Good Questions.
Straight Answers.

Yes, including Mythos. New models arrive quickly, though, and we may not yet know about or have access to a model that has just been released. Access also does not mean every model is used in every scan: we evaluate models before adding them to zkao.

We aim to use all state-of-the-art models whose providers offer a cyber plan that supports security research, alongside the latest open-weight models that perform well in our benchmarks.

The idea behind zkao is to combine as many effective techniques and models as we can to find as many bugs as possible. We keep evaluating new releases and updating the mix.

Yes. We have trained and fine-tuned our own models, but they are not currently used in zkao. Their results are not yet good enough to include them.

We call asking a vanilla model to audit your code "vibe auditing." It can find bugs, but zkao adds a dedicated security harness: multiple models, specialist techniques, tools, prompts, and skills, with findings checked before they reach you.

That is the advantage we build for. It is not a claim that zkao wins on every codebase or against every security feature those products offer. Different approaches can find different bugs.

SAST analyzes source code. DAST tests a running application. When we say security harness, we mean an agent-based system that coordinates models, tools, and audit techniques to investigate code and validate findings.

Most of the work goes into how the agents operate, rather than changes to the underlying models. A harness can also use static and dynamic analysis tools as part of an investigation.

We would expect it to be different. A team working full time on this problem for years could build something that resembles zkao: many techniques, prompts, skills, and models working together. Your harness may also know things about your code that ours does not.

Our advantage is the experience behind it. At zkSecurity, we still find bugs during manual cryptography audits that zkao cannot find. We turn those lessons into improvements that teach zkao to catch more of them. New models and every audit we do give us more ways to improve the tool.

Meet zkSecurity

Cost depends heavily on the size and complexity of the code you want audited. You set a budget for each scan and never pay more than that cap. As with other LLM work, there is plenty of room to spend more if you want to go deeper.

For Deep Audit, our most expensive scan type, we recommend a budget of around $2,500 to $5,000, depending on the scope. This is guidance, not a fixed price. If runtime usage exceeds the budget you selected, we absorb the overage. A budget cap does not guarantee that every part of an audit finishes.

How pricing works

We recommend running Deep Audit as often as your budget allows. On frozen code, aim for 3 to 10 completed, adequately funded audits of the same scope with no new findings. Repeated clean results build confidence, but do not prove that the code is free of bugs.

After that, we generally recommend putting additional budget into Continuous Testing, our continuous audit feature. It builds on earlier work and keeps testing the repository over time.

Explore Continuous Testing