--- title: "Building Reliable AI Systems for Security and Privacy Reviews" description: "AI is transforming security reviews. Learn how to structure prompts, enforce output normalization, and build guardrails that scale security and work in production without compromising trust." canonical: https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews --- # Building Reliable AI Systems for Security and Privacy Reviews _Emily Choi-Greene · 2025-07-28 · Artificial Intelligence_ Half of all new code is now AI-generated. But security teams haven’t scaled to match. As an industry, we ship more software, face greater compliance requirements, and integrate with more third-party vendors than ever before. Security teams, doing critical work, can no longer scale with manual reviews alone. The obvious answer is to use AI tools to accelerate security reviewers. But there is a massive gap between throwing ChatGPT at the problem and building reliable AI systems. Hallucinations, untraceable reasoning, and non-deterministic outputs can turn a security tool into a liability. Here’s how we’re solving this at Clearly AI. ## Why security reviews don't scale anymore Security teams were already stretched thin before AI. Now, with tools like Cursor and Claude Code, the scale is staggering. Cursor is now used by [53% of Fortune 1000 companies and generates over 100M lines of enterprise code daily](https://cursor.com/enterprise). GitHub Copilot reports that [half of all new code is AI-generated](https://www.wired.com/story/fast-forward-ai-rewiring-coders-brains-github-copilot/). That’s a win for innovation, but it also means a growing volume of code entering production without security review. ![Line chart of daily active users of agentic software from January 2024 to February 2025, climbing from under 200 to about 550 — a 215% increase (data from Microsoft)](/blog-images/building-reliable-ai-systems-for-security-and-privacy-reviews/building-reliable-ai-systems-for-security-and-privacy-reviews-1.png) _Data from Microsoft indicates a massive increase in agentic software adoption._ Manual security reviews worked when we planned features in quarters and launches in sprints. But when developers can turn ideas into entire microservices in minutes, security teams risk becoming a bottleneck or missing critical vulnerabilities that ship to production. To match this new velocity, security teams need tools that can evaluate code, specs, and even ideas at scale. ## Pick the right tool for the job Building AI tools for security is like building AI tools for any other complex domain. It requires knowing when to actually use AI, when to use code, and when to call upon human judgment. ### Where AI works best Many security and privacy tasks have characteristics that align well with AI strengths. Privacy impact assessments, for example, require understanding diverse context types like codebases, documents, and diagrams. LLMs can ingest diverse formats and produce a normalized output that’s ready for review in seconds. Well-defined, consistent workflows and frameworks like STRIDE represent a perfect use case for AI automation. LLMs can handle repetition at scale with infinite patience. They can process in parallel, in response, and on schedule. **Use AI to:** - Convert unstructured data into structured data - Process large and vast amounts of diverse context - Handle unexpected situations at scale - Find patterns in messy data - Follow well-defined, structured processes, ad nauseam ### Where AI struggles Today, LLMs do not deal well with logic gaps and sparse context. Their output quality depends on the quality of their input. If available documentation is incomplete, noisy, or otherwise requires unwritten context or judgment, the task should escalate to a human expert. While AI offers great scalability, it cannot yet match humans when it comes to judgment. Taste, values alignment, intuition, and social, organizational, and historical context are critical pieces of problem-solving, and humans do that best. They can better disambiguate and balance customer, business, and compliance priorities. When making risk tradeoffs, defining policies and specifications, or disambiguating, call on a human. **Call on a human for:** - Critical judgment calls requiring values alignment, intuition, taste - Understanding social/organizational/historical context - Making risk tradeoffs and defining policies - Disambiguation where context matters - Tasks with unclear process or missing key information - Tasks with significant tradeoffs, with no clear “right” answer ### What about code? AI handles unstructured inputs and