Models generate text, not exploits. Execution, state coherence across 50+ step attack chains, finding validation, and safety enforcement all live outside the model, and each is an engineering problem, not a reasoning problem. Unvalidated model output and traditional DAST scanners land in the 50–70% false-positive range, while FireCompass reports below 2% because every finding is proven against the live target before it appears. In FireCompass testing, the full harness of routed frontier models, purpose-built small models, orchestrated agents, and validated execution produces roughly 3X to 10X the result of a plain frontier model with tools connected.