Phase 5: Security Testing AI-Generated Code · 60 min · Semgrep · Bandit · Z3 SMT solver

Building Security Gates

6 industry tools combined catch 7.6%. Build a gate that catches the other 92.4%.

Hiring signal: Engineers who can build multi-layer security pipelines (SAST + formal verification + AI review) address the 97.8% gap in industry tools and demonstrate production-grade security engineering.

What you will learn

Compose SAST + formal verification + AI review into a multi-layer security pipeline
Understand the 97.8% gap: 6 industry tools combined catch only 7.6% of Z3-proven vulnerabilities
Build a security gate that enforces all three layers in CI/CD
Configure gate thresholds and failure modes for each layer

The Problem

The Z3 study found that 6 industry security tools combined catch only 7.6% of Z3-proven vulnerabilities. That's a 97.8% gap -- 92.4% of formally proven vulnerabilities are invisible to industry tools. This lesson covers how to build a multi-layer security gate that closes this gap by combining SAST, formal verification (Z3), and AI review.

The 97.8% Gap

Layer	Detection Rate	What it catches	What it misses
SAST (6 tools combined)	7.6%	Known patterns (SQL injection, XSS)	Novel patterns, context-specific flaws
Z3 Formal Verification	100% (of provable)	All mathematically provable vulnerabilities	Vulnerabilities not encoded as constraints
AI Review	78.7%	Context-aware analysis, novel patterns	21.3% of vulnerabilities
Combined (SAST + Z3 + AI)	~97%	Nearly all vulnerabilities	~3% residual

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Multi-Layer Security Gate Architecture, Gate Configuration, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.