Verona, Italy, July 31, 2026 (GLOBE NEWSWIRE) -- ISGroup, an Italian cybersecurity company, has published "What Can an Attacker Find With an LLM?", a large-scale study on the use of Large Language Models to identify vulnerabilities in source code.
The case study focuses on GlobaLeaks, an open-source whistleblowing platform developed over more than a decade and previously reviewed through several independent security audits. The analysis, conducted with the support of models from Anthropic and OpenAI and accompanied by systematic human validation, resulted in the confirmation of 29 vulnerabilities, 12 denial-of-service issues, and 42 hardening observations.
Overall, approximately 1.24 billion tokens were processed through 12,000 model requests. These results produced 110 candidates, all of which were manually triaged by ISGroup researchers. Every model output was treated as a hypothesis requiring verification. Reproduction, impact assessment, and final classification remained the responsibility of the security specialists.
All findings were shared with the GlobaLeaks developers before publication. The most critical issues were addressed, contributing to the security of software used by news organisations, companies, and public administrations to protect sources and whistleblowers.
The research examines how access to frontier models can expand the capabilities of those analysing software. Lower costs now make it possible to review entire repositories more broadly and continuously, an activity that until recently required weeks of specialist work and substantial budgets.
To guide the analysis, ISGroup defined a threat model, a taxonomy of the main classes of software weaknesses, and specific evidence requirements.
"Artificial intelligence does not replace specialist expertise, but it increases the amount of code a team can analyse and reduces the cost of doing so," said Francesco Ongaro, founder of ISGroup. "Experts still have the decisive role of distinguishing a plausible hypothesis from a real vulnerability."
The study also describes the limitations of the approach, including false positives, non-deterministic results, and the need for rigorous human validation.
The full report, including the methodology, costs, and results, is available here: https://www.isgroup.biz/en/cyber-security/llm-based-code-security-review-costs-findings-methodology.html
Notes for Editors
Francesco Ongaro is available for interviews and technical briefings. A one-page summary of the methodology and aggregated data on model usage are available upon request.
About ISGroup
ISGroup S.r.l. is an Italian cybersecurity company serving clients around the world across a wide range of industries. The company specialises in security research, security assessments, penetration testing, and advanced security analysis of applications and infrastructure. Website: www.isgroup.biz
Francesco Ongaro Founder, ISGroup S.r.l. Email: francesco.ongaro@isgroup.it Phone: +393518158844 (WhatsApp)
