What is AI SAST

A cluster of vendors now sell something they call AI SAST. They do not mean the same machine. Aikido said the term is contested. Cycode said vendors treat three products as interchangeable. Checkmarx and Endor Labs each named a product AI SAST anyway.

If you shop the phrase, you shop a category fight. If you map the machines, you can pick one.

The three machines

Aikido's definition post, What is AI SAST?, leads with this: AI SAST is static application security testing where the engine is an AI that reasons about code instead of matching it against patterns. Cycode's What is AI SAST split is architectural: AI on top of a scanner, AI writing the rules, and agentic reasoning from the code. On Finding vulnerabilities at every stage, Aikido maps the phrase onto three jobs you can buy. Those jobs are the three products.

• Rules on commits: a pattern engine that runs as you push. Traditional Aikido SAST is this job. The AI-augmented overlay triages, writes a patch, or extends the queries to a language they do not cover. Checkmarx's product named AI SAST is hybrid routing: their 3.66 notes send supported languages to the query engine, and unsupported languages to an LLM, then show one result set.
• Whole-repo reasoning: an on-demand reading of source, no live app. Aikido maps what the market often calls AI SAST to this SKU, Code Security Audit.
• PR-scoped reasoning: the same kind of reading, scoped to a pull request. Aikido calls this Deep PR Review. Their PR Review page prices it at one credit per reviewed pull request.

A platform that sells all three still has three jobs. A specialist that sells one of them is not a missing platform. It is a different unit.

What gets loaded onto the phrase

Once the native meaning is the headline, the rest of the platform rides along: AutoFix pull requests, all languages, credits, several hosts, a pentest SKU. Those are product choices. They are not implied by a model reading whether a handler checks ownership. Aikido's current AutoFix page is AI Autofix: it turns findings from SAST, SCA, IaC, and containers into merge-ready pull requests. That is remediation, not a new detector.

Endor Labs named a product AI SAST in November 2025. Corgea publishes its own What is AI SAST guide and treats the phrase as an umbrella. Aikido's list of AI-native tools names ZeroPath, Corgea, AISLE, Depthfirst, and Black Duck Signal. The list does not settle which machine you are buying. It settles who wants the query.

The job on a GitHub pull request

Aevral is an AI security reviewer for GitHub pull requests. It is not a general SAST, and it does not take the AI SAST name. PR review looks for access control, business logic, SQL and command injection, XSS, SSRF, path traversal, unsafe deserialization, token and session flaws, and LLM-integration risks. Whole-repo scans read authorization, IDOR, and business-logic access control only. A finding is a lead with evidence, and a suggestion you apply. Nothing merges without you. Aevral runs on open-source models, processed in the US today, with an EU-only option announced..

Keep the rules engine you already run. Semgrep, CodeQL, Snyk Code, Aikido SAST: that job stays. The page that says this in two directions is Is Aevral SAST?. How Aikido's Code Security Audit and Deep Review sit next to that job is on Aevral and Aikido.

Buy the machine

If you need pattern coverage on commits, buy a SAST. If you need a whole-repo reasoning audit before a release, that is the SKU Aikido maps to AI SAST. If you need a reviewer on the GitHub pull requests your agents open, that is a PR reviewer. Install the GitHub App on a public repository and read what comes back.