Frontier LLM Security Scan Costs

corpus_bytes = Σ(bucket.count × bucket.mean_size)
scannable_bytes = corpus_bytes × (1 − noise%)
scannable_tokens = scannable_bytes / chars_per_token
billable_input = scannable_tokens × input_amplification × passes × (1 + retry_rate)
billable_output = billable_input × output_input_ratio
per_scan_cost = ((billable_input / 1M) × in_price + (billable_output / 1M) × out_price) × (1 − discount%)
effective_rescan_pct = min(100%, delta_pct × blast_multiplier)  ·  full re-scan = 100%
annual_cost = per_scan_cost × (1 + releases_per_year × effective_rescan_pct)

• Harness profiles approximate three publicly-described approaches to LLM-driven code review. Multipliers are derived from disclosed methodology + adjacent empirical studies — vendors do not publish exact token-amplification factors. Tune via the advanced strip if you have telemetry from a pilot run.
• Triage profile (1.5× input amplification, 1 pass, ~0.1 findings/M source tokens) models a single-pass diff-aware sweep — Claude's /security-review, GitHub Copilot Autofix, Semgrep AI. Lowest cost per scan; lowest yield. Semgrep+Claude reports 19% FPR vs 41% for naive LLM-only.
• Deep audit profile (10× input amplification, 3 passes, ~1.0 findings/M source tokens) models Anthropic Project Glasswing: multi-stage verification where the model "re-examines each result, attempting to prove or disprove its own findings" (Anthropic). Glasswing reports 90.6% TPR on independently-assessed high/critical findings.
• Agentic find-and-fix profile (30× input amplification, 4 passes, ~2.0 findings/M source tokens) models OpenAI Aardvark: 4-stage pipeline — repository analysis → commit scanning → sandbox exploit validation → patch generation via Codex. Aardvark reports 92% recall on golden repositories. (Daybreak is the enterprise platform that wraps Aardvark + Codex Security on GPT-5.5.)
• Input amplification is the dominant cost driver. The 10–30× range comes from project-scale empirical data: LLMDFA consumes ≈38M input tokens per Java project; RepoAudit consumes up to 225M input tokens per C/C++ project (arXiv 2601.19239). Agentic loops, retrieval, and re-reads compound fast.
• Reasoning is priced, not multiplied. Premium models (GPT-5.5 Pro, Claude Opus 4.8) emit more tokens per task — but their output rate card already prices this in (GPT-5.5 Pro $180/M output vs Sonnet $15/M). The profile's output:input ratio captures the harness-level reasoning intensity; the model's per-token rates do the rest. No double-multiplier.
• Smart re-analysis. On a delta release you don't re-scan everything — but you also can't scan changed files in isolation: the harness needs the dependency closure (callers, shared utilities, taint reverse paths). The re-analysis strategy dropdown picks a blast multiplier on top of delta_pct: Delta-only = 1× (perfect isolation, rare), Smart = 3× (CodeQL-incremental style), Module = 6× (PR-gating default), Naïve = full re-scan (often required for regulated-industry attestation). Effective re-scan is capped at 100%.
• Overall discount. Captures negotiated enterprise contracts and Provisioned Throughput (Azure PTU, Bedrock PT) commitments — applied after per-token math, before annualisation. List-vs-contract spread on frontier vendors typically sits in the 15–35% range for commitments above $100K/year. Use the LLM Cost Calculator's per-hosting negotiated-rate strip for finer-grained modelling.
• Noise exclusion covers committed build artifacts (dist/, target/), vendored dependencies (node_modules/, vendor/), and generated files. 25% is a mid-range estimate from enterprise monorepo audits — pre-filtering at inventory time is more accurate than a flat percentage.
• Token conversion. 3.0 chars/token reflects source-code tokenization on tiktoken for Python/JS/Java (fast.ai benchmark). Code is ≈2× denser per byte than English prose. Verbose languages (Java, C#) trend higher; Python trends lower; OCaml goes as high as 5.9.
• Annual cost assumes a baseline full scan plus N delta scans, where N = releases/year and each delta is delta% of the corpus. Cron-only deep scans plus per-PR triage is a common hybrid — model it by setting cadence to your deep-scan frequency and dropping a triage column.
• Findings yield is shown per million source tokens — the executive frame ("findings per million tokens of code we own"). Defaults: triage 0.1, deep audit 1.0, agentic 2.0. Calibration: Glasswing reported 6,200 high-crit findings across 1,000+ OSS projects (~5B source tokens) → ≈1.2 / M source on a Glasswing-class harness, matching the deep-audit default. Yield assumes lab-condition vulnerability density; mature, well-maintained codebases may produce 3–10× less.
• False-positive rates for context: Glasswing 9.4% on high/critical, SWE-AGENT FP-filter 6.3%, Agent Audit 14%, Semgrep+Claude 19%. The triage profile alone runs much higher (30–40%); the FP-filter pass (built into Deep Audit and Agentic) is what drops it.
• Provisioned throughput / reserved capacity tiers (Azure PTU, Bedrock PT) are not modelled — those are negotiated quotes, not per-token rates. Use the LLM Cost Calculator's negotiated-rate strip for ballparking.

Token pricing: reused from the LLM Cost Calculator dataset (LiteLLM aggregator, snapshot 2026-06-07).
Anthropic Project Glasswing: official landing · initial update (May 2026) · expansion (June 2026)
OpenAI Aardvark / Daybreak: Aardvark introduction · Daybreak launch
Empirical token data: LLMDFA / RepoAudit at project scale · SEC-bench ($0.87/instance) · Semgrep+Claude FPR study · fast.ai code tokenization
Multipliers are mid-range planning estimates — re-verify against telemetry from a pilot run before any budget commitment.