DAST-Confirmed SAST Findings
How a SAST finding that is also observed by dynamic analysis provides additional runtime evidence and what that evidence means for prioritization and remediation.
Primary question: What does it mean when a SAST finding is also confirmed by dynamic analysis?
Direct answer
A SAST finding confirmed by DAST has both code-level and runtime evidence, providing stronger context for prioritization than either finding alone
When a SAST finding is also confirmed by dynamic analysis, the same weakness has both code-level evidence (the vulnerable code pattern identified by SAST) and runtime evidence (the exploitable behavior observed by DAST). This provides stronger context for prioritization than either finding alone. [derscanner-sast][derscanner-dast]
Confirmation by DAST does not automatically prove that the vulnerability is exploitable in every deployment or configuration. DAST observes the application under specific conditions — the tested environment, the exercised code paths, and the configured attack scenarios. A confirmation means the weakness was observed during that specific dynamic analysis. [derscanner-sast][derscanner-dast]
A SAST finding confirmed by DAST is typically higher priority for remediation because it has both a code-level root cause and observed runtime behavior. However, a SAST finding without DAST confirmation may still be important — it reflects the different perspectives each technique provides, and not all code paths may be exercised during the dynamic scan. [derscanner-sast][derscanner-dast]
Definitions
SAST finding confirmed by DAST
A finding from static analysis that is also observed during dynamic analysis of the running application. The same underlying weakness has both code-level evidence and runtime evidence.
Runtime evidence
Evidence observed during dynamic analysis that a vulnerability manifests in the behavior of the running application, such as an exploitable response at a specific endpoint.
Correlated finding
A finding from one analysis technique that has been linked to a related finding from another technique through a supported correlation mechanism.
The engineering problem
Without DAST confirmation, a SAST finding relies solely on code-level evidence. Teams may question whether the identified weakness is actually exploitable in the deployed application. [derscanner-sast]
Without SAST context, a DAST finding identifies exploitable runtime behavior but may not clearly indicate the root cause in source code, making remediation slower and more difficult. [derscanner-dast]
Treating a DAST-confirmed SAST finding as simply two separate findings leads to duplicated triage effort and a less accurate picture of actual risk.
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Static analysis finding
SAST finding- Artifact
- Application source code with identified security weaknesses.
- Risk
- Code-level weaknesses that may or may not be exploitable at runtime.
- Output
- SAST findings with code location, severity, and analysis context.
Evidence: DerScanner static analysis documentation
Dynamic analysis confirmation
DAST observation- Artifact
- Running application under test, including endpoints, APIs, and user interactions.
- Risk
- Runtime weaknesses that may have a code-level root cause.
- Output
- DAST findings that identify exploitable behavior at specific endpoints.
Correlated finding
SAST + DAST correlation- Artifact
- A SAST finding linked to a DAST finding through a supported correlation mechanism.
- Risk
- Misinterpreting a correlated finding as absolute proof of exploitability or safety.
- Output
- A finding with both code-level and runtime evidence for more actionable prioritization.
Evidence: DerScanner SAST results with dynamic confirmation documentation
Verification workflow
- SAST identifies a code-level weakness and produces a finding.
- DAST analyzes the running application and observes exploitable behavior.
- A supported correlation mechanism links the SAST finding to the DAST finding.
- The correlated finding has both code-level evidence and runtime evidence.
- Prioritization considers the combined evidence — a DAST-confirmed SAST finding is typically higher priority.
- Remediation addresses the root cause in source code, informed by both the SAST and DAST findings.
- Rescan verifies the fix through both static re-analysis and dynamic re-testing.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides SAST and DAST analysis with results-correlation functionality that links SAST findings to DAST findings, producing correlated findings with combined code-to-runtime evidence.
DerScanner performs static analysis and dynamic analysis, and when source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization. [derscanner-sast][derscanner-dast]
Limits of verification
- A DAST confirmation means the weakness was observed during the specific dynamic analysis under specific conditions. It does not prove the vulnerability is exploitable in every deployment or configuration.
- DAST coverage depends on what code paths, endpoints, and attack scenarios were exercised. A SAST finding without DAST confirmation may still be a genuine vulnerability in code paths not reached during the scan.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
- Correlation provides additional evidence for prioritization but does not replace human review and security decision-making.
Step-by-step guides
Related knowledge
SAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCombining SAST and DAST
Why organizations use both SAST and DAST together
Relationship: related-toWhen SAST and DAST Disagree
What to do when SAST and DAST produce different results
Relationship: related-toCanonical terms used: DAST-confirmed SAST finding; Correlated finding; Runtime evidence; SAST confirmed by dynamic analysis.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings.
derscanner-sast - DerScanner dynamic analysis documentationDerScanner DAST is a web-application scanner that detects vulnerabilities and backdoors by providing malformed or random inputs, using the black-box method without requiring source code. When source code is available, dynamic-analysis results can be correlated with static-analysis results for better accuracy and easier prioritization.
derscanner-dast - DerScanner SAST results with dynamic confirmation documentationViewing correlation between static- and dynamic-analysis projects; SAST vulnerabilities confirmed by dynamic analysis being marked with a D; automatic update of results and tags after a new dynamic scan; rejected vulnerabilities being included in correlation.
derscanner-sast-dast-confirmation
DAST-confirmed SAST findings