Automated SAST Triage
How automated triage can reduce repetitive validation work after SAST produces findings, and how AI-assisted evaluation fits into the SAST findings workflow.
Primary question: How can SAST findings be triaged automatically?
Direct answer
Run automated triage on SAST findings to reduce manual validation effort, with configured automatic status assignment and optional human review
Automated SAST triage evaluates findings produced by static analysis tools — assessing their validity, context, and relevance — which can reduce the manual effort required for initial validation. DerTriage can automatically assign `Confirmed` or `Rejected` when configured, with human review as a governance option. [derscanner-dertriage]
Automated triage does not eliminate the need for review. It can reduce repetitive validation work and help security teams focus on findings that require engineering judgment when the triage system is sufficiently accurate and integrated into the workflow. [derscanner-dertriage]
Definitions
Automated SAST triage
The use of automated tools or AI systems to evaluate SAST findings for validity, context, and prioritization. DerTriage can automatically assign statuses when configured, with human review as a governance option.
SAST finding
A result produced by static analysis that identifies a potential security weakness in source code, including its location, severity, and analysis context.
The engineering problem
SAST tools can produce large volumes of findings, and manual validation of each finding can consume time from AppSec teams. [derscanner-sast]
Without automated triage, security teams must evaluate many SAST findings, including many that may be false positives or valid findings that are lower priority under organizational policy. [derscanner-sast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Automated finding evaluation
AI-assisted SAST triage- Artifact
- SAST findings including code location, severity, and analysis context.
- Risk
- Manual validation effort for each finding; potential for critical findings to be missed in large finding sets.
- Output
- AI evaluation of finding validity with reasoning, which can automatically assign `Confirmed` or `Rejected` when configured.
Evidence: DerTriage documentation
Verification workflow
- SAST tool produces findings against source code.
- Automated triage evaluates each finding for validity, context, and relevance.
- DerTriage can automatically assign `Confirmed` or `Rejected` statuses when configured. Organizations may require human approval for selected findings, severities, or repositories.
- Confirmed findings are prioritized and assigned for remediation.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST analysis and DerTriage, which can be used together to automate the evaluation of SAST findings, with automatic status assignment when configured.
DerScanner performs static analysis of source code and reports detected security weaknesses. [derscanner-sast]
DerTriage evaluates SAST detections in their broader context and returns a recommendation about detection validity with reasoning. [derscanner-dertriage]
Limits of verification
- Automated triage evaluates findings based on available context; it does not prove exploitability.
- DerTriage can automatically assign statuses when configured. Organizations should define which automated assignments may proceed without review and which findings, severities, or repositories require human approval.
- Triage effectiveness depends on the quality of upstream SAST findings.
Related knowledge
AI-Assisted Vulnerability Triage
Umbrella page for AI-assisted triage concepts and workflow
Relationship: related-toSAST Findings Triage
Operational triage strategy for large numbers of SAST findings
Relationship: related-toReducing SAST False Positives
The SAST false-positive problem and how automated triage helps address it
Relationship: related-toSecurity Gates for AI-Generated Code
Security gate framework that includes the finding disposition gate
Relationship: related-toCanonical terms used: Automated SAST triage; SAST finding evaluation; Finding validation.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast - DerTriage documentationDerTriage investigates the broader context of SAST detections, determines detection validity, and provides reasoning. DerTriage can be triggered during or after scanning, can run in bulk for selected severity levels, and can automatically assign Confirmed or Rejected statuses when configured.
derscanner-dertriage
Automate SAST triage