Code-to-Runtime Security Testing
How security teams can use SAST and DAST together to connect code-level weaknesses identified by static analysis with runtime behavior observed by dynamic analysis.
Primary question: How can security teams connect code-level weaknesses with runtime application behavior?
Direct answer
Code-to-runtime security testing connects SAST findings (code-level weaknesses) with DAST findings (runtime behavior) to provide a complete picture of how vulnerabilities exist in code and manifest in the running application
Code-to-runtime security testing connects SAST findings about code-level weaknesses with DAST findings about runtime behavior. SAST provides code-level evidence — where the weakness exists in the source code. DAST provides runtime evidence — how the weakness manifests in the behavior of the running application. Together, they provide a more complete picture than either technique alone. [derscanner-sast][derscanner-dast]
A SAST finding identifies the root cause in source code. A DAST finding identifies the exploitable behavior at runtime. When both findings relate to the same underlying weakness, the connection between them provides actionable evidence for remediation — the development team knows both what to fix and why it matters. [derscanner-sast][derscanner-dast]
Code-to-runtime security testing is enabled by correlation between SAST and DAST findings. A supported correlation mechanism links findings from both analyses that relate to the same underlying weakness, providing both code-level and runtime evidence for more actionable prioritization and remediation. [derscanner-sast][derscanner-dast]
Definitions
Code-level evidence
Evidence from static analysis about the presence of security weaknesses in source code, including code location, vulnerable function calls, and input handling issues.
Runtime evidence
Evidence from dynamic analysis about the presence of exploitable behavior in the running application, including endpoint responses, attack vectors, and observed vulnerability manifestations.
Code-to-runtime connection
The process of linking code-level evidence from SAST with runtime evidence from DAST to understand how a vulnerability exists in code and manifests at runtime.
The engineering problem
SAST findings alone provide code-level evidence but no visibility into whether the weakness manifests at runtime. DAST findings alone provide runtime evidence but no clear indication of the root cause in source code. [derscanner-sast][derscanner-dast]
Without a code-to-runtime connection, remediation teams must manually determine which SAST findings correspond to which DAST findings, which is time-consuming and error-prone at scale. [derscanner-sast][derscanner-dast]
Organizations that use only SAST or only DAST have an incomplete picture of application security — they either know about code weaknesses without runtime confirmation, or runtime behavior without code-level root cause. [derscanner-sast][derscanner-dast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Code-level evidence collection
SAST analysis- Artifact
- Application source code.
- Risk
- Code-level weaknesses without runtime context.
- Output
- SAST findings with code location, severity, and analysis context.
Evidence: DerScanner static analysis documentation
Runtime evidence collection
DAST analysis- Artifact
- Running application.
- Risk
- Runtime weaknesses without code-level root cause.
- Output
- DAST findings with endpoint, attack vector, and runtime evidence.
Evidence: DerScanner dynamic testing documentation
Code-to-runtime correlation
SAST/DAST correlation- Artifact
- SAST findings and DAST findings linked through a supported correlation mechanism.
- Risk
- Missing the connection between code-level weaknesses and runtime behavior.
- Output
- Correlated findings with both code-level and runtime evidence.
Evidence: DerScanner static analysis documentationDerScanner dynamic testing documentation
Verification workflow
- SAST analyzes source code and produces findings about code-level weaknesses.
- DAST analyzes the running application and produces findings about runtime weaknesses.
- A supported correlation mechanism links SAST findings to DAST findings that relate to the same underlying weakness.
- The correlated finding provides both code-level evidence (root cause in source code) and runtime evidence (exploitable behavior).
- Security teams use the combined evidence for prioritization and remediation.
- Development teams use the code-level evidence to locate and fix the root cause, informed by the runtime evidence about why the fix matters.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that connects code-level findings with runtime findings to provide code-to-runtime evidence.
DerScanner performs static analysis and dynamic analysis, and can correlate findings between the two to provide combined code-to-runtime evidence. [derscanner-sast][derscanner-dast]
Limits of verification
- Code-to-runtime correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Not every SAST finding will have a corresponding DAST finding, and not every DAST finding will have a corresponding SAST finding, due to the different perspectives each technique provides.
- Correlation provides structured evidence but does not replace human review and security decision-making.
Related knowledge
SAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCombining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toStatic and Dynamic Security Testing Workflow
A practical combined SAST and DAST workflow
Relationship: related-toWhen SAST and DAST Disagree
What to do when SAST and DAST produce different results
Relationship: related-toCanonical terms used: Code-to-runtime testing; SAST DAST correlation; Code-level evidence; Runtime evidence; Vulnerability manifestation.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast - DerScanner dynamic testing documentationDerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs, and supports results correlation with static analysis findings.
derscanner-dast
Code-to-runtime security testing