The commercial argument behind Microsoft's new security platform isn't that it finds more flaws than competitors. It's that it finds them sooner, because routing economics make continuous scanning viable.
The difference between periodic and continuous scanning is the exposure window. A weekly analysis finds the problem up to seven days after it enters the code, and that interval is exactly what an attacker needs. The signing key exposed in a public repository, reported weeks later, is the perfect illustration: the problem existed and nobody was looking at that moment.
What made continuous scanning impractical was cost. Running all code through a frontier model on every change is too expensive for most operations. Triaging with a cheap model and escalating only the hard cases changes that arithmetic.
The design carries an embedded risk worth naming: if cheap triage misclassifies a serious case as trivial, it never reaches the model capable of understanding it. System quality then depends on filter calibration rather than on the best available model.
Every automated barrier teaches the identical lesson: the value lies in having exercised it with a known case before treating it as protection.