adapts to novel situations better than code. But it also introduces non-determinism, which adds engineering work. Production AI systems need evaluation, iterative tuning, and, for now, human monitoring to ensure reliability, completeness, and accuracy. If code can handle the use case, it should. Code remains consistent, effective, and cheap. Code is becoming even cheaper with AI that can write the code for you. Whether handwritten or generated, code can be tested and even proven correct. Code behavior gets defined once, and then deployed. Code does not suddenly change unpredictably. When you need a fixed deterministic output, traditional code can be a better choice than AI. These methods provide consistent, testable results and are easy to validate. At Clearly AI, we rely on deterministic logic to detect secrets in code or classify structured data fields, where precision and repeatability are non-negotiable. **Use code for:** - Workflows that benefit from automation but don’t require interpretation - Functions that must behave the same way every time, regardless of input nuance - Tasks where probabilistic outcomes are not tolerated (100% not 99.95%) ## Engineering reliability with LLMs Determining which tasks AI can do well is the first step, but getting consistent, secure outcomes requires strong prompts and built-in guardrails. LLMs are prone to hallucination when left unchecked, so it's critical to structure their reasoning and validate their outputs. Here are some of the techniques we use at Clearly AI: - **Improve RAG outputs with tool use (function calling).**Traditional RAG systems rely on semantic search to retrieve relevant documents, but embedding models aren’t great at fine-grained distinctions.When many retrieved documents are conceptually similar (e.g., several IAM policies or compliance checklists), the model may get overloaded with near-duplicates. Without task-specific retrieval or stronger filtering, even a well-prompted model is likely to misapply context or blend documents that should stay separate. **At Clearly AI, we go beyond basic RAG.**We use LLMs to orchestrate tool calls, request more targeted inputs, and validate retrieved context. This helps build context beyond the code to include what’s going on around it, who’s supposed to be accessing it, and more. ![Diagram of LLM tool use / function calling: user text inputs flow into an LLM system that detects tool calls, invokes external tools, and reprompts the model with tool outputs to produce tool-augmented answers](/blog-images/building-reliable-ai-systems-for-security-and-privacy-reviews/building-reliable-ai-systems-for-security-and-privacy-reviews-2.png) - **Chain-of-thought (CoT) prompting.**Like asking a math student to “show your work,” CoT encourages the model to reason through a problem step-by-step, forcing the model to expand the problem space before generating a final output. Every time an LLM outputs a token, it's taking what's been said so far and guessing at the next statement. So once it gets off track, it's much harder for it to self-correct than to continue with the wrong answer. CoT reduces the likelihood of this happening by encouraging the LLM to "meander" or think out loud and consider a few directions before it commits. This reduces the chance of unsupported answers and makes the model’s logic easier to inspect and debug. - **Explicitly design prompts to accept uncertainty.**LLMs will hazard a guess if they are forced to answer. So it's best to give them an escape hatch, allowing them to admit when they don’t know. Prompt engineering must normalize behaviors like requesting more context, flagging incomplete information, or declining to answer definitively when appropriate. At Clearly AI, we also calibrate prompts to allow for varying levels of uncertainty, since a “pretty certain” can be more helpful to a human reviewer than a flat “unsure.” - **LLM as Self Verification.**Use a separate LLM call to check the first model’s output against source material to validate accuracy. It acts as a second set of eyes, catching hallucinations or inconsistencies before results reach a human reviewer. These layers help ensure that AI actually reduces risk, instead of introducing new uncertainty. ## Getting consistent, actionable, grounded output. To make LLM outputs useful for security reviews, structured output is essential. At Clearly AI, we treat output structure as a first-class concern. We use tools like [BAML](https://github.com/boundaryml/baml), an open-source framework for prompt-based systems, to enforce consistency across outputs and build normalization directly into