The Manual Review Argument
The case for manual code review as an AI security control goes roughly like this: require developers to review the code they are about to send to an AI tool, strip any proprietary identifiers, and paste only sanitized code into prompts.
This approach has two things going for it. It requires no tooling investment. And it theoretically works for disciplined developers.
In practice, it does not hold up at team scale.
Where Manual Review Fails
Coverage
A developer reviewing 200 lines of code before pasting it into a Claude prompt is looking for obvious identifiers: the function named after the company's proprietary trading strategy, the class named after the internal product. They are not systematically scanning every variable name, every parameter name, every return type.
Studies of manual code review for sensitive data detection consistently find 40-60% false negative rates. Half of the proprietary identifiers that should be caught are not.
With Pretense, coverage is 100% by construction. Every identifier in the code block is evaluated. There is no human attention cost.
Speed
Manual review of a code block for AI submission takes 2-5 minutes for a careful developer. Multiply that by the frequency of AI tool use (industry average: 15-20 AI prompts per developer per day for active Copilot/Claude users) and you get 30-100 minutes per developer per day spent on manual review.
That is the productivity cost the manual review approach imposes. It partially offsets the productivity gains that made AI coding tools worth adopting.
Pretense adds 2-8ms per request. The developer never notices it.
Consistency
Manual review quality varies by developer, by time of day, by workload. A developer under deadline pressure at 4pm reviews prompts less carefully than the same developer on a focused morning. A senior developer with deep domain knowledge spots proprietary identifiers a junior developer would miss.
Pretense applies the same mutation algorithm to every prompt, regardless of who sent it or when.
Side-by-Side Comparison
| Factor | Manual Review | Pretense |
|---|---|---|
| Coverage rate | 40-60% | 100% |
| Review time per prompt | 2-5 minutes | 2-8ms |
| Consistency | Variable (by developer, context) | Identical across all requests |
| Audit trail | None | Complete log per request |
| Scales with team growth | Linearly more expensive | Flat cost per seat |
| Enforceability | Policy only | Technical control |
| SOC2 evidence | Developer attestation | Machine-generated log |
The Enforceability Problem
Manual review is an advisory control, not a technical control. You can write a policy that says developers must review code before submitting to AI tools. You cannot technically enforce it.
A developer who forgets, rushes, or disagrees with the policy will skip the review. You will not know it happened until after an incident.
Pretense is a technical control. It runs in the request path. Developers cannot bypass it without changing their environment configuration, an action that generates an audit event.
What This Means for SOC2
SOC2 auditors evaluate the operating effectiveness of controls over a 12-month period. They ask for evidence that the control was applied consistently.
For manual review, the evidence is: a policy document, developer training records, and an attestation that developers followed the policy. Auditors know these are weak controls.
For Pretense, the evidence is: proxy logs showing every AI API call for the audit period, mutation records for each call, and statistics on secrets blocked. These are strong controls.
The difference matters not just for audit outcomes but for the enterprise sales cycle. When a CISO at a prospect company asks "what controls do you have over AI coding tool usage?", a machine-generated audit log is a materially better answer than "we train developers on the policy."
The Scaling Problem
Manual review costs scale linearly with team size and AI tool usage. Every new developer hired adds proportionally to the manual review burden. As developers use AI tools more frequently (the trend is upward), review time increases.
Pretense pricing is per seat. Operational cost does not increase with usage frequency.
A 10-person team doing 15 prompts per day each: 150 prompts, 5-12 hours of manual review per day across the team. Or $990/month for Pretense and zero manual review time.
At 50 developers: 750 prompts per day, 25-60 hours of manual review. Or $4,950/month.
The ROI calculation improves with team size, not the reverse.
Where Manual Review Still Has Value
Manual review is not completely without value. There are cases where a developer should slow down and think carefully about what they are about to send to an AI tool: novel prompting strategies, unusual data structures, edge cases that automated scanning might miss.
The right model is not manual review instead of Pretense. It is Pretense as the baseline technical control, with manual review reserved for the high-stakes cases where developer judgment adds value beyond what automation can provide.
See Pretense in action on your codebase or start a free trial today.
