Hybrid SAST + SCA Analysis
Hybrid SAST+SCA analysis correlates SCA findings (vulnerable components) with SAST findings (application code behavior) to construct code-level reachability evidence, enabling more accurate prioritization of dependency vulnerabilities.
Primary question: What is hybrid SAST + SCA analysis and why combine source-code analysis with dependency analysis?
Direct answer
Combine SCA and SAST to correlate vulnerable components with application code usage
Hybrid SAST+SCA analysis correlates SCA findings (vulnerable components) with SAST findings (application code behavior) to determine which vulnerable dependency functionality is actually reached from application code. This provides code-level reachability evidence that is stronger for prioritization than treating every vulnerable component identically. [derscanner-sca]
SCA identifies vulnerable components. SAST observes application code and vulnerable imports or function calls. Hybrid analysis correlates both and constructs code-level reachability evidence for dependency vulnerabilities. [derscanner-sca]
Hybrid analysis correlates SCA findings with SAST findings to prioritize dependency vulnerabilities based on code-level reachability evidence. [derscanner-sca]
Definitions
Hybrid SAST + SCA analysis
The practice of correlating SCA findings (which components are vulnerable) with SAST findings (what the application code does) to determine which vulnerable dependency functionality is actually reached from application code. Hybrid analysis provides code-level reachability evidence for dependency vulnerabilities.
SCA finding
A finding produced by Software Composition Analysis that identifies a vulnerable component, license risk, or supply-chain risk associated with a third-party dependency.
SAST finding
A finding produced by Static Application Security Testing that identifies a security weakness in application source code, including input handling issues and vulnerable function calls.
Reachability evidence
Code-level evidence showing that vulnerable functionality inside a dependency is actually reached from application code through import statements and function calls.
The engineering problem
SCA analysis identifies vulnerable components but does not determine whether the vulnerable functionality is actually used from application code. This means every vulnerable component produces a finding, regardless of whether it is reachable from the application. [derscanner-sca]
Without hybrid analysis, teams must triage all SCA findings individually to determine which vulnerable components are actually used, which is time-consuming and error-prone at scale. [derscanner-sca]
SCA findings alone cannot distinguish between a vulnerable component that is imported and called from application code and a vulnerable component that is present but not used, making prioritization less accurate. [derscanner-sca]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Dependency vulnerability identification
SCA analysis- Artifact
- Dependency manifests, component metadata, and vulnerability database entries.
- Risk
- Undetected vulnerabilities in third-party components.
- Output
- Component-level vulnerability findings with severity classification.
Evidence: DerScanner software composition analysis documentation
Application code analysis
SAST analysis- Artifact
- Application source code, including import statements and function calls.
- Risk
- Security weaknesses in application code, including vulnerable imports and function calls to dependencies.
- Output
- SAST findings that identify vulnerable code paths, including imports and calls to dependency functions.
Evidence: DerScanner static analysis documentation
Reachability correlation
Hybrid SAST + SCA analysis- Artifact
- SCA findings and SAST findings correlated to determine which vulnerable dependency functions are actually reached from application code.
- Risk
- Vulnerable components whose vulnerable functionality is not reached from application code, leading to over-prioritization.
- Output
- Code-level reachability evidence showing vulnerable imports, function calls, and call traces for vulnerable dependency functions.
Evidence: DerScanner software composition analysis documentation
Verification workflow
- Run SCA analysis to identify all vulnerable components in the project.
- Run SAST analysis to identify all imports and function calls in the application source code.
- Correlate SCA findings with SAST findings to determine which vulnerable dependency functions are actually imported or called from application code.
- Construct reachability evidence for each vulnerable component, showing the code path from application code to the vulnerable function inside the dependency.
- Use call trace data to understand the data-flow path from application code through imports to vulnerable dependency functions.
- Prioritize findings based on reachability evidence — reachable vulnerable functions are higher priority than unreachable ones.
- Integrate hybrid analysis into the build process for continuous dependency security visibility.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides hybrid SAST+SCA analysis as a core capability, correlating SCA findings with SAST findings to produce reachability evidence for dependency vulnerabilities.
DerScanner performs hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization. [derscanner-sca]
Limits of verification
- Reachability analysis provides evidence about code paths but does not by itself prove exploitability. A static result of 'not found reachable' may be a false negative because unsupported dynamic behavior, reflection, native boundaries, framework behavior, or configuration can create runtime paths not represented in the static model.
- Hybrid analysis requires source code availability; code-level reachability evidence may not be available for artifacts without source access.
- Reachability analysis coverage varies by language and dependency depth.
- Hybrid analysis may not detect vulnerabilities that require runtime behavior or integration testing to exploit.
- Production acceptance remains an organizational engineering decision.
Related knowledge
SBOM vs SCA vs Hybrid Analysis
Overview of the three-layer model (SBOM, SCA, hybrid analysis)
Relationship: related-toVulnerable Function Reachability
Deep technical explanation of reachability analysis
Relationship: related-toReducing SCA Noise with Reachability
How reachability analysis helps prioritize SCA findings
Relationship: related-toDependency Security for AI-Generated Code
Umbrella page covering the broader dependency security analysis model
Relationship: related-toDerScanner
Product line providing hybrid SAST+SCA analysis capabilities
Relationship: related-toCanonical terms used: Hybrid SAST + SCA analysis; Reachability evidence; Vulnerable imports; Call trace.
Evidence and references
- DerScanner software composition analysis documentationDerScanner SCA identifies component vulnerabilities, dependencies, software supply chain risks, and license risks. DerScanner provides hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization.
derscanner-sca - DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.
derscanner-sast
Hybrid SAST + SCA analysis