our workflows. Here’s how we structure the process: ### 1. Architectural Context Ensure the model understands the system it’s reviewing: - Break down infrastructure types - Require file paths and line numbers for cited code - Extract relevant dependencies and tags for traceability #### 2. Vulnerability Categories Tailor prompts to the specific risk areas being reviewed: - Excessive IAM permissions - Open ports or misconfigured firewalls - Overly broad IP allowlists or CIDR blocks #### 3. Normalize Output Format Structure the findings so they’re immediately usable: - Match output fields to an existing database schema - Enforce consistent formatting for severity, location, and recommendations - Enable easy cross-querying and filtering downstream #### 4. Automate the Final Report (optional) Have the LLM generate structured reporting directly: - Output reports tailored for reviewers, auditors, or compliance teams ![Code editor screenshot of a BAML ExtractClaims prompt that breaks an answer into minimal verifiable claims, with an example contrasting a vague claim against well-scoped good claims](/blog-images/building-reliable-ai-systems-for-security-and-privacy-reviews/building-reliable-ai-systems-for-security-and-privacy-reviews-3.png) This layered approach keeps LLMs aligned with engineering expectations, protects against some forms of prompt injection, and prevents answers that break downstream systems. For more tool recommendations, check out our [AI Engineer Cheat Sheet](/blog/the-ai-engineer-cheat-sheet). ## Scaling security without compromising trust AI can speed up workflows without reducing quality. But it requires disciplined implementation and ongoing scrutiny of its risks. Context engineering remains critical: if the input is incomplete, the output will be too. And there are familiar risks that take a new form with AI, like context poisoning. Applying AI responsibly means knowing where it adds value and reinforcing those areas with the right engineering controls. AI is already reshaping security reviews, making the process faster, more secure, and more scalable. If you're ready to see how [Clearly AI](/) applies these principles in practice, contact us at [support@clearly-ai.com](mailto:support@clearly-ai.com) for a demo. To learn more, check out my talk on this topic at [fwd:cloudsec](https://fwdcloudsec.org/conference/north-america/) this summer: ![YouTube thumbnail for the fwd:cloudsec talk on building reliable AI systems for security and privacy reviews](/blog-images/building-reliable-ai-systems-for-security-and-privacy-reviews/building-reliable-ai-systems-for-security-and-privacy-reviews-yt-1.webp) ## Learn more - [Secure everything that ships](https://clearly-ai.com) - [We built the tool we wished we had](https://clearly-ai.com/about-us) - [One platform. From intake to remediation.](https://clearly-ai.com/platform) - [Know everything that needs a review. Skip the 300-question form.](https://clearly-ai.com/platform/security-intake) - [Ask only what matters. Get it right the first time.](https://clearly-ai.com/platform/conversational-intake) - [Every finding, tracked to a decision](https://clearly-ai.com/platform/resolve/risk-registry) - [Show leadership and auditors exactly what security reviewed](https://clearly-ai.com/platform/resolve/reporting) - [Security reviews you can stand behind, every time](https://clearly-ai.com/platform/quality) - [Threat models built from the tools you already use](https://clearly-ai.com/integrations) - [Threat models that know about today's attacks](https://clearly-ai.com/platform/threat-intelligence) - [Automate every step around the review](https://clearly-ai.com/platform/workflows) - [Threat models your teams can work on together](https://clearly-ai.com/platform/collaboration) - [Understand the system before the review starts](https://clearly-ai.com/platform/enterprise-context-graph) - [Trust, security, and deployment](https://clearly-ai.com/platform/trust-security-and-deployment) - [Every plan reviewed. Every risky change threat modeled.](https://clearly-ai.com/platform/ide-and-mcp) - [Verify what actually shipped](https://clearly-ai.com/platform/control-and-remediation-verification) - [A current threat model for everything that ships](https://clearly-ai.com/solutions/continuous-threat-modeling) - [Prove every product that ships meets your security bar](https://clearly-ai.com/solutions/product-security-assurance) - [Privacy reviews your team can stake decisions on](https://clearly-ai.com/solutions/privacy) - [Every vendor reviewed against your standards](https://clearly-ai.com/solutions/third-party-risk) - [Review