Pattern matching finds patterns. Attackers find weaknesses.
Why threat-model-driven analysis catches the vulnerabilities traditional scanners miss — with far less noise.
Traditional static analysis has a simple model of the world: here is a list of bad patterns, go find them. eval(. A string concatenated into a SQL query. A disabled TLS check. Grep, flag, repeat.
It works — for a while. Then the findings pile up, most of them don't matter, and developers learn to ignore the tool. The signal drowns in the noise.
The problem isn't detection. It's context.
A scanner that flags every string concatenated into a database call will find real SQL injection — and hundreds of cases that are parameterised one function up, or never touch untrusted input at all. It can't tell the difference, because it doesn't model how data actually flows through your system or how an attacker would reach it.
Attackers don't think in patterns. They think in goals: can I read another tenant's data? can I escalate from this endpoint to admin? what happens if I replay this token? They chain small weaknesses into real compromise.
Threat-model-driven analysis
Codelight starts from the attacker's perspective. Instead of matching syntax, it builds a model of your system — entry points, trust boundaries, the paths that carry untrusted input — and reasons about what is actually exploitable.
That changes the output:
- Fewer false positives. A finding has to be reachable and exploitable, not merely suspicious.
- Higher-severity findings first. Business-logic flaws and broken access control — the things pattern matchers can't see — rise to the top.
- Explanations developers trust. Each finding comes with the path an attacker would take, not just a line number.
The result is a tool people actually act on, because when it says something matters, it usually does.
Less noise is a security feature
Every false positive costs attention, and attention is the scarcest resource in security. A scanner that cries wolf trains your team to ignore it — including the one time it's right.
Modelling threats instead of matching patterns is how you earn that attention back.