Trail of Bits frames security auditing as "good enough AI" era

Trail of Bits has published a useful view of what AI-assisted security auditing does to a professional services business. The point is not that AI replaces the auditor. It changes what clients are paying for, how work is delivered, and where the quality bar needs to sit. You can read the original report.

For owners running an AI-enabled services firm, this is the commercial question to watch. If AI handles more of the repeatable analysis, a traditional time-and-materials model starts to look less convincing. Clients won’t necessarily care how many hours your team spent producing an answer. They’ll care whether the answer is reliable, whether the risks were caught, and whether someone accountable stands behind the result.

That creates pressure in two directions. You may be able to deliver work faster and serve more clients with the same team. But you also need a clear definition of “good enough” for each service. Where can AI speed up research, first drafts, testing, triage, or reporting? Where does experienced human review remain non-negotiable? If you can’t explain that boundary, pricing gets difficult and trust erodes quickly.

The stronger model is likely a productized retainer with defined outcomes, review steps, response times, and clear limits, rather than selling a vague pool of expert hours. This is the kind of thing we build into an AI command centre, making the workflow, controls, and accountability visible as AI takes on more operational work.