Intelligent Findings Analytics (IFA) and Intelligent Code Analysis (ICA) for SAST

Intelligent Findings Analytics (IFA)

Intelligent Finding Analytics (IFA) is an AI-powered technology that automatically does much of your triage work for you. As part of every scan, IFA analyzes the raw findings, filters out false positives, and surfaces the issues that genuinely matter. So your team starts from a focused, actionable list instead of thousands of results to sort through by hand.

At its core, IFA uses machine learning models trained for the specific language being scanned including code-aware AI that interprets code the way a developer would, understanding its structure and context rather than reading it as plain text. Each finding is classified as interesting or not, with a confidence score behind every decision. Interesting findings are surfaced for review.So the results are always transparent, never a black box.

These models are purpose-built and trained on a curated set of real, expert-labeled findings, with a model tuned to the patterns of each major language. Because that intelligence feeds directly into fix-group prioritization, the issues IFA surfaces are already organized so that a single, well-placed fix delivers the greatest security impact for the least effort.

This translates into cleaner, more focused results, reducing false positives by as much as 75% and keeping your team's attention on the findings that truly warrant it.

Intelligent Code Analytics (ICA)

Static analysis scans apply Intelligent Code Analytics (ICA). ICA automatically discovers new application programming interfaces (APIs) and assesses them for security impact. Through ICA, third-party APIs and frameworks are reviewed and assigned the correct security impact, allowing for more complete scan results.

Dataflow-based static analysis works by tracing how data moves through an application from the points where untrusted data enters (sources) to the sensitive operations where it could cause harm (sinks). For this to be accurate, the engine needs to understand the behavior of every API along that path, including the countless third-party libraries and frameworks modern applications rely on. New APIs appear faster than any rules database can keep up with, and classifying each one by hand is slow and error-prone.

ICA solves this by applying large language models that understand code to determine how each API behaves and recognizing which methods act as sources, which act as sinks, and what type of vulnerability each represents. This extends coverage automatically to APIs a purely rule-based approach would miss, and gives the engine a stronger foundation for tracing dataflows through complex codebases. The result is more accurate classifications, fewer misclassifications where benign methods are flagged or critical ones overlooked, and ultimately less noise and a clearer picture of the findings that genuinely carry security impact, so teams can move faster from scan to fix.