It's entirely possible to address all the LLM-found issues and get an "all green" response, and have an attacker still find issues that your LLM did not. Either they used a different model, a different prompt, or spent more money than you did.

It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

> It's not a symmetric game, either. On defense, you have to get lucky every time - the attacker only has to get lucky once.

This! I love OSS but this argument seems to get overlooked in most of the comments here.