How can organizations perform SAST and SCA analysis on organization-controlled infrastructure?

Local Hybrid SAST + SCA Analysis

Direct answer

SAST, SCA, and hybrid analysis can be deployed on organization-controlled infrastructure

DerScanner's SAST, DAST, and SCA modules can be installed on one server or distributed across multiple servers within one network. [derscanner-server-requirements]

Installing the modules on organization-controlled servers provides a basis for local processing, but whether the deployment satisfies a specific data-residency or disconnected-operation requirement depends on configured network paths, licensing, telemetry, update mechanisms, and package and vulnerability data sources. Local deployment is not automatically the same as fully air-gapped operation. [derscanner-server-requirements]

Hybrid analysis — correlating SCA findings with SAST findings to determine reachability of vulnerable functions — can also be performed within organization-controlled infrastructure, combining the benefits of local deployment with code-level prioritization evidence. [derscanner-sca][derscanner-server-requirements]

Definitions

On-premises deployment

Deploying security analysis tools within the organization's own infrastructure, such as internal servers, local network, or private data center, so that source code and analysis results remain within organization-controlled infrastructure.

Local network deployment

Deploying security analysis tools on the organization's internal network, accessible to build systems and CI/CD pipelines, without requiring internet access to a cloud service provider.

Hybrid SAST + SCA analysis

The correlation of SCA findings (vulnerable components) with SAST findings (application code behavior) to determine which vulnerable dependency functionality is actually reached from application code. Hybrid analysis can be performed within organization-controlled infrastructure.

Air-gapped environment

A network-isolated environment that has no connection to external networks, including the public internet. Air-gapped environments require special considerations for SBOM and SCA analysis because public package registries and vulnerability databases are unreachable.

The engineering problem

Organizations with strict data residency, export control, or intellectual property requirements may not be able to send source code to cloud-based security analysis services. This creates a gap in their security analysis workflow. [derscanner-sast]

Cloud-based SCA services may require source code or dependency information to be uploaded to external infrastructure, which may not be acceptable for all organizations. [derscanner-sca]

Air-gapped environments present additional challenges — public package registries and vulnerability databases are unreachable, requiring offline SBOM generation and local vulnerability data sources. Full disconnected SCA or hybrid operation requires vendor confirmation of vulnerability-feed updates, licensing, telemetry, package resolution, and update procedures. [offline-sbom-generation]

Security controls

Each control inspects a different artifact and produces evidence for an engineering decision.

On-premises SAST deployment

Local static analysis

Artifact: Application source code scanned within organization-controlled infrastructure.
Risk: Security weaknesses in application code that are not detected because analysis requires external service access.
Output: SAST findings produced within the organization's infrastructure.

Evidence: DerScanner static analysis documentation DerScanner Server Requirements

On-premises SCA deployment

Local software composition analysis

Artifact: Dependency manifests and installed components analyzed within organization-controlled infrastructure.
Risk: Vulnerable or license-restricted dependencies that are not detected because SCA requires external vulnerability database access.
Output: SCA findings produced within the organization's infrastructure, with dependency information remaining on-premises.

Evidence: DerScanner software composition analysis documentation DerScanner Server Requirements

On-premises hybrid analysis

Local hybrid SAST+SCA analysis

Artifact: SCA findings and SAST findings correlated within organization-controlled infrastructure.
Risk: Vulnerable dependency functionality that is not correlated with application code usage because hybrid analysis requires external service access.
Output: Code-level reachability evidence produced within the organization's infrastructure.

Evidence: DerScanner software composition analysis documentation DerScanner Server Requirements

Verification workflow

Deploy SAST, SCA, and hybrid analysis tools within organization-controlled infrastructure (on-premises servers or local network).
Run SAST analysis on application source code within the local environment.
Run SCA analysis on dependency manifests and installed components within the local environment.
Run hybrid SAST+SCA analysis to correlate SCA findings with SAST findings and produce reachability evidence.
Integrate the local analysis tools into the CI/CD pipeline so that builds trigger local security analysis within the organization's infrastructure.
For air-gapped environments, configure offline vulnerability databases and local package repositories as described in the Offline SBOM Generation guidance. Full disconnected SCA or hybrid operation requires vendor confirmation of update mechanisms and data sources.
Review findings within the organization's infrastructure.

