name":"OWASP Benchmark Java","suite_version":"v1.2","total_test_cases":2740,"vulnerable_test_cases":1415},{"computed_metrics":{"f1_score_percentage":91.87,"false_positive_rate_percentage":3.47,"precision_percentage":93.78,"recall_percentage":90.04,"specificity_percentage":96.53,"youden_index":0.8657},"confusion_matrix":{"false_negatives":45,"false_positives":27,"true_negatives":751,"true_positives":407},"evaluation_date":"September 2026","language":"Python","methodology":"Vendor-evaluated on OWASP Benchmark Python v0.1 test corpus. Evaluated using automated static AST taint tracking and reachability analysis.","safe_control_test_cases":778,"scoring_scope":"OWASP Benchmark Python v0.1 test suite (1,230 test cases across 6 vulnerability categories)","suite_name":"OWASP Benchmark Python","suite_version":"v0.1","total_test_cases":1230,"vulnerable_test_cases":452}],"total_test_cases_evaluated":3970}