AI providers and cost

Every AI feature runs on models you connect here: AI Native SAST, dependency checks, secrets verification, proof-of-concept generation, the AI Pentest, AI DAST and drafting custom rules. Until a model answers the default route, AI scans cannot start.

The setup has three parts, in this order:

A fourth card, AI usage by task, shows what each task has spent.

System AI and a team's own models

The same four cards appear in two places:

On the team's AI tab, the AI provider card has one field, Use:

Click Save after changing it. Only team admins can change the team's AI; other members see the settings read-only. A team's models never fall back to the system's, and the system's never fall back to a team's.

Connect your first AI provider

This sets up the system AI, which every team uses by default. To give one team its own models instead, do the same steps on Teams → AI after setting Use to This team's own models and clicking Save.

Before you start

Steps

1. Open System Settings (sidebar, Admin) and the Shared services tab.

   Check: the System AI, Task routing, AI connections and AI models cards are shown. Task routing says No model answers the default route yet: AI scans cannot start until one does.

2. In AI connections, click Add connection. Enter a Name (for example Main), choose the Kind (OpenAI-compatible or Vertex AI (Claude)) and fill in the fields of that kind (see Connection fields).

3. A person types the API key or pastes the service account key into the form. An OpenAI-compatible server at its own API URL that takes no key, such as vLLM or Ollama inside the network, is saved with the key left empty.

4. Click Save.

   Check: the connection is listed with Key saved, or No key for a server without one.

5. In AI models, click Add model. Enter a Name (for example Strong), choose the Connection you just saved, enter the Model ID, and click Save.

   Check: the model is listed as Usable, and the Task routing card now shows it on the Default row. The first model you add answers the default route, which every task falls back to.

6. Click Test beside the model.

   Check: it says Answered in N s followed by the model's reply.

7. In the System AI card, click Test connection.

   Check: it says The system AI answered.

Every team that uses the system AI can now run AI scans. A team admin can confirm it for one team with Teams → AI → Test connection: AI answered, using the system AI.

If it does not work

Connection fields

The Add connection form. Fields marked system only appear only in System Settings.

Model fields

Each model in the list shows its status — Usable, Cannot be used (with the reason) or Turned off — how many routes use it, and Test, Edit and Delete.

Task routing

The Task routing card lists the tasks with the model that answers each one, under Answered by. A route is a First model and, under Then, the models to try next when it does not answer.

• The Default route answers every task without a route of its own, and is every task's last fallback. It cannot be emptied once set.
• The feature rows are AI SAST, Dependency checks, Secrets verification, PoC generation, AI pentest, AI DAST and Custom rules. A feature without its own route uses the Default route.
• Show the steps expands a feature into its steps. Each step is marked needs a strong model, a mid model is enough or a fast model is enough; a step without its own route uses the feature's.
• A step marked Tool loop asks models with tool calling first.

To route a task, click Change on its row, pick the First model and any Then models, and click Save. Use the route above removes the task's own route again.

When a model does not answer the availability check at the start of a scan, it is set aside for that scan and the next model of the route answers instead. The scan log names the model that answered, and the scan page lists the model that answered each AI task. When no model of a step the scan cannot do without answers, the scan stops and its log gives the provider's error.

AI usage by task

The AI usage by task card lists, per Task and Model, the Requests, Tokens and Cost, USD over every scan and page request. Cost appears once the model is priced (see Cost below). The tasks that spend most on a strong model are the ones worth trying on a cheaper one.

Keeping code on-premise

AI Native SAST sends source code to the model, so this is the decision that matters most for static analysis.

• Plain http:// addresses are accepted, for a model server inside your network. Over HTTP the key and the prompts, including source code, travel unencrypted: use it only on a network you trust.
• TLS verification cannot be turned off. If an internal certificate authority issued the model's certificate, or a proxy inspects TLS, put the model on the system AI and fill in CA bundle path: the system administrator copies the authority's PEM file to /opt/scansuite/key on the server and enters its path as the containers see it, for example /key/internal-ca.pem. Teams cannot name a CA bundle.

Model choice

Results are written by the model, so they vary a little between runs. Larger models give more consistent results; for local models, 30B parameters is the practical floor if you want reproducible findings rather than suggestions.

Cost

Token usage is counted per team, including usage through a team's own models. Two monthly limits apply, and the lower one wins:

When the month's tokens are used up, AI features pause and AI scanners report that AI is unavailable until the next month or a higher limit. The Monthly token budget card shows what the team has used.

Spend is shown in US dollars once the models are priced. A system administrator fills in the LLM prices card under System Settings → Shared services: a JSON table keyed by model name, with the price per million prompt and completion tokens, for example {"Strong (system)": {"prompt": 3, "completion": 15}}. Use the names listed under Models your teams used; a system model is listed as teams see it. Scan History, the scan page, the Products pages, the Top 10 LLM Token Consuming Targets panel and AI usage by task then show the cost. Changing a price re-prices past scans; token counts never change.

Other AI settings of a team

The How AI handles findings card on the team's AI tab holds two settings that team admins and operators can change:

Where this fits

The other integrations of a team and the system — DefectDojo, Securitm, alerts, Nessus — are in API keys for external systems. Who may change what is in Teams and roles.