Bitsec (SN60) Is Pricing Security Like Hosting Rather Than an Event

Speaking on a Beyond Finance community call, Bitsec (SN60) laid out a result that redefines what security testing on Bittensor should catch.

A frontier model ran a client codebase and returned a clean, accurate report of roughly 60 vulnerabilities, none of them critical.

Bitsec ran its own agents across the same code and surfaced more than 160, including five criticals the frontier model never flagged.

The model found real bugs and described them correctly before it stopped looking, which is exactly the gap continuous testing exists to close.

Why a Yearly Audit Is the Wrong Way to Look at Codes

Bitsec argues that traditional audits are structurally mismatched to how code behaves over time.

A team freezes its codebase, fixes what the report names, and keeps shipping against a snapshot that already went stale since last audit.

1. Human audits start at $25,000 to $50,000 and climb into the millions on larger codebases

2. The review happens once a year at best, and often never happens after that

3. The report describes a version of the code that has evolved over time

A practical example was when a protocol on the Move blockchain lost $250 million despite the layers of traditional audit it passed. Bitsec later went at that same Move protocol and found the exploit in 10 to 15 minutes on a language it had never trained against.

How the Competition Stays Sealed Off

No serious protocol hands a crowd of strangers its private code, which is the obvious objection to decentralized security.

Bitsec answers it by never letting the two sides meet, running the competition on codebases it controls with known exploits planted inside.

1. Miners build agents to find planted vulnerabilities on Bitsec’s own code, never the client’s

2. Agents must find every critical and high-severity issue, and missing one fails the whole run

3. Only winning agents reach client work, alongside in-house agents hunting novel exploits

4. Findings arrive chained into criticals, each with a test that proves the vulnerability exists

Once fixes go in, everything gets rescanned from scratch, because a fix routinely opens fresh surface area of its own.

The Economics That Flip Security Into a Running Cost

A quality human audit starts around $2,000 per 100 non-test, non-comment lines of code, and climbs from there. Bitsec charges roughly $250 for that same unit and turns it around in hours or days rather than months.

1. Audits sell in sets of four, since one snapshot is the thing the subnet argues against

2. Four audits at $250 per 100 lines cost half of one audit at the bottom of the human range

3. The introductory price should roughly double soon, still a quarter of the incumbent at $500

4. The real cost line is inference, which keeps falling as cheaper models reach frontier parity

At an eighth of the incumbent price, an audit becomes a recurring cost like hosting rather than a capital event braced for once a year.

The Buyers Showing Up Weren’t the Ones Expected

Bitsec launched wanting to audit subnets, and subnets have mostly not bought, since a team treating its own mechanism as broken feels no urgency about a security budget.

What converts instead is the audience already spending $25,000 to $100,000 on audits and needing no convincing the category matters.

Web2 companies now approach the team unprompted, and the direction of travel points out of crypto toward npm supply chain attacks and AI-written code arriving faster than anyone can review it.

SN60 is live with two clients closed and several more expected, bootstrapped by a tiny team, with a trust badge called Sentios that links back to Bitsec on every covered repo.