every design before it's built](https://clearly-ai.com/solutions/design-and-architecture-reviews) - [Secure the AI you build, buy, and code with](https://clearly-ai.com/solutions/ai-agentic-security) - [Every regulation you answer to. One review process.](https://clearly-ai.com/solutions/compliance) - [Every product ready for the Cyber Resilience Act without growing your team](https://clearly-ai.com/solutions/compliance/cyber-resilience-act) - [Build vs. buy for security review automation](https://clearly-ai.com/compare/claude-chatgpt) - [The ThreatModeler alternative built from your own docs, code, and policies](https://clearly-ai.com/compare/threatmodeler) - [The Clover Security alternative with findings your team can trust](https://clearly-ai.com/compare/clover) - [The Prime Security alternative for every review your team runs](https://clearly-ai.com/compare/prime) - [Security and Privacy](https://clearly-ai.com/trust/security-privacy) - [Clearly AI Privacy Policy](https://clearly-ai.com/trust/privacy-policy) - [Clearly AI Subprocessors](https://clearly-ai.com/trust/subprocessors) - [Contact](https://clearly-ai.com/contact) - [Contact Enterprise Sales](https://clearly-ai.com/demo) - [Latest from the Clearly AI blog](https://clearly-ai.com/blog) - [In the news](https://clearly-ai.com/press) - [How Ericsson Enterprise Wireless Solutions cut review times by up to 80%](https://clearly-ai.com/customer-stories/ericsson) - [How HID Global reviews 300+ products for the Radio Equipment Directive with the team it already has](https://clearly-ai.com/customer-stories/hid-global) - [How Rivian scaled privacy and AI governance reviews 4x without adding headcount](https://clearly-ai.com/customer-stories/rivian) - [Part 2! Okay, privacy is different from security. Now what?](https://clearly-ai.com/blog/part-2-okay-privacy-is-different-from-security-now-what) - [How AI is rewiring our product engineering workflow](https://clearly-ai.com/blog/how-ai-is-rewiring-our-product-engineering-workflow) - [Good Data Scientists and Bad Outcomes, Part 1: What's the difference between security and privacy work?](https://clearly-ai.com/blog/good-data-scientists-and-bad-outcomes-what-s-the-difference-between-security-and-privacy-work) - [Why I Joined Clearly AI](https://clearly-ai.com/blog/why-vp-marketing-joined-clearly-ai) - [Skip the Marketing: Clearly AI for Technical People](https://clearly-ai.com/blog/clearly-ai-technical-explanation) - [Clearly AI Raises $8.4M Seed Round to Scale Product Security](https://clearly-ai.com/blog/seed-round) - [Why We Started Clearly AI](https://clearly-ai.com/blog/why-we-started-clearly-ai) - [Applying AI to Threat Modeling - Where AI Thrives, Survives, and Dies](https://clearly-ai.com/blog/applying-ai-to-threat-modeling) - [Why We Build in Public](https://clearly-ai.com/blog/why-we-build-in-public) - [Solving the Threat Modeling Bottleneck with AI Workflows](https://clearly-ai.com/blog/solving-the-threat-modeling-bottleneck-with-ai-workflows) - [Clearly AI Named Finalist in the 2025 Okta Startup Challenge](https://clearly-ai.com/blog/clearly-ai-named-finalist-in-the-2025-okta-startup-challenge) - [Security, SOC 2, & Startups](https://clearly-ai.com/blog/security-soc-2-startups) - [Building Reliable AI Systems for Security and Privacy Reviews](https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews) - [How to Automate Security and Privacy Reviews with Clearly AI](https://clearly-ai.com/blog/how-to-automate-security-and-privacy-reviews-with-clearly-ai) - [One Year of Clearly AI](https://clearly-ai.com/blog/one-year-of-clearly-ai) - [Navigating EU RED Compliance: Meeting the August 2025 Deadline](https://clearly-ai.com/blog/navigating-eu-red-compliance-meeting-the-august-2025-deadline) - [The AI Engineer Cheat Sheet](https://clearly-ai.com/blog/the-ai-engineer-cheat-sheet) - [Intelligent Vendor Risk Assessments](https://clearly-ai.com/blog/intelligent-vendor-risk-assessments) - [Clearly AI wins the AWS Bedrock Builder's Challenge](https://clearly-ai.com/blog/clearly-ai-wins-the-aws-bedrock-builder-s-challenge) - [Reviews, reviews, reviews!](https://clearly-ai.com/blog/reviews-reviews-reviews) - [Halfway through YC](https://clearly-ai.com/blog/halfway-through-yc) - [llms.txt — site overview for LLMs](https://clearly-ai.com/llms.txt) - [llms-full.txt — full site content for LLMs](https://clearly-ai.com/llms-full.txt) - [sitemap.xml — all public routes](https://clearly-ai.com/sitemap.xml) - [Documentation](https://docs.clearly-ai.com/docs) [Canonical page](https://clearly-ai.com/blog/building-reliable-ai-systems-for-security-and-privacy-reviews)