Much of the debate about agentic code scanning revolves around three core questions: Do more capable models find more vulnerabilities? Where does deterministic, rules-based SAST still fit? What does ...