## 5 Conclusions and Answers to Research Questions  
This study presents a comprehensive evaluation of reasoning and non-reasoning LLMs for software vulnerability detection. Through extensive experiments on the SARD dataset, we investigated four research questions concerning the performance, cost, interpretability, and limitations of these models. (RQ1) Do reasoning-aware LLMs outperform non-reasoning models in software vulnerability detection? Yes. Through a systematic comparison of representative reasoning models (e.g., DeepSeek-R1, O3-Mini) and non-reasoning models (e.g., GPT-4o-Mini, Claude-3.5-Haiku, DeepSeek-V3), it demonstrates the clear advantages of incorporating structured reasoning mechanisms into vulnerability detection tasks. Experimental results show that reasoning LLMs consistently outperform their non-reasoning counterparts across all major evaluation metrics. In particular, DeepSeek-R1 achieves state-of-the-art performance on the SARD dataset, with an Accuracy of 0.9507, F1-score of 0.9659, and mAP of 0.9756. These results highlight the effectiveness of step-by-step reasoning in enhancing the model's understanding of complex code semantics and in identifying subtle vulnerabilities that heuristic-based models may overlook. (RQ2) What are the trade-offs between performance and cost for different models? Beyond performance, a detailed cost-performance analysis is also conducted. Although reasoning models incur higher token usage, especially in output generation due to explanatory reasoning, their improved precision and reduced false positives contribute to greater overall efficiency and practicality in real-world applications. Among them, DeepSeek-R1 achieves the best trade-off between performance and cost, making it a strong candidate for scalable deployment in software security. (RQ3) Can reasoning traces from DeepSeek-R1 provide interpretable insights into its decision-making process? Yes. DeepSeek-R1 generates coherent reasoning traces that simulate the diagnostic thought process of a human security expert. These traces enhance transparency and interpretability by illustrating how the model identifies, explains, and justifies its vulnerability predictions. The valuable traces offer actionable insights for remediation, making these models valuable tools for developers to improve code quality. (RQ4) What are the potential limitations of reasoning-aware LLMs in the context of software vulnerability detection? Despite their strengths, it is worth noting that despite their strong potential, reasoning LLMs still exhibit several limitations. Error analysis reveals that current models struggle with subtle, domain-specific vulnerabilities. These failures underscore the need for enhanced instruction tuning that not only improves technical comprehension but also emphasizes security risk awareness and encourages attack-aware coding practices. In addition, the inherent complexity of software vulnerabilities, along with adversarial examples specifically crafted to exploit LLM behaviors, continues to increase the difficulty of accurate detection. Moreover, the extensive computational demands required for model inference pose scalability challenges, particularly due to the high costs and energy consumption associated with running LLMs containing tens of billions of parameters. Future research is expected to address these issues through the development of more efficient, task-specific LLMs for vulnerability detection. Lightweight or specialized architectures are also hoped to be explored for software defect detection in future work. In conclusion, this work highlights the transformative potential of reasoning LLMs in automated software vulnerability detection. By addressing the aforementioned limitations through continued research and technical innovation, such models can play a crucial role in building more secure, robust, and intelligent software systems. Conceptualization, W.Q., L.S., L.L. and F.Y. ; methodology, F.Y. ; software, W.Q., L.S. and F.Y. ; validation, W.Q., L.S. and F.Y. ; formal analysis, W.Q.