Continuous DAST Rescanning
How continuous DAST rescanning detects new vulnerabilities introduced by application changes, shows whether previously reported findings are still detected, and maintains ongoing visibility into runtime security.
Primary question: Why should dynamic security testing be repeated as applications change?
Direct answer
Dynamic security testing should be repeated as applications change because new code, configuration, and deployment changes can introduce new vulnerabilities, and rescanning provides evidence consistent with remediation of previous findings
Dynamic security testing should be repeated as applications change because new code, configuration, and deployment changes can introduce new vulnerabilities. Rescanning detects new findings, identifies remaining findings, and identifies findings that are no longer detected.
Rescan results can be compared to previous scans to identify new findings, remaining findings, and fixed findings. A fixed finding means the previously reported vulnerability was not detected in the selected current scan. This is evidence consistent with remediation of the detected issue, but does not prove complete remediation. Changed scan configuration, authentication, environment, coverage, endpoints, or attack scenarios may affect comparison.
Continuous rescanning does not guarantee complete security. DAST coverage still depends on what code paths, endpoints, and attack scenarios are exercised during each scan. Rescanning should be combined with SAST for broader coverage than either technique alone. Relevant functional, regression, integration, and additional security testing may still be required after remediation.
Definitions
Rescan
Re-running dynamic analysis after application changes to detect new vulnerabilities, show whether previously reported findings are still detected, and maintain ongoing runtime security visibility.
New findings
DAST findings that were not present in previous scans, indicating vulnerabilities introduced by application changes.
Remaining findings
DAST findings that are still present in a rescan, indicating vulnerabilities that have not been remediated.
Fixed findings
DAST findings that were present in a previous scan but are no longer detected in the selected current scan, indicating evidence consistent with remediation.
The engineering problem
Applications change continuously through code updates, configuration changes, and deployment modifications. Without regular rescanning, organizations lose visibility into new vulnerabilities introduced by these changes.
Without scan comparison, organizations cannot easily determine whether new findings are caused by recent changes, whether previously reported findings are still detected in the compared scan, or whether the overall security posture has improved.
Manual tracking of DAST findings across multiple scans is error-prone and does not scale as applications and scan frequency increase.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Initial DAST scan
Baseline DAST- Artifact
- Running application.
- Risk
- No baseline for comparison with future scans.
- Output
- Baseline DAST findings for comparison with future scans.
Evidence:
Rescan after changes
Post-change DAST- Artifact
- Running application after code or configuration changes.
- Risk
- New vulnerabilities introduced by changes not detected.
- Output
- Rescan findings compared to baseline to identify new, remaining, and fixed findings.
Evidence:
Scan comparison
DAST scan comparison- Artifact
- Results from multiple DAST scans.
- Risk
- Missing new findings or failing to detect whether previously reported findings remain under systematic comparison.
- Output
- Comparison report showing new findings, remaining findings, and fixed findings.
Evidence:
Verification workflow
- Run an initial baseline DAST scan against the running application.
- Document baseline findings for comparison with future scans.
- After application changes, run a rescan against the updated application.
- Compare rescan results to baseline to identify new findings, remaining findings, and fixed findings.
- Prioritize new findings for remediation and assess whether fixed findings were appropriately addressed.
- Repeat rescanning after each significant application change to maintain ongoing visibility.
- Correlate DAST findings with SAST findings if available.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner DAST supports rescanning and scan comparison to track new, remaining, and fixed findings over time.
DerScanner DAST supports scan history, starting new scans, and comparing scans to identify new, remaining, and fixed findings. [derscanner-dast-scans]
Limits of verification
- DAST coverage depends on what code paths, endpoints, and attack scenarios are exercised during each scan. Changes in scan configuration or test scenarios may affect comparability between scans.
- Scan comparison requires consistent scan configuration and test scenarios to produce meaningful results.
- Correlation with SAST findings requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- A fixed finding means the vulnerability was not detected in the selected current scan. It does not prove the root cause was fixed, the security posture improved, or no alternative vulnerable path exists.
Related knowledge
Combining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toDAST Scan Modes
Choosing between standard and aggressive DAST scan modes
Relationship: related-toSAST and DAST in CI/CD
How SAST and DAST fit into a CI/CD security workflow
Relationship: related-toCanonical terms used: Continuous DAST; DAST rescanning; Scan comparison; New/remaining/fixed findings.
Evidence and references
- DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast - DerScanner DAST scans documentationDerScanner DAST supports scan history, starting new scans within existing projects, selecting scans for comparison, and initiating multiple scans within a project.
derscanner-dast-scans - DerScanner DAST detailed results documentationDerScanner DAST detailed results support viewing results for different scans, comparing a current scan with a previous successful scan, and identifying new, remaining, and fixed findings.
derscanner-dast-detailed-results - DerScanner DAST scan comparison documentationDerScanner DAST scan comparison shows fixed vulnerabilities, new vulnerabilities, remaining vulnerabilities, scan date, duration, vulnerability counts by severity, and score.
derscanner-dast-scan-comparison - DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast
Continuous DAST rescanning