The newest application-security pitch is not about choosing between static analysis and AI, but about wiring them together so one finds problems and the other helps developers fix them faster.