Can we trust AI to find the vulnerabilities that matter?