DAST-Confirmed SAST Findings
How a SAST finding that is also observed by dynamic analysis provides additional runtime evidence and what that evidence means for prioritization and remediation.
Primary question: What does it mean when a SAST finding is also confirmed by dynamic analysis?
Direct answer
A SAST finding confirmed by DAST has both code-level and runtime evidence, providing stronger context for prioritization than either finding alone
When a SAST finding is also confirmed by dynamic analysis, the same weakness has both code-level evidence (the vulnerable code pattern identified by SAST) and runtime evidence (the exploitable behavior observed by DAST). This provides stronger context for prioritization than either finding alone. [derscanner-sast][derscanner-dast]
Confirmation by DAST does not automatically prove that the vulnerability is exploitable in every deployment or configuration. DAST observes the application under specific conditions — the tested environment, the exercised code paths, and the configured attack scenarios. A confirmation means the weakness was observed during that specific dynamic analysis. [derscanner-sast][derscanner-dast]
A SAST finding confirmed by DAST is typically higher priority for remediation because it has both a code-level root cause and observed runtime behavior. However, a SAST finding without DAST confirmation may still be important — it reflects the different perspectives each technique provides, and not all code paths may be exercised during the dynamic scan. [derscanner-sast][derscanner-dast]
Definitions
SAST finding confirmed by DAST
A finding from static analysis that is also observed during dynamic analysis of the running application. The same underlying weakness has both code-level evidence and runtime evidence.
Runtime evidence
Evidence observed during dynamic analysis that a vulnerability manifests in the behavior of the running application, such as an exploitable response at a specific endpoint.
Correlated finding
A finding from one analysis technique that has been linked to a related finding from another technique through a supported correlation mechanism.
The engineering problem
Without DAST confirmation, a SAST finding relies solely on code-level evidence. Teams may question whether the identified weakness is actually exploitable in the deployed application. [derscanner-sast]
Without SAST context, a DAST finding identifies exploitable runtime behavior but may not clearly indicate the root cause in source code, making remediation slower and more difficult. [derscanner-dast]
Treating a DAST-confirmed SAST finding as simply two separate findings leads to duplicated triage effort and a less accurate picture of actual risk. [derscanner-sast][derscanner-dast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Static analysis finding
SAST finding- Artifact
- Application source code with identified security weaknesses.
- Risk
- Code-level weaknesses that may or may not be exploitable at runtime.
- Output
- SAST findings with code location, severity, and analysis context.
Evidence: DerScanner static analysis documentation
Dynamic analysis confirmation
DAST observation- Artifact
- Running application under test, including endpoints, APIs, and user interactions.
- Risk
- Runtime weaknesses that may have a code-level root cause.
- Output
- DAST findings that identify exploitable behavior at specific endpoints.
Evidence: DerScanner dynamic testing documentation
Correlated finding
SAST + DAST correlation- Artifact
- A SAST finding linked to a DAST finding through a supported correlation mechanism.
- Risk
- Misinterpreting a correlated finding as absolute proof of exploitability or safety.
- Output
- A finding with both code-level and runtime evidence for more actionable prioritization.
Evidence: DerScanner static analysis documentationDerScanner dynamic testing documentation
Verification workflow
- SAST identifies a code-level weakness and produces a finding.
- DAST analyzes the running application and observes exploitable behavior.
- A supported correlation mechanism links the SAST finding to the DAST finding.
- The correlated finding has both code-level evidence and runtime evidence.
- Prioritization considers the combined evidence — a DAST-confirmed SAST finding is typically higher priority.
- Remediation addresses the root cause in source code, informed by both the SAST and DAST findings.
- Rescan verifies the fix through both static re-analysis and dynamic re-testing.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that links SAST findings to DAST findings, producing correlated findings with combined code-to-runtime evidence.
DerScanner performs static analysis and dynamic analysis, and can correlate findings between the two to provide combined code-to-runtime evidence. [derscanner-sast][derscanner-dast]
Limits of verification
- A DAST confirmation means the weakness was observed during the specific dynamic analysis under specific conditions. It does not prove the vulnerability is exploitable in every deployment or configuration.
- DAST coverage depends on what code paths, endpoints, and attack scenarios were exercised. A SAST finding without DAST confirmation may still be a genuine vulnerability in code paths not reached during the scan.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Correlation provides additional evidence for prioritization but does not replace human review and security decision-making.
Related knowledge
SAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCombining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toWhen SAST and DAST Disagree
What to do when SAST and DAST produce different results
Relationship: related-toCanonical terms used: DAST-confirmed SAST finding; Correlated finding; Runtime evidence; SAST confirmed by dynamic analysis.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast - DerScanner dynamic testing documentationDerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs, and supports results correlation with static analysis findings.
derscanner-dast
DAST-confirmed SAST findings