DAST Finding Not Found by SAST
Reasons why dynamic analysis may observe exploitable behavior that static analysis does not identify, including runtime configuration, authentication behavior, and exposed interfaces.
Primary question: Why might DAST identify a vulnerability that SAST does not report?
Direct answer
DAST may identify weaknesses that SAST does not report because DAST observes runtime behavior including configuration issues, authentication-related weaknesses, and exposed interfaces that static analysis cannot observe in source code
DAST may identify weaknesses that SAST does not report because DAST observes the running application in its deployed state. Runtime configuration issues — such as insecure HTTP settings, debug mode enabled, or exposed administrative interfaces — exist in the deployment but are not visible in source code alone. [derscanner-dast]
DAST may identify authentication-related weaknesses that SAST cannot observe. Broken access control, session management issues, and token validation problems often depend on runtime behavior, framework configuration, and user interactions that static analysis cannot fully determine. [derscanner-dast]
DAST may identify weaknesses in exposed interfaces that SAST does not report because static analysis may not discover all deployed endpoints, especially those generated dynamically, exposed through API gateways, or accessible only through specific network paths. [derscanner-dast]
A DAST finding not identified by SAST does not prove that SAST is incomplete or inaccurate. SAST and DAST observe different properties of the application. A DAST-only finding may indicate a runtime issue that requires configuration changes, access control adjustments, or interface hardening rather than source code changes. [derscanner-sast][derscanner-dast]
Definitions
Runtime configuration weakness
A weakness that exists due to the configuration of the running application rather than the source code itself — for example, insecure HTTP settings, debug mode enabled, or exposed administrative interfaces.
Authentication-related weakness
A weakness that manifests only when specific authentication states or user roles are present, such as broken access control that depends on session behavior or token validation at runtime.
Exposed interface
An API endpoint, web page, or service that is accessible from the network and may be exercised by attackers, which static analysis may not fully discover without knowledge of the deployment topology.
The engineering problem
Security teams may over-rely on SAST and underestimate DAST coverage, assuming that SAST findings represent the complete set of vulnerabilities when runtime configuration and authentication issues may exist independently. [derscanner-dast]
DAST findings without SAST correlation may be harder to remediate because the root cause may not be clearly identifiable from source code alone — it may require configuration changes, framework adjustments, or infrastructure modifications. [derscanner-dast]
Without DAST, organizations miss runtime-configured weaknesses and authentication-related issues that only manifest when the application is running with real data and user interactions. [derscanner-dast]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Runtime configuration review
DAST configuration analysis- Artifact
- Running application configuration, deployed endpoints, and runtime settings.
- Risk
- Runtime configuration weaknesses not identified by SAST because they exist outside the source code.
- Output
- DAST findings about insecure configuration, exposed interfaces, and runtime behavior.
Evidence: DerScanner dynamic testing documentation
Authentication and access control review
DAST authentication analysis- Artifact
- Running application with authentication and authorization mechanisms.
- Risk
- Authentication-related weaknesses that SAST cannot observe because they depend on runtime session behavior.
- Output
- DAST findings about broken access control, session management issues, and token validation problems.
Evidence: DerScanner dynamic testing documentation
Exposed interface discovery
DAST endpoint discovery- Artifact
- Running application, including all accessible endpoints and APIs.
- Risk
- Exposed interfaces not discovered by SAST because they are generated dynamically or accessible only through specific network paths.
- Output
- DAST findings about exploitable behavior at discovered endpoints.
Evidence: DerScanner dynamic testing documentation
Verification workflow
- DAST analyzes the running application and produces findings about runtime weaknesses.
- SAST does not identify corresponding findings for some or all DAST results.
- Security teams investigate whether the DAST finding relates to runtime configuration, authentication behavior, or an exposed interface.
- If the finding relates to configuration, the infrastructure or deployment team addresses it.
- If the finding relates to authentication or access control, the application team reviews the relevant code and configuration.
- If the finding relates to an exposed interface, the team assesses whether the interface should be accessible and whether appropriate controls are in place.
- Remediation is applied and verified through rescan.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides DAST analysis that identifies runtime weaknesses including configuration issues, authentication-related weaknesses, and exploitable behavior at exposed interfaces.
DerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs. [derscanner-dast]
Limits of verification
- DAST findings without SAST correlation may be harder to remediate because the root cause may not be clearly identifiable from source code alone.
- DAST coverage depends on what endpoints, authentication states, and attack scenarios are tested. Not all exposed interfaces or runtime configurations may be exercised during the scan.
- Correlation requires a supported mechanism; not all SAST and DAST tools provide correlation functionality.
Related knowledge
When SAST and DAST Disagree
How to interpret and resolve SAST/DAST disagreements
Relationship: related-toSAST Finding Not Found by DAST
Why SAST may identify vulnerabilities that DAST does not detect
Relationship: related-toSAST/DAST Results Correlation
How findings from static and dynamic analysis are linked
Relationship: related-toCode-to-Runtime Security Testing
Connecting code-level weaknesses with runtime application behavior
Relationship: related-toCanonical terms used: DAST finding not found by SAST; DAST-only finding; Runtime configuration weakness; Authentication-related weakness.
Evidence and references
- DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast - DerScanner dynamic testing documentationDerScanner performs dynamic analysis of running applications, identifying exploitable behavior at endpoints and APIs, and supports results correlation with static analysis findings.
derscanner-dast
DAST finding not found by SAST