Claims vs reality

Evidence categories stay separate.

Empty columns are findings, not omissions. NONE_FOUND is not NO; UNKNOWN is not a negative claim.

System / capability	Vendor claims	Primary documentation	Demonstrated	Benchmarked	Independently validated	Unknown
Microsoft AI Code Security Remediation	The Defender CLI can generate and apply code fixes directly from agentic scan results.	The Defender CLI can generate and apply code fixes directly from agentic scan results.	NONE_FOUND	NONE_FOUND	No independent validation published as of 2026-08-30.	Production effectiveness remains UNKNOWN.
Microsoft AI Code Security Alert Triage	Agentic code-scanning findings are published to Microsoft Security Exposure Management for organization-wide triage.	Agentic code-scanning findings are published to Microsoft Security Exposure Management for organization-wide triage.	NONE_FOUND	NONE_FOUND	No independent validation published as of 2026-08-30.	Production effectiveness remains UNKNOWN.
Microsoft AI Code Security Vulnerability Validation	The scanner claims broad language support with specially tuned expertise for C, C++, Java, and C#.	The scanner claims broad language support with specially tuned expertise for C, C++, Java, and C#.	NONE_FOUND	NONE_FOUND	No independent validation published as of 2026-08-30.	Production effectiveness remains UNKNOWN.
MDASH Vulnerability Validation	Codename MDASH is a private-preview agentic code scanner that surfaces code-level weaknesses across connected repositories.	Codename MDASH is a private-preview agentic code scanner that surfaces code-level weaknesses across connected repositories.	NONE_FOUND	NONE_FOUND	No independent validation published as of 2026-08-30.	Production effectiveness remains UNKNOWN.
MDASH Remediation	MDASH exports validated findings to CSV for existing remediation workflows.	MDASH exports validated findings to CSV for existing remediation workflows.	NONE_FOUND	NONE_FOUND	No independent validation published as of 2026-08-30.	Production effectiveness remains UNKNOWN.