Open-weight vs frontier models: the economics of an AI security harness

Open-weight models change the marginal cost of AI code review, but the cheapest credible design is not an open model running alone. Normalized to one million lines of code, our tiered harness routed about 718 million input tokens and 127 million output tokens: three pooled discovery passes, verification over 15 percent of the workload, and frontier adjudication over the top 5 percent.

These are normalized workload figures, not customer pricing or a quality benchmark. They are derived from the token profile of a completed harness run and mapped to a relative cost index using August 2026 AWS Bedrock rates in us-east-1. Engineering, evaluation, storage and review labor sit outside the index.

Amazon Bedrock pricingBedrock service tiers

A single model pass over one million lines routes about 224 million input tokens and 40 million output tokens, using 11 tokens per line, a 24 times harness reread multiplier, and an 85 to 15 input-output split. Applying that common workload to each model makes the relative rate-card difference visible.

A lower index does not establish detection quality. Our earlier runs showed that model configurations specialize by language and vulnerability class, and that their findings overlap very little. A pass at 0.11x only matters if it finds the class you asked it to hunt. The economic advantage comes from buying several different discovery views before paying for expensive judgment. It does not come from treating the lowest-cost model as interchangeable with the highest.

Read the findings comparison

The tiered design separates recall from confidence. Discovery pools three models because different models surface different defects. Verification uses a separate model whose job is to challenge the candidate rather than defend it. Frontier adjudication is limited to the small set that survives both stages.

Using the tiered model mix above, incremental PR scans analyze new code as it is introduced and reuse cached dependency context. At 600 net-new lines per PR across 100 PRs, they analyze 60,000 lines. A release-only gate analyzes those changes plus the unchanged 4.8 million-line repository, for 4.86 million lines in total. That means the incremental path analyzes over 98% less code. Both paths grow with new code, but only the release gate keeps paying to reread the existing repository.

Use open-weight models when scan volume, source control, model rotation or deployment boundaries make marginal cost and replaceability important. Use frontier models directly when volume is low, their measured capability on the target defect class justifies the premium, or review labor dominates the bill. For a continuous security harness, the stronger default is mixed: cheap and diverse discovery, an independent validator, and frontier escalation for the narrow set that deserves it.

In the next note, we will go inside that system: what we learned from assigning different models to discovery, verification and judge work, where CDM-based models and Jev-like classifiers fit, and how our model router chooses the right inference path for the task, evidence requirement, deployment boundary and budget.

Open weight makes repeated analysis affordable. Frontier models remain useful for hard judgment. Scoping determines whether either can run continuously. The cost comparison only becomes meaningful when all three are designed as one system.