DerScanner · Enterprise

Relationship to DerScanner

DerScanner provides SAST, SCA, and hybrid SAST+SCA capabilities, and its analysis modules can be installed on one server or distributed across multiple servers within one network.

DerScanner modules can be installed on organization-controlled servers for SAST analysis. [derscanner-server-requirements]

DerScanner provides SCA and hybrid SAST+SCA capabilities, while its SCA module can be installed on organization-controlled servers. [derscanner-sca][derscanner-server-requirements]

Explore the DerScanner product line →

Limits of verification

On-premises deployment requires the organization to manage its own infrastructure, including updates to vulnerability databases and tool versions.
Local deployment is not automatically the same as fully air-gapped; air-gapped environments require additional considerations for offline vulnerability feeds, package resolution, signatures, and update procedures. Full disconnected SCA or hybrid operation requires vendor confirmation.
Production acceptance remains an organizational engineering decision.

Dependency Security for AI-Generated Code

Umbrella page covering the broader dependency security analysis model for AI-generated applications

Relationship: related-to

Hybrid SAST + SCA Analysis

Overview of hybrid SAST+SCA analysis concept and engineering model

Relationship: related-to

Offline SBOM Generation in Air-Gapped Environments

SBOM generation in air-gapped environments using corporate repositories; full disconnected SCA/hybrid requires vendor confirmation

Relationship: related-to

Reducing SCA Noise with Reachability

How reachability evidence helps prioritize SCA findings

Relationship: related-to

Dependency Security Gates for AI Coding

Where dependency security checks are placed in the AI-assisted development workflow

Relationship: related-to

DerScanner

Product line providing on-premises SAST, SCA, and hybrid analysis capabilities

Relationship: related-to

Canonical terms used: On-premises deployment; Local network deployment; Hybrid SAST + SCA analysis; Air-gapped environment.

Evidence and references

DerScanner static analysis documentationDerScanner performs static analysis and reports source-code security findings, including vulnerable imports and function calls to dependencies.derscanner-sast
DerScanner software composition analysis documentationDerScanner SCA identifies component vulnerabilities, dependencies, software supply chain risks, and license risks. DerScanner provides hybrid SAST+SCA analysis to correlate SCA findings with SAST findings for dependency vulnerability prioritization.derscanner-sca
DerScanner Server RequirementsDerScanner is delivered as application, SAST, DAST, and SCA modules; the required analysis modules can be installed on one server or distributed across multiple servers within one network.derscanner-server-requirements
Offline SBOM generation in air-gapped environmentsOrganizations can generate SBOMs in air-gapped environments using corporate repositories as registry substitutes. Full disconnected SCA or hybrid operation requires vendor confirmation.offline-sbom-generation

Local SAST + SCA deployment

Deploy SAST, SCA, and hybrid analysis on organization-controlled infrastructure.

Tell us about your data residency requirements and deployment model. The DerScanner team will help you plan on-premises SAST+SCA deployment.

Discuss on-premises deployment Explore DerScanner

SAST, SCA, and hybrid analysis can be deployed on organization-controlled infrastructure

Definitions

On-premises deployment

Local network deployment

Hybrid SAST + SCA analysis

Air-gapped environment

The engineering problem

Security controls

On-premises SAST deployment

On-premises SCA deployment

On-premises hybrid analysis

Verification workflow

Relationship to DerScanner

Limits of verification

Related knowledge

Dependency Security for AI-Generated Code

Hybrid SAST + SCA Analysis

Offline SBOM Generation in Air-Gapped Environments

Reducing SCA Noise with Reachability

Dependency Security Gates for AI Coding

DerScanner

Evidence and references

Deploy SAST, SCA, and hybrid analysis on organization-controlled infrastructure.

Discuss on-premises SAST + SCA deployment for your organization